Category Archives: regulatory enforcement

5 Points. Unanimous Data Security Bill Post- Equifax.

Oregon’s SB 1551 (2018)  will require:

  • notification to consumers of a data breach within 45 days unless it could hinder law enforcement
  • if more than 250 Oregonians are affected, then notice must also go to the state Attorney General
  • a violation triggers Deceptive Trade Practices Act 
    • this means class action lawsuits
    • this also means big fines
  • no fees for credit freezes or thaws
  • prohibits ‘ “upselling” by breached companies or third-party contractors when they offer people free credit…

New Coalition. Against Card Skimming.

State: Alabama

What entity organized the coalition against card skimming? Alabama’s Attorney General

The new coalition against card skimming: Alabama Focus Group on Skimming

What entities comprise the coalition?

  • U.S. Secret Service
  • Alabama Department of Agriculture and Industries
  • Alabama Department of Transportation
  • Alabama Fusion Center
  • Alabama Law Enforcement Agency
  • Alabama Petroleum Equipment Contractors Association
  • Petroleum & Convenience Marketers of Alabama
  • Alabama Attorney…

Procurement Opportunity. State Cyber Crime Labs. Anatomy of a State Cyber Crime Lab.

State: Alabama

Agency Housing the Cyber Crime Lab: Attorney General Office

What tools does the operator of a cyber crime lab need?

  • talent to unlock cell phone evidence
  • talent to track down credit/debit card skimmers
  • talent to unmask criminals behind identity theft
  • talent to help businesses &  local governments recover revenue  lost in cyber theft 

AL.com | State launches lab to fight growing problem of cyber crime

Lege trend. Increasing Consumer Protections in a Post-Equifax World.

A Rhode Island legislator wants companies that have had a data breach to:

  • notify the state and consumers in a “reasonable promptness”, quicker than the current 45 days
  • Increase the penalty from $100 to $150,000 per breach

WPRI | Lawmaker proposes law to protect victims of data breaches

Rhode Island HB 7387 (2018) 

Red State Bill. Protecting Health Care Data in its Data Security Laws. Read the bill Text. Be informed.

Iowa’s Attorney General is supporting House Study Bill 526 (2018)  which adds the following health care information to the state’s data breach statute:

  • medical records, physical and mental health
    • including treatment & diagnosis
  • health insurance information

Any other requirements in House Study Bill 526 (2018) ?

  • 45 day notification requirement
  • 128-bit data encryption requirement
  • Notification to the state if written notification to more than 500 consumers in the state is required by a…

3 Reasons this Georgia Data Security Bill Poses a Threat to Security Researchers

Gerogia Legislature is considering Senate Bill 315 (2018) .

Data Security research supporters say the bill raises these 3 concerns:

  • The terms  “access” and “authority” are not clearly defined
  • because the terms are not clearly defined research will be quelled for the fear of committing an unknown crime
  • The Federal Computer Fraud and Abuse Act also had broad terms and led to the “overzealous” prosecution of researchers

What’s the goal of the bill? To add the crime of unauthorized computer…

+ 1 Executive Order on Net Neutrality. Where. How. Who. Why. What.

Where: New York

Who: New York Governor Cuomo

How: By Executive Order

What does the executive order do? NY Executive Order Number 75

  • Prohibits state contracts with entities that  treat all web traffic equally
  • Establishes internet access as an essential service

Why: In response to the FCC net nuetrality repeal, NY became the 2nd state to creae its own net nuetrality provisions.

The Hill | Cuomo signs executive order protecting net neutrality in New York

 

Bill Requires an Agency to Audit Other Agency Data Security Standards. Procurement Opportunity. Read the Bill.

H.R. 1224 (115th Congress) requires a 6 point audit of federal agency data security:

  • a description of staffing plans
  • workforce capabilities
  • methods of conducting such audits
  • coordination with agencies to support such audits
  • expected timeframe for the completion of the audits
  • other relevant information

 

Regulatory TREND. Imposing Data Security on Credit Reporting Agencies. Read the new Rules from NY

New York’s new rules on credit reporting agencies will do these 4 things:

  • Require consumer credit-reporting agencies to identify “dedicated points of contact” for New York’s Division of Consumer Protection
    • WHY? Ensure consumers can promptly get answers 
  • Mandate that credit-reporting agencies respond “within 10 days” to any requests for information made on behalf of consumers by the Division of Consumer Protection
  • Credit reporting agencies must “plainly disclose” to consumers all fees…