2019 legislative issue – Page 15 – InfoHive

PA 95 HB 5257 (2018)
- prohibits knowingly possess ransomware with the intent to use or employ that ransomware
PA 96 HB 5258 (2018)
- sentencing guidelines for ransomware possession

What problems was the Legislature trying address:

Michigan had no recourse to charge cybercriminals that had ransomware on their computers that they hadn’t used
In 2017 there were 1,300 reported cases of ransomware attacks in Michigan

…

Lege Trend. Anatomy of a Statewide Net Neutrality Bill in the Mayflower State that also limits ISP data collection

Massachusetts Legislature is moving a net neutrality bill, S2376, that will:

create a central registry of internet service providers
require net nuetrality in government contracts
prohibit ISPs from collecting, using or sharing a consumer’s personal data without their consent
State rules would be developed by the state Department of Telecommunications and Cable
Requires ISPs to make the same disclosures to state regulatators that ISPs make to the FCC
An assessment on ISPs would be levied…

Lege Trend. What triggers a notification? How does that standard impact a business liability?

Draft Federal legislation will require notification of breach if and only if a business determines:

“a reasonable risk that the breach of data security has resulted in identity theft, fraud or economic loss”

Why does this specific statuory draft langauge matter? Courts are split on whether a business is liable when a data breach hasn’t resulted in actual fraud or economic loss, which means the language sets up a liability threshold.

Fox 13 | Report: Draft bill would allow credit reporting…

3 Reasons 30+ State Attorneys General Opposition to Federal Data Breach Preemption.

32 Attorneys General oppose federal preemption of state data security laws because:

Reduces state enforcement by allowing entities to decide if a breach needs to be reported
Prevents proactive action by consumers in state law, which states currently have
Leaves a vacant enforcement loophole for breaches that impact fewer than 5000

Pocono News | PA attorney general seeks stronger enforcement of data breach notification laws

Bi partisan Attorneys General Letter Opposing Federal Data Security…

3 Ways State & Local Regulators Can Take Action on Cybersecurity

State agencies can coordinate data sharing, processing and storage
State and Local agencies can actively work on data minimization
Include cybertraining as basic employee training

State Tech | What’s the State and Local Agency Role in the Battle for Data Privacy?

Lege Trend. Gov Signs Post Equifax Bill in the Goldenrod State. 3 Key Elements of the Bill.

State: Nebraska

Nebraska’s 2018 post-Equifax reform bill: Legislative Bill 757 (2018)

What does Nebraska’s LB 757 do?

requires reasonable security and disposal procedures and practices for all entities possessing data
non-affiliated 3rd parties also have to maintain reasonable security and disposal procedures for data
free credit freezes and free credit thaws

3 Points. Final EQUIFAX Response Bills in the American Pasque Flower State. LEGE TREND.

State: South Dakota

The South Dakota post-Equifax data breach bills: House Bill 1078 & House Bill 1127

What did House Bill 1078 do? Freezes remain in place until the consumer requests otherwise & must be lifted within 3 days of a request

What did House Bill 1127 do? Cost free credit report freezing & un-freezing (thawing)