InfoHive – Data Security – Page 127

Lege Trend. Anatomy of a Strict Data Breach Notification State Bill.

30 days to provide notification to consumers
Greater disclosures to consumers about data collected and where it is stored
Free credit freezes and unfreezes for a year
4 years of credit monitoring- free
Applies Deceptive Trade Practices Act penalties to Businesses (these accrue daily and per incident)

What impact does this have to businesses?

healthcare comapnies would see their notifcation timeline cut from 60 days to 30 days

Have other states shortened notification timelines? Yes, in 2018 Colorado also went to 30 days. Iowa went to 45 days.

What are states doing to train their employees to protect data?

Michigan, Oklahoma and Wyoming encourage but don’t require training
Idaho Governor Excutive order requires training for all executive staff
Illinois in 2017 made cybersecurity training mandatory for state employees
Indiana’s CIO has authority to make training mandatory for state employees
Utah sends out phony phishing emaisl to state employees to test them
CT offers voluntary training every 2 months
Alabama offers daily cybersecurity trivia games with prizes to employees, 1000 employees play a day

SB273 (OH |2018) does the following:

Adopts the National Association of Insurance Commissioners’ (NAIC) Insurance Data Security Model Law
OH becomes the 2nd state after South Caroline to adopt the model law
Requires licesees develop, implement, and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards to protect nonpublic information and the licensee’s information system within 1 year of the effective date of the Act;
Perform a risk assessments
Develop a formal incident cyber response plan
Require their third-party service providers to implement security measures within 2 years
Report data breaches to the head of its Department of Insurance within 3 business days after determination tof a cyber event;
Certify compliance to the the head of its Department of Insurance
5 year retention of all records supporting the certificate of compliance

Cybersecurity experts favor: hand-marked paper records processed by optical scanners

What did Georgia’s voting security commission recommend? paper records but not hand marked and processed by optical scanners

Paper products rejoice! South Carolina legislature will consider requiring paper ballots. S374 (2019 |SC)

Anatomy of a white hacker on construction equipment:

Accessed 14 construction locations
hacked into devices that not only controlled:
- cranes
- excavators
- scrapers
- other large machinery

The solution: Move equipment away from “esoteric custom protocols” and to “modern, standardized tech” that can be easily upgraded for security

What is special about Rhode Island’s newly implemented risk limiting audits?

data helps create more efficient permitting processes
- CT allows local governments to get occupational licensing data directly form the state
overdose data helps first responders and hospitals prepare for epidemics
Prevent fraud
- IN adopted its Indiana’s Management and Performance Hub to “integrate” data from several agencies to build custom analytics solutions.” Its addressing issues from car crashes and infant mortality to Medicaid optimization.
- TX shared data across agencies during Hurricane Harvey. Data was shared in real time to support first responders, law enforcement and others.

Why is statutorily protecting business email correspondence increasingly important to law makers?

Data.

What does the FBI data say about business email hacking?

Are there other terms I need to watch for in legislation/from clients?

IN 2018, Vermont became the first state to regulate data brokers.

What is a data broker?

What business guidance did the Vermont Attorney General offer?

If Vermont courts do not have jurisdiction, then this law does not apply to a business
Does it establish an opt out requirement for consumers? no
Will businesses have to change their practices to opt out? no
A business that collects data for its own use only is not a data broker