Data Security Breaches: The Growing Liability Threat Crafting and - PowerPoint PPT Presentation

Data Security Breaches: The Growing Liability Threat Crafting and Implementing Policies to Prevent and Crafting and Implementing Policies to Prevent and presents presents Respond to Inadvertent Disclosures A Live 90-Minute Teleconference/Webinar with Interactive Q&A Today's panel features: Jonathan T. Rubens, Of Counsel, Bullivant Houser Bailey , San Francisco Catherine D. Meyer, Counsel, Pillsbury Winthrop Shaw Pittman , Los Angeles Aaron P. Simpson , Hunton & Williams , New York Thursday, February 11, 2010 The conference begins at: 1 pm Eastern p 12 pm Central 11 am Mountain 10 am Pacific You can access the audio portion of the conference on the telephone or by using your computer's speakers. Please refer to the dial in/ log in instructions emailed to registrations. CLICK ON EACH FILE IN THE LEFT HAND COLUMN TO SEE INDIVIDUAL PRESENTATIONS. If no column is present: click Bookmarks or Pages on the left side of the window. If no icons are present: Click View , select Navigational Panels , and chose either Bookmarks or Pages . If you need assistance or to register for the audio portion, please call Strafford customer service at 800-926-7926 ext. 10

For CLE purposes, please let us know how many people are listening at your location by • closing the notification box • and typing in the chat box your company name and the number of attendees. • Then click the blue icon beside the box to send.

DATA SECURITY BREACHES: THE GROWING THREAT DATA SECURITY BREACHES: THE GROWING THREAT DATA SECURITY BREACHES: THE GROWING THREAT DATA SECURITY BREACHES: THE GROWING THREAT PART I: RECENT STATE LEGISLATION AND CIVIL PART I: RECENT STATE LEGISLATION AND CIVIL LITIGATION LITIGATION LITIGATION LITIGATION Jonathan T. Rubens h b Bullivant Houser Bailey PC San Francisco Jonathan.rubens@bullivant.com

Key Federal Key Federal Legislation Addressing Data Legislation Addressing Data Security Practices Security Practices i i i i • Fair Credit Reporting Act of 1970 • Video Privacy Protection Act of 1988 • Electronic Communications Privacy Act of 1986 • Telemarketing and Consumer Fraud and Abuse T l k ti d C F d d Ab Prevention Act of 1994 • HIPAA (1996) ( ) • Gramm ‐ Leach ‐ Bliley (1999) • Fair and Accurate Credit Transactions Act of 2003 • Red Flags Rule (2009) R d Fl R l (2009) • Hi ‐ Tech Act (2010) 2

CA Data Security / Breach Law CA Data Security / Breach Law CA Data Security / Breach Law CA Data Security / Breach Law • California – where it started California where it started – Requires data security procedures and practices that are “reasonable” and “appropriate to the that are reasonable and appropriate to the nature of the information”. Civil Code Section 1798.81(5)(b) – Requires notice following breach. Section 1798.82; 3

California Data Security / Breach Law California Data Security / Breach Law California Data Security / Breach Law California Data Security / Breach Law • California: “personal information” means: Ca o a: pe so a o at o ea s: – First name or first initial and last name, in combination with any of: • SSN • Drivers License No. • Credit Card #, Debit Card # along with login and password; , g g p ; • Medical Info (added more recently): – Notice required following breach regardless of d f ll b h dl f evidence of harm 4

Massachusetts Massachusetts Massachusetts Massachusetts • New Mass Law effective March 1, 2010 – MGL Ch 93H ‐ • Requires notice following breach to consumers and state: – Notice required, from a person that owns or stores information ot ce equ ed, o a pe so t at o s o sto es o at o about a resident, to the owner or licensor of the information, when the person knows or has reason to know that the information was acquired or used by an unauthorized person or for an unauthorized purpose; for an unauthorized purpose; – From the owner or licensor, to the attorney general, the director of consumer affairs and business regulation and to the resident of consumer affairs and business regulation and to the resident. (Ch 93H section 3) 5

Massachusetts Massachusetts Massachusetts Massachusetts • Defines Personal Information as: – A resident’s first name or first initial, plus last name, with one or more of • SSN • SSN • DL or State ID Card number • CC #, Debit Card #, financial account #, with or without any required security or access code PIN or password required security or access code, PIN, or password • Applies to any person, corporation, or other legal entity that owns, licenses, maintains, or stores the personal information of a resident of Massachusetts (whether or ( not such person is present in Massachusetts). 6

Massachusetts Massachusetts Massachusetts Massachusetts • Statute directs dept. of consumer affairs to adopt regs: p p g – to “safeguard the personal information of residents of the Commonwealth” – to be consistent with the safeguards for protection of to be “consistent with the safeguards for protection of personal information set forth in the federal regulations by which the person is regulated” (Section 2(a)) – to “insure the security and confidentiality of customer information in a manner fully consistent with industry standards ” (Ch 93H Section 2(a)) 7

Massachusetts Massachusetts ‐ Regulations Massachusetts Massachusetts Regulations Regulations Regulations • 201 Mass Code Regs. 17.00 et seq. impose 0 ass Code egs. .00 et seq. pose “minimum standards to safeguard personal information in both paper and electronic records” on companies that collect, store or transmit h ll personal information concerning Massachusetts residents residents. • Regs require development of a comprehensive “written information security program” (WISP) written information security program (WISP) for records with personal information 8

Mass Regs Mass Regs Mass Regs Mass Regs • WISP must include: – Designation of a employee in charge of WISP – Identifying internal and external risks to security of records containing PI; records containing PI; – Employee policies and discipline; – Preventing terminated employee access to PI; – Service provider oversight; – Data storage; – Monitoring, Updating; Monitoring Updating; – Documenting response to breach. 9

Mass Regs Mass Regs Mass Regs Mass Regs • WISP must include a security plan that addresses: – Encryption of all personal information transmitted across public networks or stored on laptops, portable devices; – Secure user authentication protocols; – Secure access control measures; – Monitoring for unauthorized system access; – “Reasonably up ‐ to ‐ date firewall protection and OS system patches” for a network connected to the Internet; h ” f k d h – “Reasonably up ‐ to ‐ date” system security agent software that includes malware protection and “reasonably up ‐ to ‐ date patches and virus definitions”; patches and virus definitions ; – Employee training on the security system and protection of PI; 10

Massachusetts Massachusetts Massachusetts Massachusetts • Compliance deadline: Mach 1, 2010 Co p a ce dead e: ac , 0 0 • Attorney general may bring action “to remedy violations of this Chapter and for other relief that p may be appropriate.” • Attorney General may seek injunctive relief against the person involved in an unauthorized act or practice at issue. • Court may impose $5,000 civil penalty for each C t i $5 000 i il lt f h violation 11

Nevada Nevada Nevada Nevada • Businesses must encrypt personal information us esses ust e c ypt pe so a o at o – on data storage or mobile devices moved beyond the “physical or logical controls” of the business; or – When data is transferred “through an electronic non ‐ voice transmission other than a facsimile” outside the secure system of the business y • Business that accept payment cards must comply with PCI DSS • Defines acceptable levels of encryption 12

Minnesota Minnesota Minnesota Minnesota • Prohibits retention of security codes and other o b ts ete t o o secu ty codes a d ot e credit card data after processing transactions • Requires merchants to reimburse credit ‐ card q issuing financial institutions for costs incurred following a data breach • Creates private right of action for financial institutions following noncompliance by merchants merchants • Minn. Stat. 365E.64. 13

Other Jurisdictions; Potential Laws Other Jurisdictions; Potential Laws Other Jurisdictions; Potential Laws Other Jurisdictions; Potential Laws • Data breach notification statutes now on the Data breach notification statutes now on the books in 45 states • D.C., Puerto Rico, US V.I. • Federal legislation introduced in both the House and the Senate in 2009 based on state House and the Senate in 2009, based on state breach notification statutes 14

FTC Enforcement FTC Enforcement FTC Enforcement FTC Enforcement • FTC’s Authority to Regulate Data Security FTC s Authority to Regulate Data Security Practices • Broad power under §5 of FTC Act to regulate "unfair or Broad power under §5 of FTC Act to regulate unfair or deceptive acts or practices in or affecting commerce” • Enforcement Responsibility for Specific Statutes • COPPA TCFAPA • CAN ‐ SPAM FCRA • GLB G FACTA / RED FLAGS RULE C / GS U 15