INTERIM. Lege Trend: Data Security Proposal. 3 Points to Know Now.

What kind of data breach triggered data breach law changes in Maine?  A health care data breach affecting 120,000.

What requirements does the legislator weant? Extended credit monitoring & fraud protection services requirement to total 2 years.

Are these legislative changes from a chairman? Yes, the Maine legislator behind this push is the House chairman of the Insurance and Financial Services Committee.

Kennebec Journal| Waterville legislator seeks more protection for victims of Augusta hospital data breach

INTERIM. 8 Elements of Data Security Laws & Regulations.

  • Data Breach Definition.
    • What data was breached?
    • The level of knowledge the data holder must have of the breach before notification is triggered. Did they know? Is it reasonable that this data was breached?
  • How to treat good faith access to data by an unauthorized employee
  • How to treat the breach of account creditial information.
    • user name, passwords, and security questions
  • Timing.
    • ​When must notification be given?
  • How to treat data processors, people who hold the data but are not the owners of the data.
    • Must data processers notify data controllers immediately?
    • An example would be a contractor who has a data breach of state employment records.
  • Whether identify theft protection must be offered and for how long.
  • Can companies waive their liability?
    • California law prohibits this waiver.
  • Statutory risk mititgation requirements.

The Recorder | Know the Basics of Data Breach Notification Laws

 

Model Health Care Data Security legislation. 3 Key Elements.

  • A limited time healthcare industry cybersecurity task force
  • The taskforce includes cybersecurity experts and healthcare stakeholders
  • The charge to the task force:
    • analyse the cybersecurity risks facing health care
    • recommend ‘actionable cyber threat indicators & defensive measures

The legislation people are looking to: Congress cyber security legislation.

The Global Legal post | Healthcare sector suffers chronic data breaches

 

New Legal Trend. Suing the Company Hired to Stop the breach. 2 Take Aways for Government Procurement for Data Security Services.

What‘s happening? Affinity Gmaing, owners of 11 casinos, is suing the company it hired to contain a data breach.

How is this relevant to Texas government? Pay close attention to the enforcement actions and lawsuits that emerge from the federal government OPM data breach in which the company hired for remediation.

Why is this important? the laws related to data security are chaning at lightening fast speed. Faster than a lobbyist can walk, and on a very complex, technical topic which does make for smooth lobbying. 

iapp | Daily Dashboard | Is this case a new avenue for data breach liability?

Trend: Financial Regulators Target Security. 3 Trends.

The SEC is getting tough on data security. State financial agencies likely to follow suit. Here’s what’s happening:

  • Enforcement actions against companies with weak security protocols
  • The SEC expects financial firms to have security planning in place before a hack
  • Periodic risk assessments and encryption are key

Financial Times | Securities and Exchange Commission gets tough on cyber security

INTERIM. Auto Manufacturers. Hackers. United Front. The Impact to Lege Trends and Regulatory Trends.

Why is GM embracing white hat hackers? To help identify and notify of security risks.

What’s the industry response? Just announed Detroit’s first public security vulnerability disclosure program bringing together GM and HackerOne

What’s the benefit to white hat hackers? As long as thehackers follow basic published protocols, the hackers can challenge security without legal repercussions.

So, its creating charitable immunity for white hat hackers? in contract form, yes. It allows hacker alliance to continue its bounty hunting without legal ramifications. 

ARS Technica |  GM embraces white-hat hackers with public vulnerability disclosure program

 

 

INTERIM. 2 Elements of a Data Breach Response That Trigger new State Causes of Action.

What dam got hacked? Iranian hackers targeted a dam in New York. Shortly thereafter Ukranian hackers got into a power grid.

What type of hack triggers a state response or the creation of a new state penalty?

  • Look to whether the hackers took control of the system or just “looked around”
  • Look to whether any person was injured as a result

Just Security | Was the Cyber Attack on a Dam in New York an Armed Attack?

Lege Trend: Tech Caucus. 3 Priorities.

California Legislature has a newly formed Tech Caucus. It’s full name is the Legislative Technology and Innovation Caucus. 

One would think if any state had a tech caucus, it’d be California. Such is not the case. It was founded by the legislator pushing ride share legislation in California. 

The priorities of the fledgling tech caucus are:

  • Touting the sharing economy. 
    •  ride share, fly share, move share, house share
  • workforce training and workplace diversity
  • bring together tech industries and associations

The Recorder | Tech Caucus Forms, But Hasn’t Taken Shape

Library Data. Do Cities Protect it? Do Universities? 3 Points from the Pro-Delete User Records Side.

  • The City University of new York began purging data because it believes libraries should only keep information users want
  • American Library Association doesn’t believe you are what you read and opposes law enforcement use of library records.
  • The  Library Freedom Project supports protecting web searches on public computers, encouraging libraries to operte exit nodes and Tor, a difficult to trace web browser

The Guardian | You are not what you read: librarians purge user data to protect privacy

INTERIM. Lege Trend. State Suffers Major Breach. Responds with 2 Step legislation.

What was the state government data breach? in 2012, South Carolina suffered a data breach that exposed records for 6 million taxpayers.

What legislative fixes have emerged from South Carolina in wake of this data breach?

  • Support agencies’ preventive measures
    •  dual-password programs
    • laptop encryption
  • Centralize cybersecurity in an office under the governor.
    •  Allows an information security director to oversee and enforce statewide standards.

Governing | 2016’s Top Legislative Issues to Watch