Category Archives: regulatory enforcement

76% of IT Decision Makers would Move Data Centers out of the US over Privacy.

Who was surveyed? 1000 IT decision makers across the UK and US

What did 76% say? 76% would “move their organization’s data to another country as a result of privacy concerns”

The privacy concern of businss: government snooping

How do the CEOs feel? 29% have moved data security to the top of the corporate agenda

Where are they moving their data storage? To Switzerland and Canada

The Data Center Journal | Information Exodus: 76% of IT Decision Makers Would Move Their Data to…

U.S. Chamber on Data Security. 3 Points.

  • A patchwork of state laws is hard on business
  • Requires a single regulatory agency
    • Currently the FTC, FCC & state agency wrangle over regulatory authority
  • Clear legal standards on what constitute harm from a data breach

U.S. Chamber Institute for Legal Reform | A Perilous Patchwork: Data Privacy and Civil Liability in the Era of the Data Breach

Regulatory Trend: Cybersecurity & Connected Cars. (Wifi Cars, not Trains)

What agency is talking cybersecurity & cars? The FTC

What committee heard from the FTC? Subcommittee on Commerce, Manufacturing and Trade of the House Energy and Commerce Committee

What did the FTC testify to?

  • FTC is the “the nation’s lead privacy and data security enforcement agency”
  • Proposed legislation is weaker than the FTC rulemaking on “connected cars”
  • Proposed safe harbor for auto manufacturers that submit privacy policies to the Department of Transportation was too…

Lege Trend: New State Data Security Laws. New State Cyber Security Agency. 8 Goals.

The New Jersey Legislature moved forward a data security law that will:

  • Create the New Jersey Cyber Security Commission
    • It will be a 13-member commission within New Jersey’s Department of Criminal Justice.
    • 6 members will be:  representatives from the state Attorney General’s Office, the chief technology officer of the Office of Information Technology, the chief executive officer of the state Economic Development Authority, the commissioner of the Department of Education, the…

Regulatory Trend: Agency Fines for Failing Policies before Data Breach

Which agency is issuing fines for lacking data security policies? The Securities and Exchange Commission. 

Why is the SEC fining a company? Two reasons:

  1. It failied to have an adequate daa security policy in place before it experienced a data breach that exposed financial records of 100,000.
    1. Let’s repeat, the company never adopted written policies and procedures
    2. The company did not conduct periodic risk assessments
    3. The company did not implement a firewall
    4. The company did not…

6 Trends in State Data Breach Laws

  • Greater Enforcement Powers for State Attorneys General
  • Protecting More types of data = more reasons to notify consumers
  • Expanded liability for private companies that store state data
  • Requiring companies that have a data breach to offer, at their cost, mitigation services that protect data- think Life Lock etc…
  • Protecting Student Data
  • Requiring encryption for stored data
    • As an example, see: 
      • “The new Washington law goes even further as it identifies a minimum standard for…

Texas New Data Leaders at Agencies near you

2 big data security steps from the 2015 Legislature:

  • SB1844 creates the Interagency Data Coordination and Transparency Commission.
    • staff from 10 legislative agencies
    • will evaluate how data is reported, shared, classified and used in the state.
  •  HB1912 created the statewide data coordinator position at DIR to oversee data at all agencies.

State Tech Magazine

Regulatory Trend: Health Care Data Breach

A health care company experiences a data breach, what’s the regulatory and legal landscape?

  • Civil lawsuits that lead to Class Action lawsuits, check.
  • Penalties imposed by a regulatory agency, check.
    • Health and Human Services reached a $750,000 settlement with Cancer Care Group over a data breach involving HIPPA records. 

What can we learn from this incident?

  • health care companies should  conduct risk analysis of tinformation security policies
  • health care companies should have a…

Lege Trend: Legislative Data Task Force. Protect the Data.

California Governor Jerry Brown announced a new Cybersecurity Task Force today. Its goal are to:

  • “reinforce online security”
  • “protect critical state information from data breaches”

The task force is in response to an audit that faulted California for:

  • lax security measures
  • finding 73 of 77 state entities comply with information security standards.
  • “The 75-page audit criticized the California Department of Technology for failing to identify failing state agencies, and found the state…