WA Data Security Legislation

Hot Topic: How to protect and notify individuals in case of a data breach. Here’s Washington State’s proposal to upgrade their notification laws: Finally, unlike other states, Washington state law does not require any centralized reporting to the state when a data breach occurs, resulting in a lack of robust information for law enforcement and consumers.

The proposed legislation strengthens Washington’s data breach notification law by:

• Notification requirements when the data breach is encrypted data

• Establish notification timelines.

  • Require consumer notification as immediately as possible and no later than 30 days whenever personal information is likely compromised

• Centralized reporting to the state to improve enforcement actions.

  • Require the Attorney General to be notified within 30 days when a data breach occurs at a business, non-profit or public agency, enabling the Attorney General to compile centralized information about data breaches for law enforcement and consumers

• Require businesses, non-profits and agencies, when reporting a breach, to provide consumers with basic information they can use to help secure or recover their identities.   

Kirkland Report: WA House Bill 1078 & Senate Bill 5047

 

White House Wants to Lead in Education Data Protection Legislation

The White House released proposals to protect data. Student data. Energy data.  Tech data. 75 Companies have said “Aye.” Including the big dogs- Apple and Microsoft. 

Education Data Protection:

  • No sales to third parties for a purpose other than strictly educational.
  • No targetted advertising to kids. 

WSJhttp://blogs.wsj.com/law/2015/01/12/white-house-moves-to-protect-data-privacy/

 

Data Security Ripe for Tort Reform. Will it help? No Says Washington Post Legal Commentator

Mandatory data breach notices have triggered lawsuits. Lawsuits have led to class action lawsuits. Think Target and Home Depot, the big retail data breaches. Class Action lawsuits lead to settlements.  

Whether one agrees or not what the impact of tort reform will be, data security is ripe for tort reform. 

 Volokoh Conspiracy | Washington Post

Data Security Taking Front Stage with New Congress

Data security and protecting consumers education, health and financial data just got a kick start.  

  • Texas Congressman Hurd will chair the IT Subcommittee — a new panel created by incoming Oversight Committee Chairman Jason Chaffetz of Utah.
  • Texas Congressman Ratcliffe will chair the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, a part of the Homeland Security Committee.

Dallas Morning News

In 2014 states began passing data security and data protection legislation. Just look to legislative efforts in CA, FL, NJ, IN, WY, AL. Click the legislative trend category to see a complete list.  

 

Data Security Sample Bills: Protect Minors, Students, Health Care Data & More

In 2014 California passed a number of data security bills to protect students, consumers and patients, including:

  • Privacy Rights for California Minors in the Digital World (California’s SB 568)

    •  Prohibits marketing or advertising alcohol, firearms and tobacco to minors

    • Prohibits using, disclosing, or compiling a minor’s personal information (or permitting a third party to do so).

    • Intended to exceed federal protections for minors.

  • Data Breach Notification Amendments (California’s AB 1710):

    •  Business must “implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” 

    • Any identity theft prevention services must be made at no cost to the affected person for not less than 1 year. 

  • Medical Information Breach Notification Period (California’s AB 1755):
    • Expands the time permitted to report breaches or disclosures of patients’ medical information to the state & to the patient.  
    • Permits email notification.

  • Safeguarding Pupil Digital Records ( California’s AB 1584):

    • Provide local educational agencies with control to contract with third parties that provide digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of pupil records. 

    • Limits the use of the pupil records, ensuring compliance with the federal Family Educational Rights and Privacy Act

  • Pupil Records and Social Media (California’s AB 1442):

    • Restricts a school district, county education office, or charter school that gathers information from an enrolled pupil on social media from using information collected for other purposes.

    • Prohibits selling or sharing of information, and imposes other requirements related to the destruction of information. 

  • Student Online Personal Information Protection Act (California’sSB 1177):

    • “Prohibits operators of websites and online services and applications used primarily for K–12 school purposes, and designed and marketed for those purposes, from pursuing targeted advertising to students and their parents or legal guardians.”

    • “Prohibits using covered information to build a profile of K–12 students, selling a student’s information, and disclosing certain types of information.”  

National Law Review 

 

 

$5.6 Billion: The 2015 Cost of Health Care Data Breaches

$5.6 Billion buys a lot of tongue depressers. Its also the expected cost of data breaches in the health care industry for 2015 according to the 2015 2nd Annual Data Breach Industry Forecast by Experian. Highlights from the forecast :

  • A Ponemon Institute survey found that 72% of healthcare organizations indicated they are only “somewhat confident” or “not confident” in the security and privacy of patient data. 
  • Increasing data security by health care organizations could limit  the risk of breaches and  limit scrutiny from regulators   Business Solutions