9 Parts. North Carolina Data Security Bill. Post-Equifax.

The state Attorney General and a State Representative are promoting an forthcoming North Carolina bill, the Act to Strengthen Identity Theft Protections.

Here’s what the bill will do:

  • Include ransomware in definition of data breach
  • Protect more information by creating a duty for businesses to have reasonable data security standards, and include insurance/medical information in the data breach notification law
  • Quicker consumer notification.  15 day time limit to notify the consumer & the Attorney General
  • Free credit freezes & credit freeze lifts
  • 3 free credit reports from each of the 3 credit reporting agencies
  • 5 years of free credit monitoring if a credit reporting agency experiences a breach
  • Penalties will follow the Deceptive Trade Practices Act  that makes each act a violation to which penalties can attach
  • Require consent for credit reports
  • Consumer right to all their information at a credit reporting service

 

Lege Trend. 22 Groups of Banks & Retailers Join Forces. Wonder Twin Powers Urge 4 Point Data Security Bill.

The 4 Issues the group wants covered by federal data breach legislation:

  • A flexible, scalable standard for data protection that factors in:
    • the size and complexity of an organization
    • the cost of available tools to secure data
    • the sensitivity of the personal information an organization holds, as well as guarantees that small organizations are not burdened by excessive requirements.
  • Notification when a reasonable risk exists. A notification regime requiring timely notice to impacted consumers, law enforcement, and applicable regulators when there is a reasonable risk that a breach of unencrypted personal information exposes consumers to identity theft or other financial harm.
  • Consistent, exclusive federal enforcement of the new national standard by the Federal Trade Commission (FTC) and state Attorneys General, other than for entities subject to state insurance regulation or who comply with the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act of 1996/HITECH Act. For entities under its jurisdiction, the FTC should have the authority to impose penalties for violations of the new law.
  • Clear preemption of the existing patchwork of often conflicting and contradictory state laws. 

 

The group supporting federal data security legislation: 

ACT | The App Association

American Bankers Association

American Insurance Association

American Land Title Association

BSA | The Software Alliance

Consumer Bankers Association

Credit Union National Association CTIA

Electronic Transactions Association

Financial Services Roundtable

Independent Community Bankers of America

Independent Insurance Agents and Brokers of America

Internet Commerce Coalition

National Association of Federally-Insured Credit Unions

National Association of Mutual Insurance Companies

National Business Coalition on E-Commerce & Privacy

Property Casualty Insurers Association of America

Reinsurance Association of America

Retail Industry Leaders Association

TechNet

Twenty-First Century Privacy Coalition

USTelecom 

Open Records TREND. Are election cybersecurity documents open records? See 2 different states work.

South Carolina Attorney General clarifies- financial info yes, but not security information

South Carolina Attorney General says that the South Carolina election commission can withhold from disclosure cybersecurity information. 

Can related information about election cybser security be released thbrough open records?

Yes, South Carolina election commission will release financial information about cybersecurity products & services purchased

Michigan considered a bill to protect election cybersecurity information

HB 4973 (2017)  excepts from disclosure information that addresses:

Lege TREND. 6 Standard Data Protocol For all State Data. Is the South leading the way in protecting personal information?

Mississippi is considering statewide standards for data that will:

  • how to long to store personal data
  • how to dispose of personal data
  • what personal data can be disposed of
  • how to store personal data
  • apply to all state entities that have personal data in their possession
  • what a state agency, Department of Archives and History, needs to store data in perpetuity

What prompted this legislative action by Mississippi?

  • A 2013 breach of health care data at the Univeristy of Mississippi
  • A resulting 2016 $2.75 Million penalty by the US DHHS as a result of the data breach
  • An unfavorable report by the state legislative watchdog committee for Performance Expenditure and Evaluation Review

Clarion Ledger | Lawmakers to review ways to make public’s identifiable data in state hands more secure

Lege TREND. Bills Protecting Health Care Data in 2 States.

​Maryland HB 974 (2017)

  • Includes all HIPPA information in the defintion of personal information for state data breach law purposes
  • The bill also protects Biometric data, such as fingerprints, voice prints, and genetic prints

Delaware HB 180 (2017)

  • Includes medical history in the defintion of personal information
  • Requires “any person who conducts business in Delaware and maintains personal information must safeguard that information.”
  • Requires health insurance information to be protected
  • Establishes standards to dispose of the electronic information

Health IT Security | 2017 Updated State Data Breach Laws Account for Medical Information 

Legal Trend. Data Breach Liability for Employers

A UK court found that an employer, that had taken appropriate measures to prevent a data breach,  can be held vicariously liable for a data breach when an employee:

  • deliberately misused the data
  • intended to cause damage to the employer by misuing the data

Bonjour U.S. State Legislators- daat security liability issues should be in your radar.

Lexology | Employer held vicariously liable for employee’s deliberate data breach

WM Morrison’s Supermarket PLC | England and Wales High Court (Queen’s Bench Division) Decisions

Regulatory TREND. Imposing Data Security on Credit Reporting Agencies. Read the new Rules from NY

New York’s new rules on credit reporting agencies will do these 4 things:

  • Require consumer credit-reporting agencies to identify “dedicated points of contact” for New York’s Division of Consumer Protection
    • WHY? Ensure consumers can promptly get answers 
  • Mandate that credit-reporting agencies respond “within 10 days” to any requests for information made on behalf of consumers by the Division of Consumer Protection
  • Credit reporting agencies must “plainly disclose” to consumers all fees associated with any identity theft protection product sold or purchased, “including when those products are originally offered for ‘free’
  • Require the credit-reporting agencies disclose to New York’s Division of Consumer Protection all business relationships and contracts with companies involved in marketing credit monitoring services and related products.

The tagline from state leaders: consumers should not be penalized for having their data breached

Boston 25 News | Citing Equifax data breach, one state cracks down on credit-reporting agencies

3 Ways The Los Angeles Cyber Center is a Model for Cities

What standards did Los Angeles use in crafting its Cyber Center? Federal Government and industry Standards

The key to the city Cyber Center?  integrated strategic operations center

What does the integrated strategic operations center do? 

  •  “processes cyber threat information from the Homeland Security Department, the FBI and various private sector and non-profit sources and feeds it out to its member operations centers and to city departments”

How does this help unify cyber protections in Los Angeles?  Prior to the cyber center the city’s IT office, the Water and Power Department, the Port of Los Angeles and Los Angeles International Airport did not communicate regularly on cybersecurity. Now each is on the same page.

Are other cities taking note? Yes, Chicago, Las Vegas and New York have visited to learn more

NEXTGOV | LA Cyber Center Hopes to be a Model for Cities Nationwide

State Attorney Generals Raise 3 Issues in Suing Over Net Neutrality Rule

The FCC overturns net neutrality rules and Attorneys General of New York and Washington announce their lawsuit raising these 3 concerns:

  • FCC’s net neutrality repeal harms consumers
  • FCC’s net neutrality repeal harms small business
  • FCC’s net neutrality repeal harms innovation

The Attorney General of Washington State notes that he is 5-0 in his lawsuits against the Trump administration. 

The Hill | Washington AG to sue over net neutrality repeal