Post Equifax, New Data Breach Notification Laws are Inevitable

The U.S. Securities and Exchange Commission plans to update its six-year-old guidelines regarding data breach notification and cyber risk disclosure, Bank Info Security reports: The agency has indicated that it expects to refine guidance around how businesses disclose cybersecurity risks to investors as well as require insider trading programs to include blackout rules in the event that a suspected data breach gets discovered. "Unfortunately, in the reality that we live in now, cyber breaches are going to be increasingly common, and this is in part why the SEC is so fully focused on cybersecurity," says Matt Rossi, a former assistant chief litigation counsel to the SEC who's now an atto ey specializing in securities litigation and enforcement as well as data privacy at global law firm Mayer Brown. "Chairman [Jay] Clayton said it's one of the greatest risks to the financial system right now." There is great irony in the SEC’s announcement. Less than two weeks after the Equifax breach came to light last fall, the agency disclosed that its EDGAR database, which is used to disseminate company news and data to investors, had been hacked – over a year prior. Be that as it may, data privacy is at top of mind for consumers. The General Data Protection Regulation (GDPR) is about to become law in the European Union, and 2017 saw numerous high-profile incidents where breached organizations sat on their hands for extended periods of time before notifying potential victims. Equifax Breach Incites Outrage from Congress, But No Action The SEC’s guidelines are just that – guidelines, not legislation – and they apply only to publicly traded firms. While 48 states have data privacy laws on the books, and companies in certain industries are subject to industry-specific regulations or standards, such as HIPAA and PCI DSS, there is no federal data privacy or data breach notification law that applies across industries. For the past several years, the U.S. government has been under increasing pressure to establish federal data breach notification regulations and address other data privacy issues. This pressure intensified after the Equifax breach was disclosed, and many privacy advocates hoped the incident would finally push Congress to act. Unfortunately, lawmakers’ initial public outrage over the Equifax breach quickly died down, and Congress’ focus shifted back to healthcare and tax reform. Frustrated with the lack of progress in Washington, states have begun taking matters into their own hands. Last year, New York State passed a sweeping cybersecurity law that was heavily steeped in data governance and integrated risk management. Effective January 1, 2018, Maryland’s data breach notification law was amended to not only require companies to notify victims within 45 days of a data breach but also expand the definition of “personal information.” Could We Ultimately See an “American GDPR”? However, the lack of progress on a federal level doesn’t mea U.S. companies should assume that we will never see an “American version” of the GDPR on a federal level. The New York Times recently reported on businesses that do not accept cash as a form of payment. While these are isolated incidents, they are a sign of the rapid digitization of our society. Consumers are seeing more and more of their personal information being preserved for posterity in digital files kept by a dizzying array of government entities and private-sector organizations, with almost no control over where it goes or what happens to it. Even minors’ information is stored digitally, and children can easily become victims of identity theft. Businesses, meanwhile, are struggling to stay abreast of an ever-changing compliance landscape complicated by the fact that while states have borders, ecommerce does not. This forces businesses that sell in multiple states to reconcile a confusing patchwork of regulations, some of which contradict each other. Depending on individual states to regulate data breach notification and data privacy is rapidly becoming untenable, and the federal government will be forced to step in, as it did with HIPAA in the 1990s. In the meantime, the best option for businesses is to adopt a data-centric, integrated risk management approach to ensure they have control of their data and are able to quickly adapt to changing regulations.