Category Archives: legal trend

3 Ways State Attorneys General Control Data Security Policy

  • Create policy by litigating
    • ex: suits to support online privacy could be the new tobacco lawsuit
  • Blocking Federal Policies
    • Repulican Attorneys General sued Obama Administration 46 times in 8 years
    • Democratic Attornesy General have sued the Trump Administration 35 times in year 1
  • Crafting policy by managing State-level settlements delivering big headlines and fast payouts
    • ex: Equifax settlements

Forbes | How state attorneys general are driving tech policy

Lege Trend. Liability Protection for Business Investment in Data Security. Read the Bill

Ohio’s  SB 220 (2018 | OH)

If a business’ cybersecurity procedures reasonably conform to any of these:

(a) The security requirements of the “Health Insurance Portability and Accountability Act of 1996,” as set forth in 45 CFR Part 164 Subpart C;

(b) Title V of the “Gramm-Leach-Bliley Act of 1999,” Public Law 106-102, as amended;
(c) The “Federal Information Security Modernization Act of 2014,” Public Law 113-283;
(d) The “Health Information Technology for Economic and Clinical Health Act,”…

Regulatory TREND. Higher State Regulations for Credit Reporting Agencies. 8 states.

  • NY rules will require credit reporting agencies to comply with the state’s Department of Financial Services cybersecurity standards
  • An agreement between Equifax & 8 State Financial regulators will allow the states to:
    • impose punitive damages against Equifax
    • conduct annual  security audits 
    • develop written data protection policies and guides
    • monitor outside technology vendors
    • improve software patch management controls
  • The states:
    • Alabama
    • California
    • Georgia
    • Maine
    • Massachusett…

+1 State Suing Over Equifax Breach. The Facts:

State: West Virginia

The lawsuit by the West Virginia Attorney General:  Violation of the the state’s Consumer Credit and Protection Act  

The potential penalty: $150,000 for each security breach and $5,000 for each violation of each of the 730,000 West Virginians affected by the Equifax breach

The statement from the WV Attorney General:

“Equifax’s failure to secure consumers’ personal information constitutes a shocking betrayal of public trust and an egregious violation of West Virginia…

Lege Trend. What triggers a notification? How does that standard impact a business liability?

Draft Federal legislation will require notification of breach if and only if a business determines:

  • “a reasonable risk that the breach of data security has resulted in identity theft, fraud or economic loss”

Why does this specific statuory draft langauge matter? Courts are split on whether a business is liable when a data breach hasn’t resulted in actual fraud or economic loss, which means the language sets up a liability threshold.

Fox 13 | Report: Draft bill would allow credit reporting…

Legal Trend. Ride Share + Data Breach = State Attorneys General File Suit . +1 State.

Pennsylvania Attorney General has filed suit against Uber for violating the state’s data breach notification laws.

What are the alleged violations? (Also Known As red flags for drafting data breach notification laws)

  • 13,500 Pennsylvanians were not notified in a reasonable time
  • each violation has a $1000 fine, for a total of $13.5 Million

What ogther circumstances did the Attorney General mention?

  • The company waited a year
  • intentionally hid the breach
  • contracted with hackers concerning the…