Category Archives: regulatory enforcement

Data Security Legislation Trend. 1st Legislative Phase is Missing. Ask the experts.

A former top national security adviser says the cybersecurity legislation that is necessary is:      uniform definitions for cybersecurity across all government levels.

Why do we need uniform definitions?  Uniform defintions improve strategy for enforcement and legislation.

Defense of Democracies | Framework and Terminology for Understanding Cyber-Enabled Economic Warfare

Regulatory Trend. Fining Companies That Track Your Electronics without Notice.

The Company: Vizio 

The privacy breach:  installed software in televisions that recorded consumers tv habits

The regulatory enforcement: Federal Trade Commission and the New Jersey Attorney General

The fine: $2.2 million + must delete customer data by March

Engadget | Vizio tracked and sold your TV viewing habits without consent (updated)

TX Hospital. Data Security Civil Penalty. 4 Key Points.

the hospital: Children’s Medical Center of Dallas 

the data security charge: years of noncompliance with HIPAA rules and after failing to request a hearing on the penalty. Since 2010 the hospital used unencrypted devices to store HIPAA protected info

the regulator: U.S. Department of Health and Human Services’ Office for Civil Rights

the fine: $3.2 million civil money penalty

Day Pitney LLP | United States: Hospital Hit With $3.2M Penalty for Ongoing Health Data Security Lapses

Lege Trend: State Agency on CyberSecurity. +1 More Western State.

Add Nevada to the list of states moving to create an Office of Cyber Defense. Governor Sandoval proposes funding it with $3.5 million.

The Office of Syber Defense will be within the Nevada Department of Public Safety and will offer assistance to local government agencies and private industry.

Las Vegas Review Journal | Marijuana, cybersecurity among debates to happen in Nevada Legislature

Data Breach Legislation & Regs. Carrot & the Stick. The Stats & The Regs.

What do you need to know about data breaches?

The carrot & the stick:

  • Increase the accountability of entities that hold data
  • By requiring the entities to shoulder more of the cost of a breach
  • Allow these entities to offer “credible security signals to the market” to provide a benefit to the entity

Tech Crunch | The carrot and stick of data breaches

3 Ways State Attorney Generals Play a Role in State Data Security Legislation

  • 23 of the 47 states that have data breach laws require the state Attorney General to be notified
  • State Attorney Generals litigate data breaches
    • in Texas, the Attorney General reached a settlement with Paypal app, Venmo, for $175,000 requiring the company to “improve disclosures regarding security and privacy”
  • many state Attorney Generals set policy like hio Attorney General who launched, CyberOhio

Lexology | McGuirre Woods | In Data Privacy, Don’t Forget the State Attorneys General

Holiday Gifts = Data Security Threat. Welcome to legislating gift giving.

The gift: talking dolls

The data security threat: The dolls record, without consent, children’s voices and saves the voices.

The laws and rules at issue both federal and state: Deceptive Trade Practices Act. Federally enforced by the FTC, and by the AG in Texas. 

Wallstreet Journal | Talking Dolls Pose Privacy Risk to Children, Advocacy Groups Allege

TREND. Anatomy of A State Cyber Security Quick Reaction Force

Germany has created a mobile Quick Reaction Force to quickly address cyberthreats.

Which cyber threats will the Quick Reaction Force respond to? Cyber attacks on government agencies & critical infrastructure

Will there be cyber threat information sharing between business interests and the state? yes.

Why did they enact this Quick Reaction Force for cybersecurity? To protect Germany’s elections from Russian or Chinese hackers

DW.com | German cabinet approves cyber security…

TREND. New Rules on Data Privacy. +1 Federal Agency with cybersecurity rules. 4 Points to be Informed.

The agency with new data protection rules: The FCC

The new FCC rules will require broad band and wireless providers to:

  • offer 3 tiers of privacy protections: opt-in, opt-out, and inferred
  • opt-in will be the standard for this information held by providers:
    • sensitive personal data
    • financial data
    • location
    • social security numbers
    • health or medical information
    • internet browsing or app history
    • message content
    • data belonging to minors.
  • opt-out standard for non-sensitive data…