Responding to a Data Breach 360° of IT Compliance Michael Bosse, Shareholder Litigation Practice Group Data Security & Privacy Team November 5, 2015

In the Event of a Data Breach Key actions in event of breach: Prompt action key – many statutes provide specific timing Appropriate team of responders Clear and concise action plan Assess data breach notification statutes (may need to comply with more than one state statute) Technical assessment – what really happened

Assemble Appropriate Team Contact departments/service providers relevant to breach mitigation Privacy Department/Privacy Officer Records Department Legal IT HR Public Relations/Marketing Outside Experts (e.g., outside PR, legal, security experts)

Post-Breach Investigation Paper or electronic records? What are the specifics of the “breach event” Type of information protected by breach statutes: Name plus SSN Drivers license number or state ID number Account number + security code, password Medical information Health insurance information or Any other information leading to potential personal or financial harm

Legal Review: Likelihood of Misuse and Required Notices Legal assessment – likelihood of misuse/harm Insurance review and Notice of Claim Notice to affected parties Method, timing, other Law Enforcement Requirements: Many states have number thresholds that trigger certain notice requirements Specific Content re: type of breach, etc. – statutes vary Notice to administrative or regulatory agencies

Notices & Other Response Actions Document all steps taken and maintain copies of reports, notices, etc. Notice to insurance carrier? Evaluate your security program, insurance, service provider contracts, training, technology, etc. and take reasonable steps to strengthen, improve and/or protect against further breaches PR and follow-up considerations, e.g. provide credit mentoring or other accommodations?

Communications to Affected Individuals Notification letters to include phone numbers for contacts Train employees on how to respond to inquiries Use of service providers (e.g., call center)? Information to be included in notices – each state differs slightly (e.g. some require description at breach event and others prohibit such descriptions)

Records Retention Thorough documentation of: Event Investigation Response Consider Retention Period for Documentation of Breach Statute of limitations? Regulatory? Review and refine data security plan, training and breach response action plan

Questions & Answers