Legal Counsel to the Financial Services Industry PRIVACY AND DATA SECURITY: UNDERSTANDING THE LEGAL FRAMEWORK November 19, 2010 Presented by: Donna L. Wilson Partner BuckleySandler LLP Los Angeles, CA (424)

22  Evolution from crisis management approach to risk management approach  Risks are constantly changing  Were primarily third-party breach and technology issues  Now "voluntary breach" and marketing/business issues  Some risks were largely never realized (huge class action recoveries) while others were largely unforeseen (e.g., cloud computing) WHERE WE WERE, WHERE WE ARE, AND WHERE ARE WE GOING?

33 LITIGATION TRENDS, DEVELOPMENTS AND RISKS Good News / Bad News  Good News: -The good news: financial institutions are using physical security safeguards, and technologies to identify or prevent unauthorized transfer of information, and have taken steps to secure Social Security numbers. (Privacy & Data Protection Practices: A Benchmark Study of the Financial Services Industry (Mar. 2010)).

44 LITIGATION TRENDS, DEVELOPMENTS AND RISKS (CONT.) Good News / Bad News  Bad News: - Less than half of the institutions surveyed (i) review new software applications and databases for legal compliance and privacy considerations before implementing; or (ii) use intrusion detection systems and data loss prevention technology. - More than 83% use real customer or employee information in development and testing, and 88% continue to use Social Security numbers as primary identifiers. - Most significantly, half believe that they have insufficient resources to manage privacy/data security risks. (Id.)

55 AN INTRODUCTION TO KEY STATUTES  Federal (e.g., FCRA/FACTA, GLB, Dodd-Frank, FTC Act)  State (e.g., Song-Beverly Act, data breach notification statutes, PCI standard setting)

66 THE PLAINTIFF'S BAR AND CLASS ACTIONS  Bars to common law recoveries  But is the tide changing? (Gap v. Ruiz, Hannaford Brothers)

77 - Given the limited availability of common law damages (and thus relative disinterest of the plaintiff’s bar), regulators have, and will continue to take a lead role - Privacy issues fall within the scope of numerous regulators (e.g., FTC, SEC, CFPB) - Interaction of those regulators on and across both state and federal levels THE ROLE OF FEDERAL AND STATE REGULATORS

88  A plaintiff lawyer’s dream come true? -- All eyes on Hannford Bros. Co. Customer Data Security Breach Litigation, (MDL-1954 D. Maine): – Do time and effort alone, spent in a reasonable effort to avert reasonably foreseeable harm, constitute a cognizable injury under Maine common law? – If so, plaintiffs may have both a negligence and implied contract claim. 2010: A REFLECTION OF THINGS TO COME

99  Facebook, Google, And Netflix Cases: – Much-publicized collisions between creative marketing and product/service development and privacy/data security considerations. – Focus of attention by the media, class action lawyers, industry, privacy watchdogs, and regulators.  Cloud Computing: A Game Changer? – Benefits versus risks – cost savings and efficiencies on the one hand, but loss of direct control of information. – Already appearing as an issue/factor in privacy-related litigation. 2010: A REFLECTION OF THINGS TO COME (CONT.)

10  More traps for the unwary: state privacy and data breach legislation and regulation in 2010: – Data breach notification – PCI standards – Third-party service provider issues  Dodd-Frank taking it to the next level 2010: A REFLECTION OF THINGS TO COME (CONT.)

11  Always remember: Privacy risk = data collection, data use, and data security.  Change your focus and risk management to address the evolving nature of privacy/data security risks: Don’t simply plan for fighting the last battle: – Consumer liability/defense costs versus brand/reputation damage versus data breach notification costs versus third-party business-to-business litigation  Don’t overlook contractual protections potentially available to mitigate these risks: – Indemnification – Insurance NOW WHAT?