Dino Tsibouris & Mehmet Munur Privacy and Information Security Laws and Updates

Dino Tsibouris (614) Privacy and Information Security Laws and Updates Mehmet Munur (614)

Outline 1.Themes and Trends 2.Federal and State Enforcement Actions 3.Federal and State Data Breach Developments 4.Planning Ahead and Contract Negotiations 5.International Data Privacy

Themes and Trends

The Legal Response Proposed federal legislation Expanding state legislation Federal and state level enforcement Civil liability

Closer Look at Wyndham 3 data breaches at hotels in less than 2 years. Privacy and security representations made. FTC alleges that Wyndham failed to: – Use complex IDs and passwords, – Use firewalls and network segmentation, – Patch systems, and – Follow incident response procedures. Compromised 500K credit cards.

Typical FTC §5 Enforcement Action Designate employee responsible for privacy or security program. Conduct risk assessment and employee training. Test and monitor risk identified. Implement and maintain protections. Evaluate and adjust program. Biennial third-party assessments. In effect for 20 years.

Zappos MA AG Enforcement Zappos agreed to pay $106K Unauthorized access to: – Names, addresses, phone numbers, – Last 4 digits of credit card numbers, and – Login credentials of customers.

Zappos MA AG Enforcement Settlement requires: – Maintenance and compliance with information security policies, – Providing the AG with information, – Demonstrating compliance with PCI-DSS for two years, – Third party audit, providing copy to MA AG, and addressing deficiencies, and – Annual training.

SHA1 MD5

A Push for Federal Data Breach Legislation Personal Data Notification & Protection Act Proposed by President Obama at the State of the Union Address on January 20, 2015 Pre-empts state laws Must notify in 30 days No private right of action FTC enforcement

Personal Data Notification & Protection Act Triggers First and last name/or first initial and last name along with any two: – Home address or phone number – Mother’s maiden name – Full birth date SSN, DL, passport, alien registration number Biometric data Unique account ID (user name, routing code)

Personal Data Notification & Protection Act Triggers Any combination of the following three elements: – First and last name/first initial and last name – Unique account ID – Any security code/source code that could generate a security code or password

Personal Data Notification & Protection Act Risk of harm analysis Must send notice 30 days after discovery Individual notice ( acceptable with consent) Notice to media Notice to Federal law enforcement Notice to credit reporting agencies

A Push for State Law and Regulation Timing and content of breach notice Definition of personal data – /password information – Non-HIPAA health data Requirements to inform media/regulators

Contracting Security and Privacy – Incident or Breach Notification Obligations and Costs – Industry Certifications and Vulnerability Scans – Audits by Customer or Regulator – International Data Flows

Contracting 1.2 Your Account. … we and our affiliates are not responsible for unauthorized access to your account.

Contracting 3.2. Protection of Your Data. We will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Your Data, as described in the Documentation.

Security Breaches Plan ahead Identify response team Identify vendors and contacts PR Aspects Test Insure

Security Breaches Federal and state laws govern unauthorized access to personal information – Gramm Leach Bliley (CFPB, SEC, NCUA, OCC, FDIC, FTC) – HIPAA/HITECH Breach Notification Rule (HHS) – Health Breach Notification Rule (FTC) – State laws vary, apply to companies outside the state, require vendor to notify data owner, private right of action to consumers to sue

Security Breaches Must get access to cloud provider information Access to vendor staff Must understand vendor data structure and security Identify data involved Identify degree of protection Identify if there was a reportable incident

Security Breaches Remediation Notification – Individuals, Regulators, Media Litigation

International Data Privacy

General Data Protection Regulation EU member states in final stages of negotiations Expected in the next year or so Includes data breach notification obligation Fines as high as 2% of annual turnover

Outline 1.Themes and Trends 2.Federal and State Enforcement Actions 3.Federal and State Data Breach Developments 4.Planning Ahead and Contract Negotiations 5.International Data Privacy

Dino Tsibouris (614) Questions & Answers Mehmet Munur (614)