2 States First to Update Data Security Laws for 2015

Montana and Wyoming, wrangling western individualism, passed new data breach notification laws. Here’s what they did:

Wyoming expanded what information triggers a data breach notification to include:

  • Username or email address with password or security question and answer
  • Birth or marriage certificate
  • Medical, biometric or health insurance information
  • Individual taxpayer identification number.

Wyoming also expanded what should be included in a notification received by a consumer to include:

  • A toll-free number to contact the organization
  • Types of PII affected
  • A general description of the breach
  • Approximate date of the breach
  • General actions taken to protect against further breaches
  • Advice relating to reviewing account statements and monitoring credit reports-
  • Whether the notification was delayed due to law enforcement.

Montana also expanded what type of information triggers a notification, to include:

  • Information that relates to an individual’s physical or mental condition
  • Medical history, medical claims history, or medical treatment information obtained from a medical professional or medical care institution, from the individual, or from the individual’s spouse, parent, or legal guardian.
  • a tax ID number

Montana also broadened which entities receive notification to include:

  • A company must “simultaneously” provide a copy of the notice to the Montana Attorney General’s Consumer Protection Office. 
  • If the data breach involves insurance information,  simultaneous notice must be given to the Montana Insurance Commissioner.

Wilson Elser via JD Supra

Lege Enacted: 3 States, New Laws. Data Security Trends

3 states have enacted new data security reforms. Most recently, Washington State  joined Wyoming and Montana. Washington’s reforms include, according to JD Supra:

  • Expands coverage to hard copy data as well as electronic or “computerized” data;
  • Requires notification of the Washington Attorney General if more than 500 Washington residents are required to be notified;
  • Imposes a 45-day deadline for notification of affected consumers and, when required, of the Washington Attorney General;
  • Empowers the Washington Attorney General to enforce the statute by bringing actions under the state’s consumer protection act;
  • Mandates certain content in the consumer notification, including the name and contact information of the reporting business, a list of the types of PI subject to the breach, and the toll-free telephone numbers and addresses of consumer reporting agencies;
  • Introduces a safe harbor for PI that is “secured” or encrypted in a manner that meets or exceeds the National Institute of Standards and Technology (NIST) standard “or is Otherwise modified so that it is rendered unreadable, unusable, or undecipherable by an unauthorized person;” and
  • Adds language that exempts certain covered entities from compliance if they otherwise comply with certain federal laws. 

Davis Wright Tremaine LLP

Legal Trend: Small Banks Want to Block Target Settlement with MasterCard

Small banks and credit unions have filed suit to enjoin the nearly $20 million settlement between Target and Mastercard related to the 2013. 

Small banks and credit unions allege:

  • the agreement between Target and Mastercard was surreptitious
  • ““This sweetheart deal for Target was negotiated without involvement of the court or the legal representatives of the impacted financial institutions.”

Target is still in negotiation with Visa over a settlement for reissuing credit and debit cards after the 2013 data breach.

​Reuters

New SEC Rules on Cyber and Data Security Forthcoming

The SEC is mulling over requiring disclosures by publicly traded companies concerning data security and data breaches. 

This should come at no suprise as in 2011, the Corporate Fiannce Division issued guidance on disclosing data security and data breaches in CF Disclosure Guidance: Topic No. 2, Cybersecurity, Oct. 13, 2011.

What’s the SEC considering risk factors that need to be disclosed?

  •  if the risk of data breaches would make an investment in the business risky or speculative AND
  • including the potential cost of any breach.

SEC is serious too. It is issuing comment letters based on the current guidance and imposing fines.  The Recorder

States Lose (Again) with Federal Data Breach Law

The federal data breach bill moving through Congress will preempt all state laws. Most states have stronger data breach laws than the federal bill.

Some say the federal bill is being pushed by the business lobby. It makes sense. Businesses are being sued after data breaches and it is costing millions and millions. Hundreds of millions. 

California, has stronger data security statutes and the California Consumer Federation says the federal bill will:

•Eliminate notification to the California attorney general  of any security breach.

•Allow the state attorney general to file a civil lawsuit but prevent individuals from suing over a data breach.

•It would no longer require breached companies to provide free ID theft protection services, such as credit monitoring and fraud alerts.

LA Times 

GAO: IRS Needs Better Data Security

The GAO found 69 data weaknesses at the IRS, which caught the attention of Sen. Grassley and the Treasury inspector general for tax administration.

The Treasury’s inspector general for tax administration ranks data security as the IRS’s top management problem for 2015. In response, the IRS claims that budget cuts have impacted its abaility to find security weaknesses.

The Hill

Top Concern for Credit Unions Rhymes with Lata Becurity

Data Security is the number one concern for credit unions according to the National Association of Federal Credit Unions. 

Their concern is founded in fact. In 2014, 317 million new pieces of malware were created according to Symantec’s 2015 Internet Security Threat Report. Data breaches have been increasing by 20% per year. 

This group supports legislation that includes:

  • Payment of Breach Costs by Breached Entities
  • National Standards for Safekeeping Information
  • Data Security Policy Disclosure
  • Notification of the Account Servicer
  • Disclosure of Breached Entity
  • Enforcement of Prohibition on Data Retention
  • Burden of Proof in Data Breach Cases 

Business Wire