New Data Security Rules for Financial Institutions from NY

New York is home to WallStreet. Naturally the New York Department of Financial Services would include new exmaination requirements that focus on data security. Exmainations will now include:

  • Management of 3rd parties
  • Cyber Security Insurance requirements
  • Monitoring, protection, testing, and detection of cyber security systems [3 page letter from NYDFS] [WSJ]

3 Articles on Banks and Credit Unions Suing Retailers After a Data Security Breach

Winter 2013 brought a large data breach for Target. Various lawsuits ensued. Financial institutions sued. Individuals sued.

Target had sought to dismiss the suit brought by 5 financial institutions. The judge said, “NO,” in one of the first rulings of its kind allowing financial institutions to sue retailers for data breaches. 

Judge Magnuson also said, “imposing a duty on Target in this case will aid Minnesota’s policy of punishing companies that do not secure consumers’ credit- and debit-card information.”  [Bloomberg] [Law360] [NY Times | BitsBlog]

Health Care Data Security. HHSC Offers 3 Legislative Proposals

HHSC gave the House Committee on Public Health and the Senate Health and Human Services Committee a holiday gift- a report on data security.

The report lays out plans for rulemaking and legislative recommendations, including new requirements for providers: 

  • Amend the Texas Medical Records Privacy Act (the “Act”), Chapter 181, Health and Safety Code, to include reference to electronic PHI security requirements similar to those included as part of 26 required or addressable security considerations in the HIPAA security regulations 

  • Require entities not covered by HIPAA, but that are covered by the TX Medical Records Privacy Act to comply with electronic PHI security requirements.

  • Establish breach response and notification requirements. 

  • Require adequate investigation, mitigation, and corrective action following a breach of PHI and a duty to promptly notify individuals of a breach of PHI in any form, electronic, oral, or paper  [HHSC]

Data Security Legislation Predictions for Financial Institutions

Legislation predictions from Bankers: 

  • Banks required to appoint chief information security officers
  • Banks to undergo quarterly tests for information system vulnerabilities
  • Required review of these third-party contracts and relationships
  • Standard set of protocols that banks must follow
  • Tort issues like: 
    • assign legal duties and responsibility
    • illuminate investor or shareholder disclosure obligations

[American Banker]

Student Data Privacy- Private Companies Want the Data. States Move to Protect Student Data.

How do policy makers balance the need for educational systems to adapt and improve while also protecting student data?

 It’s a state issue. It’s a federal issue. It’s a local school district policy issue. Politico calls it an issue that “Parents, activists and a select group of lawmakers are clamoring for a fix.”

Federal, bipartisan bills are languishing. in 2014 Colorado, Oklahoma and California passed their own bills to protect sudent data. Industry wants to self regulate, with some online education providers signing a letter that states they will not sell student data.  [Politico]

 

 

 

Retailer has breach. 5 Banks sue. Litigation continues to Protect Public Policy. Tort Reform on Horizon.

Winter 2013 brought a large data breach for Target. Various lawsuits ensued. Financial institutions sued. Individuals sued.

Target had sought to dismiss the suit brought by 5 financial institutions. The judge said no.

Judge Magnuson also said, “imposing a duty on Target in this case will aid Minnesota’s policy of punishing companies that do not secure consumers’ credit- and debit-card information.”  [Bloomberg] [Law360]