The FBI is investigating whether hacked tax information was used to file fraudulent state and federal tax returns without the original taxpayer’s knowledge.
The fraudulent state and federal tax filings are impacting businesses and individuals.
Breach Leads to Class Action. Rinse. Repeat.
Last week Anthem experienced a data security breach that resulted in the exposure of personal information for up to 80 million people. This week, a class action lawsuit has been filed in Atlanta.
Here’s what plaintiffs allege:
- World’s biggest known data breach
- The FBI has identified health care as particularly weak in data security.
4 Data Security Policy Trends
- Health Information protected by HIPPA will put companies at risk.
- Department of Health and Human Services Office for Civil Rights enforcement actions have led to multiple million dollar settlements against hospitals, clinics, and health systems
- FTC will take enforcement action. That action will lead to lawsuits challenging the FTC powers of enforcement.
- Opportunity for state enforcement abounds.
- More lawsuits against companies and financial institutions. Big legal costs. Big tort reform opportunity. A sample of the lawsuits:
- class action suits
- Claims under specific privacy statutes, like motor vehicle records
- State medical privacy laws for employee health insurance records
- Restricted access to bank accounts may satisfy data breach causes of action
- Insurance Regulation on data breach policies as the industry rapidly expands.
Lege Trend: Another Attorney General Supports Data Breach Notification & Enforcement
The Oregon Attorney General has a data breach legislation wish list. On her wish list is:
- Extend data breach enforcement and notification to the Oregon Department of Justice
- Oregonians should have access to information about:
- who is collecting their personal information and data
- how it is being used and protected
- to whom it is being sold.
Cost of a data breach: $15 Million +
Sony Pictures spent $15M in Q3 for investigating and remediating its data breach. Legal costs forthcoming. Tech Crunch
Data Breach Liability for Retailer? Is there a Financial Cap for a Grocer?
Retail data breaches lead to class action lawsuits. They’re new. They’re trendy.
How financial liability for a breach is assessed is a developing legal trend. Legal trends turn into legislative trends as states grapple with assigning liability.
Today the retailers & the banks are at odds over this in policy court. To add fuel to the this policy fire, a federal court sided with a retailer against financial institutions by limiting a grocer’s liability to:
- $500,000
- based on the agreement between the grocer & the financial institutions processing the payments
Retailers want banks to bear the brunt of costs. Banks want retailers to meet the high security standards they have to meet.
Public Ed Contractors Want Data. States Stop the Data Flow.
In 2014, California passed bills to protect student data from contractors. What did the bills do?
- Require “school districts to maintain control and ownership of any data managed by a private vendor.” Cal AB 1584 (2014)
- Give education technology companies until 2016 to stop selling student personal identifying information and to stop target marketing to students CAL SB 1177
At the school district level, these actions are being taken:
- Teacher training on privacy issues.
- Use of vetted list vendors, that comply with data retention and storage restriction
Mandatory Encryption for Health Care Data. States Imposing Higher Standards than HIPAA.
The Garden State has mandated that all protected health information be encrypted. This new requirement applies to:
- health providers
- hospitals
- medical insurance corporations
The NJ legislation, signed by Gov. Christie, exceeds HIPAA requirements and will require encryption of:
- patient’s name linked with:
- a Social Security number
- driver’s license or other state-issued identification
- address
- identifiable health information.
Downsizing Health Care Data Sharing
Private companies want access to government health care information to build their business, but they’re access to health care data is shrinking fast. HHS is severely cutting the information it is sharing with third parties.
The change was sparked after the AP reported that healthcare.gov was sending personal identifying information to third parties for marketing, advertising, and internet data performance purposes.
Privacy advocates, the Electronic Frontier Foundation, Senator Hatch and Senator Grassley want the federal government to do more to stop health care data sharing with private companies.
Survey Says 34% More Spent on Retailer Cyber & Data Protections
The Target data breach of 2013 changed a lot of things. Cyber Insurance is a booming business, and spending for cyber security is increased on average 34%. The survey also said:
- 57% of U.S. CEOs extremely concerned about over-regulation
- AppRiver says last year it quarantined about 1 billion email messages that contained viruses in attachments, about double the amount it did in 2013.
- 75% of the British people it asked said they want more transparency in business, and 81% said they want more accountability.
- A survey by KPMG of the FTSE350 found 58% of respondents said they expect their cybersecurity risk to increase over the next year. WSJ