1. Cybersecurity News: Vermont, Colorado and Maybe California by Donna Wilson, Charles Washburn, Jr., Brett Natarelli

Going forward data brokers in Vermont will need to take the appropriate security measures before gathering information on users and notify the state if they've experienced a breach. Writing in Lexology, a legal water cooler blog of sorts, attorneys with Manatt Phelps & Phillips LLP, a law firm based in L.A. said the move makes Vermont the first state in the country to regulate the activity of data brokers. Brokers in the state will need to pay an annual $100 fee, disclose to consumers what data is collected, and provide instructions as to how to opt out of having it collected. The whole blog is worth a read, especially if you're curious about how other states' data breach laws are evolving. Recent changes to Colorado's laws, and a potential ballot initiative in California that would grant consumers "the right to request all personal information collected about them—both online and off—for the prior 12 months, as well as information on all third parties that purchased the data" are also covered.

2. Meltdown, Spectre Variants Could Endanger Healthcare Data Security by Fred Donovan

It’s been months since the words Meltdown and Spectre has entered the lexicon of some admins. The news broke in January and while fairly damning somewhat subsided over the last several months. New variants, discovered several weeks ago, could have an implication on healthcare data security. That angle isn't getting the attention it deserves HealthITSecurity.com said this week. The article cites a CERT advisory, issued in late May, and several alerts issued by medical device companies like BD and Abbott, which stressed that while they're monitoring the issues, they haven't seen any compromised products yet.

3. Facebook Gave Device Makers Deep Access to Data on Users and Friends by Gabriel J.X. Dance, Nicholas Confessore, and Michael LaForgia

The battle around privacy between users and Facebook reached another level this week after revelations the company shared user data with a slew of device manufacturers – at least 60 including Apple, Samsung, Amazon, and others - over the last 10 years. The true scope of the partnerships didn't come out until Sunday in a New York Times piece, which if you haven’t yet is worth a read. Naturally it didn't take long for officials from the U.S. Senate's Committee on Commerce, Science, and Transportation to come calling, asking CEO Mark Zuckerberg if there's any part of his previous testimony he'd like to amend. One voice (Germany's privacy regulator) called the news “an unprecedented violation of privacy laws and user trust.” Facebook, for its part, took umbrage with the New York Times' claims, specifically when it came to APIs. Shortly after the Times’ article went live Facebook issued a statement that its APIs are device-integrated, have been controlled "tightly from the get-go," and that 22 of the partnerships the NYT observed have already ended.