1. Latest Developments in Privacy Robert J. Scott Managing Partner

2. Latest Developments in Privacy © 2007 Scott&Scott, LLP

3. Latest Developments in Privacy © 2007 Scott&Scott, LLP The Business Impact of Data Breach º May 15, 2007 Survey º Commissioned by Scott & Scott LLP º Conducted by Ponemon Institute º Respondents = 720 companies º Margin of Error <3%

4. Latest Developments in Privacy © 2007 Scott&Scott, LLP Network Security and Privacy Injury Claims º FTC Investigations º State Investigations º Private Causes of Action º Mitigation Strategies

5. Latest Developments in Privacy © 2007 Scott&Scott, LLP FTC Investigations º Unfair Practices º Violations of Fair Credit Reporting Act º Failure to Maintain Adequate Security º Failure to Protect Financial Data º Failure to Disclose Security Breaches º Violations of Federal Trade Commission Act º Violations of GLBA

6. Latest Developments in Privacy © 2007 Scott&Scott, LLP Losses Related to FTC Investigations º State C Superior Mortgage Company Agrees to Refrain from Making Misrepresentations and to Allow FTC Compliance Monitoring for 10 Years. º DSW, Inc., Nations Title, and Card Systems Agree to Implement Comprehensive Security Measures and Allow FTC Compliance Monitoring for 20 Years. º ChoicePoint Agrees to Pay $15 Million and to Allow FTC Compliance Monitoring for 20 Years. onsumer Protection Laws º Breach Notification Violations º Violations for Failure to Protect and Properly Destroy Customer Data

7. Latest Developments in Privacy © 2007 Scott&Scott, LLP State Investigations º State Consumer Protection Laws º Breach Notification Violations º Violations for Failure to Protect and Properly Destroy Customer Data

8. Latest Developments in Privacy © 2007 Scott&Scott, LLP Losses Related to State Investigations º Forty-four state Attorneys General settled for $500,000 with ChoicePoint after it sold personal data to identity thieves. º NY Attorney General settled with Datran Media for $1.1 million after Datran improperly disclosed personal data. º TX Attorney General entered into an agreed temporary injunction with CNG Financial and several other companies requiring proper destruction of customer records.

9. Latest Developments in Privacy © 2007 Scott&Scott, LLP Private Causes of Action º Breach of Contract Claims º Third-Party Beneficiary Claims º Contractual and Non-Contractual Indemnity Claims º Tort / Negligence Claims º Failure to Maintain Adequate Security º Negligent Retention of Data º Negligent Misrepresentation Regarding Breaches in Security

10. Latest Developments in Privacy © 2007 Scott&Scott, LLP Private Party Claims Scenarios º Class action lawsuit against TJX based on failure to comply with the PCI Data Security Standard. º Class action lawsuit against the Veterans Administration for violations of the Privacy Act. º Class action lawsuit against TJX alleging negligence. º Class action lawsuits against merchants alleging violations of FACTA.

11. Latest Developments in Privacy © 2007 Scott&Scott, LLP State Data Breach Notification Laws

12. Latest Developments in Privacy © 2007 Scott&Scott, LLP Robert J. Scott Managing Partner rjsott@scottandscottllp.com 800-596-6176 (Telephone) 800-529-3292 (Facsimile) Contact Information