Indiana AG Proposes Data Security Legislation

The proposed legislation would require more of businesses, including:

  • More stringent requirements for storing & retaining sensitive data
  • Reduce harm to consumers with better notifications
  • Increase transparency of online privacy policies

What does this mean for business:

  • Require data to be securely stored
    • Delete personal or financial data
    • Retain only what is necessary for business purposes and processes
  • Limit sharing or selling of data only when authorized by law or when consumers are informed in advance
  • Inform consumers by clear and conspicuous notice when personal data must be collected and how long it will be stored
  •  Data Breach Notification Changes with quicker notifications to consumers, with more information, applied to more data breaches.   AD LAW ACCESS  National Law Review Indiana Attorney General Proposal 

FTC Has Authority to Pursue Data Breach Enforcement

FTC and FCC are both regulating data breaches. FTC pursued an enforcement action against Wyndham Hotels, which then challenged the FTC’s regulatory authority. 

In a case watched by many corporations, the courts said yes, the FTC has regulatory authority to take enforcment actions related to data breaches.  

In late 2014, the U.S. Court of Appeals for the Third Circuit ordered the parties to mediation to save all parties time and money.    King & Spaulding via JD Supra

Why does this matter? Data security laws on the state level are increasing.  State level enforcement is inevitable. Enforcement will come with hefty fines against businesses that experience data breaches. 

 

Kerfuffle: Financial Institutions v. 6 Retailer Groups- Which Bears the Financial Burden for a Data Breach?

The fighters for financial institutions:   Independent Community Bankers of America  

The fighters for retailers: Retail Industry Leaders Association, National Retail Federation, National Grocers Association,  Merchant Advisory Group, National Association of Convenience Stores, Food Marketing Institute, &  National Restaurant Association 

 Why did the kerfuffle start: Banks assert that they absorb the heaviest burden “following security breaches of payment card data.”   The Independent Community Bankers Support:

  • “the costs of data breaches should ultimately be borne by the breached party,
  • all participants in the payments system—including merchants—should be subject to Gramm-Leach-Bliley Act–like data-security standards,
  • a national data-security breach and notification standard should be implemented to replace the current patchwork of state laws,
  • unnecessary barriers to effective threat-information sharing between law enforcement and the financial and retail sectors should be removed, and
  • while community banks and other financial institutions continue to move to chip technology for debit and credit cards, these technologies alone may not have prevented the recent retailer breaches and do not protect against fraud in “card-not-present” transactions, such as online purchases.”     ICBA Press Release

Retort from the Retailers:  

  • “Retailers bear more of the costs of breaches than banks. “
  • “We need increased sharing of information between law enforcement and the business community, as well as between retailers and financial institutions. “
  • ” Ignoring PIN technology leaves us all more vulnerable.  “

  • “The Gramm-Leach-Bliley Act is not a model for data security. ”   Letter from the Retail Groups

    The Hill: Data Breach Payment Fight Heats Up

 

 

 

 

Healthcare Data Must Be Addressed When Crafting Data Security Laws

Federal Health and Human Services has pursued a string of health care data breach claims against health care providers.

Health care data is protected under HIPAA, and data breach issues could also fall under data security laws and regulations.  

For refresher on the HHS settlement with Anchorage Community Mental Health Services, see Association of Corporate Counsel. 

Trend: Insurance for Cyber Security

Forecasting trends related to hacking/data breaches/cyber security is a hot topic. Just look at the plethora of class action lawsuits, and the Sony hack that led to pulling the film, The Interview, and its own set of lawsuits.

In an interview with the WallStreet Journal Legal Writer Dan Dipietro, a cyber security expert says he expects cyber security insurance to soon be part of the ordinary course of business.  

WallStreet Journal

 

Federal Secure Data Act- Disallow Law Enforcement Surveillance

Tech companies (makers of computers, phones, tablets, etc… & software companies) are getting protection under a bill By Sen. Wyden.  

Think of all the personal privacy bills in Texas during 2013- drones, license plate capturing, photography protections… Texas loves protecting personal privacy from big brother. 

The Wyden bill would prohibit law enforcement from requiring tech companies to make it easy for law enforcement to access data and devices. Closing this exception would make it harder for hackers to access data and devices.

Win for data security against hackers. Win for Constitutional protection against unreasonable searches.   VPN Creative | The Verge 

Lawmakers: 500 Million Financial Records Hacked in 2014. Need Policy Fixes.

Lawmakers wants to know what financial institutions are doing to keep financial data secure. This applies to state and federal lawmakers.

National press focuses on federal lawmakers. So, here we go: Sen. Warren and Rep. Cummings want to know which banks have experienced cyber attacks. They claim 500 million records have been hacked from financial institutions in the last year, and they want solutions to fix it.

We all know this will first get fixed on the state level,  like the 11 states that enacted data security bills in 2014. 

 Above the Law  | Letter from Sen. Warren & Rep. Cummings  

 

National Consumers League: California Data Security Legislation is Model Legislation

California’s sweeping data security legislation should serve as a model for the nation and states according to the National Consumers League (“NCL”).

NCL also commends the 10 states that have enacted data security legislation requiring businesses to implement data security protocols. The Hill  California’s Assembly Bill 1710

 

 

Sony Pictures Data Breach Leads to Lawsuits

Data breaches and law suits go together like PB&J- pear, brie and jambon.

Sony faces a class action lawsuit from former employees, who claim Sony had knolwedge of the data security weaknesses & did nothing to correct or protect confidential information.

The data breach leak included personal & confidential employee information, and their lawsuit is limited to the leaking of the employee information.  Deadline Hollywood  Sony Employee Class Action Court Filing 

This should be on every employer’s radar as well as the impending legislation to address data security that may add new burdens to businesses.