Trend: State Adds Data Security Requirements for State Contractors

Connecticut’s enacted Senate Bill 949 contains significant data security requirements for entities contracting with state agencies and entities in the health insurance and administration business. 

Contracting entities must provide:

  • Comprehensive data-security program, including:
    • the use of security policies,
    • annual reviews of such policies,
    • access restrictions, and
    • mandatory security awareness training for employees beginning July 1, 2015.
  • Restrict access to Confidential Information only to authorized contractor employees,
  • Maintain the Confidential Information in secure servers with firewall protections
  • Implement security and breach investigation procedures.
  • Undergo annual reviews
  • Include ongoing employee security awareness program.

National Law Review

New Student Data Security Bill. 4 Pts. Adds Cloud Computing to Student Data Controls.

A bipartisan duo of Congressmen and women (Congresspersons?) has a new student data security bill.

Reps. Todd Rokita (R-Ind.) and Marcia Fudge (D-Ohio) rolled out the Student Privacy Protection Act this week. It will:

  • bar schools or private technology companies from selling or using student data for targeted ads.
  • set minimum data security standards for companies handling sensitive student information
  • update the Family Educational Rights and Privacy Act (FERPA) for mobile apps and cloud computing
  • give parents the right to access, alter or delete certain information about their child

The Rokita-Fudge bill would be a companion to an effort from Sens. Orrin Hatch (R-Utah) and Ed Markey (D-Mass.), as both measures revise FERPA.

The Hill

 

Procurement Process. Federal Data Breach.

The emergency contract for $20M was the tip of the ice berg. By August 14th. the federal government will award a 5 year contract for data security protection for the 21.5M federal employees whose data was hacked. Washington Post

Oh, and that pesky, initial contract of $20M isn’t going so well.  The Austin, TX based vendor cannot keep up with demand. Washington Post

Legal Trend: Cost of Monitoring is Damages for a Data Breach lawsuit

The Neiman Marcus data breach lawsuit can continue according to the 7th Circuit. 

Courts have wrangled with whether a person who had her information stolen in a dat abreach must have had that information used in a manner to cause harm before a lawsuit can continue.

The 7th Circuit said no to that specific standard and is allowing more damages like the cost of credit monitoring.

Law360

Hacking a Car. Brakes Controlled by Hacker.

A reporter for Wired details what parts of a car hackers can control while you’re driving. 

Hackers are able to control a vehicle’s:

  • A/C system, changing the temperature in the car
  • The radio, changing channels and volume control
  • Windshield wipers
  • Windshield washer fluid blurring the windows
  • dashboard functions
  • steering
  • brakes
  • transmission

All of the car functions above can be controlled from a laptop by a nefarious hacker. Wired. Congress is trying to stop it with the Spy Car Act.