Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

Massachusetts' Office of Consumer Affairs & Business Regulation (OCABR) recently released a revised version of its "Standards for the Protection of Personal Information of Residents of the Commonwealth" (the "Regulation").  This August 2009 version modifies the February 2009 version of the Regulation. The press release and the FAQs released by OCABR appear updated to address some of the changes in the regulations.

UPDATE (082509):  On his blog, Uncommon Sense Security, Jack Daniel shares his insight from the security perspective. 

For ease of reference, ILG has taken the time  to create a REDLINED VERSION showing the revisions in the new Regulation.  The redlines indicate changes between the February 2009 version and the August 2009 version of the Regulation.  Also included below is a summary of some of the more significant changes.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Nevada appears to be the second State to incorporate the Payment Card Industry Data Security Standard (PCI) into its personal information security law. Minnesota is the other State that incorporated part of PCI into its law. 

• Email This
• Print
• Comments (2)
• Trackbacks
• Share Link

Plastic Card Protection laws continue to be proposed in state legislatures. This time its Alabama and Iowa that are jumping into the fray with bills that incorporate the Payment Card Industry ("PCI") Data Security Standard and/or provide financial institutions with the legal right to seek reimbursement for costs associated with payment card security breaches. However, the Iowa and Alabama bills provide some new wrinkles.

Alabama SB 382. Here are some of the wrinkles in the Alabama bill:

(1) Personal Information Deletion Requirement. Requires the deletion/destruction of personal information that is "longer necessary to be retained."

(2) PCI Tie-In - PCI Section 3.2.. The bill prohibits the storage "in either encrypted or unencrypted form, subsequent to authorization, the card security code data, the PIN verification code data, the full contents of any track of a magnetic stripe or data chip, card-validation code, or value, or any other security information in a manner that permits access to an individual financial account." This is essentially the same duty as section 3.2 of the PCI Standard. Note this language appears to go beyond payment card security since it relates to "any other security information that permits access to an individual financial account." This language could possibly include passwords for online banking sites, online payment sites and other access codes tied to financial accounts (beyond credit card accounts).

(3) Financial Institutions Recovery of Reasonable Costs. Like other Plastic Card Protection laws, in the event the of a violation of the law and a security breach exposing personal information, the Alabama bill provides bank with the right to reimbursement for the reasonable costs of actions taken "to protect the personal information and account information of the customer or to continue to provide financial services to the customer," including the costs to reissue cards, open/close accounts, contacting cardholders and refunds or credits made to customers.

(4) Private Cause of Action. In a new twist the bill specifically provides a private cause of action for financial institutions against those that "are responsible for the security breach." The financial institution may receive not only actual damages, but also incidental and consequential damages, as well as court costs and reasonable attorney fees. Significantly, this language may help financial institutions recover damage elements that would be very difficult to recover under a traditional negligence claim.

Iowa S.S.B 3183. Here are some of the wrinkles in the Iowa bill:

(1) PCI Tie-In - Entire PCI Standard. The Iowa bill requires compliance with the entire PCI Standard by any entity that accepts a payment card in connection with transactions in the ordinary course of business. However, the bill also indicates that the Iowa attorney general must adopt rules necessary to implement the bill, including identifying the payment card industry standards to be applied.

(2) PCI Certification. Financial institutions initiating an action must request a certification of compliance from the party that suffered the security breach. The certification must be made by a payment card industry approved independent auditor. It appears that an action cannot be commenced against an entity that has not been found in violation of the PCI Standard.

(3) Financial Institutions Recovery of Reasonable Costs. The bill provides for the right to recover similar damage components as those in the Alabama bill.

(4) Attorney Fees for Prevailing Party. The bill provides that the prevailing party in an action will be entitled to recover attorney fees. However, if the prevailing party is an entity that has refused to certify PCI compliance it cannot recover attorney fees.

BOTTOMLINE:the legal liability will change radically if these bills get passed (like the Minnesota and Connecticut laws, as well as the bill in Washington State that has passed one house).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Ninth Circuit Partially Reverses Motion for Summary Judgment on Issue of Damages in Data Breach Case

One of the biggest obstacles for consumer plaintiffs in personal data breach lawsuits has been establishing the "damages" element for a negligence claim. Several courts have dismissed such suits ruling that plaintiffs could not provide sufficient evidence that they suffered an injury as the result of a data breach. Ironically one of landmark cases against establishing damages, Stollenwerk v. Tri-West Health Care Alliance (D. Ariz. 2005), may give plaintiffs' attorneys some additional ammunition. The United States Court of Appeals for the Ninth Circuit ("Appellate Court") recently ruled on the Stollenwerk appeal and provided the plaintiffs with a partial victory on the issue of proving damages that could clarify the liability landscape for data breach lawsuits (see Stollenwerk v. Tri-West Health Care Alliance (9^th Cir. November 20, 2007). The ruling may allow more data breach suits involving victims of actual identity theft to get in front of a jury and achieve more favorable settlements.

In its September 2005 opinion, the District Court dismissed all of the plaintiffs' claims on the grounds that they could not establish that they suffered any injury as a result of the Tri-West data breach. The Credit Monitoring Plaintiffs attempted to analogize financial credit monitoring expenses to medical monitoring expenses in "toxic tort" cases (e.g. asbestos lawsuits where otherwise healthy individuals exposed to asbestos paid doctors to monitor their health prior to any adverse affects manifesting). The District Court indicated that enhanced risk of future injury is generally insufficient to establish a negligence claim, but in the case of toxic tort lawsuits an exception was justified because of the importance of preserving public health. In addition, since the plaintiffs could not establish that the target of the burglary was their personal information (as opposed to the physical hard drives themselves), the court ruled that the Credit Monitoring Plaintiffs failed to provide evidence that such information was significantly exposed or that plaintiffs were at significantly increased risk of suffering identity fraud.

The District Court also dismissed the negligence claim of the ID Theft Plaintiff. Although the plaintiff suffered identity theft on several occasions six weeks after the burglary, the Court held that the circumstantial timing of the burglary and identity theft was insufficient evidence that the burglary was the cause of such theft.

The Appellate Court's Decision

In November 2007, the Appellate Court reversed the District Court's decision concerning the ID Theft Plaintiff, but upheld the lower court's ruling on the Credit Monitoring Plaintiffs.

The Credit Monitoring Plaintiffs

With respect to the Credit Monitoring Plaintiffs, the 9^th Circuit agreed that the analogy to toxic tort cases was not justified because credit monitoring does not directly involve health and human safety. However, the court did not reject the analogy entirely, noting that:

"In both circumstances the individual may manifest more obvious injury, such as identity fraud or disease, after some period of time, and in neither instance is the later manifestation of patent injury guaranteed, although the certainty with which such a development may be anticipated may be greater for toxic torts."

The Appellate Court also noted that under the facts of this case, even if the toxic tort analogy were apt, the Credit Monitoring Plaintiffs had not established the requisite elements to support their claim, including: (1) significant exposure of sensitive personal information; (2) a significantly increased risk of identity fraud as a result of that exposure; and (3) the necessity and effectiveness of credit monitoring in detecting, treating, and/or preventing identity fraud. The Court held that the plaintiffs did not provide sufficient evidence that their personal data was targeted or accessed. Moreover, the Court indicated that the plaintiffs' expert failed to objectively quantify the reduction of risk that would result from credit monitoring.

The ID Theft Plaintiff

The Appellate Court's opinion was much more forgiving for the ID Theft Plaintiff. In this case, the ID Theft Plaintiff allegedly was the victim of identity theft on six occasions after the burglary of Tri-West's hard drives. The Court did not make a distinction between "attempts" to open accounts and successful account openings - the Court appeared to conclude that both constituted identity theft. Significantly, the Court's opinion appears to simply accept that "identity theft" constitutes an injury, and instead focused on whether the ID Theft Plaintiff established that the burglary was the proximate cause of the identity theft.

On the issue of causation, to survive a motion for summary judgment, the plaintiff needed provide evidence from which a reasonable jury could conclude that ID Theft Plaintiff's injuries were the result of the burglary rather than other causes. Direct or circumstantial evidence is permitted, but this plaintiff was only able to offer circumstantial evidence, including:

1. Possession: the ID Theft Plaintiff provided Tri-West with his information;
2. Type of Information: the personal information stored on the Tri-West hard drives is the type of information that can be used to open credit card accounts;
3. Timing -- Identity Theft Incidents: the six alleged identity theft incidents all occurred after burglary, and the first began about six weeks after the burglary (the last happened about 3 - 4 months after the burglary);
4. Timing - Prior Incidents: the plaintiff had never suffered identity theft prior to the burglary (despite having his wallet stolen five years earlier); and
5. Limited Opportunities for Other Causes: the plaintiff testified that he had never transmitted his personal information over the Internet and that he shreds all mail in the form of credit card applications, approvals and pre-approvals.

The 9^th Circuit ruled that this circumstantial evidence on the issue of causation was sufficient for purposes of summary judgment and reversed the District Court's grant of summary judgment to the Defendants.

Conclusion

The Stollenwerk decision is largely a mixed bag for both plaintiffs and defendants. The 9^th Circuit's decision is good for defendants because it largely validates that the purchase of credit monitoring services or insurance to decrease the likelihood of potential future identity theft is not sufficient to establish damages for purposes of a negligence lawsuit. This ruling most likely decreases the risk of successful class action lawsuits involving massive numbers of plaintiffs whose personal information is exposed in a data breach. However, because its decision was based mainly on public policy grounds, and because it noted some similarities between toxic tort injuries and data breach injuries, the Court appeared to leave the door open a little for plaintiffs to make the toxic tort analogy in other jurisdictions.

The Court's ruling was favorable for plaintiffs that actually suffer identity theft after a data breach situation The Court was lenient in its acceptance of purely circumstantial evidence -- most of the evidence provided was very loosely tied to the actual burglary. As a result of this ruling, plaintiffs that were the victims of identity theft will have a better chance to get their case in front of a jury in the 9^th. On the flip side, since it appears that most data breaches never actually result in identity theft (see GAO Report (June 2007)), plaintiffs' lawyers may find it difficult to establish large classes that make these suits financially attractive to pursue. In all, this decision and other cases dismissing breach data cases seem to indicate that successful and severe consumer litigation (e.g. large successful class action suits) is still elusive for the plaintiffs' bar Circuit, which increases both the likelihood of success in litigation and the leverage plaintiffs will have to force a settlement.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

I came across this ruling in the TJX matter that dismisses some of the banks' claims against TJX: Link

Consistent with past decisions (B.J. Wholesalers) it looks like issuing banks cannot rely on a 3rd party beneficiary theory to go after merchants for breach of contract. Also appears that the economic loss doctrine is still an effective block to general negligence actions.

However, the negligent misrepresentation claim and unfair/deceptive business act claims both survived. The negligent misrepresentation argument was very interesting. Basically, it appears that the issuing banks alleged that by participating in an a financial network that relies on members taking appropriate security measures, TJX made "implied representations" that they would take security measures required by industry practice. The court let these allegations stand, indicating that the economic loss doctrine does not apply to a negligent misrepresentation claim in Massachusetts. In addition the court ruled that the banks' reliance on such implied representations is a question of fact inappropriate for resolution at the motion to dismiss phase. These allegations also serve as the basis for the Banks' unfair and deceptive business practices claims under Chapter 93 of Massachusetts' law.

While the survival of these claims is certainly good news for the banks, TJX may still be able to stop this case from going to trial using a motion for summary judgment further down the line. It will be interesting to see if the Banks can successfully argue that the costs of preemptively reissuing credit cards constitutes "damages" for purposes of negligent misrepresentation.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This month's post follows up on some developments in the FACTA credit card receipt class action suits that InfoSecCompliance explored in April 2007 newsletter (What You Don't Know Just Might Hurt You. - April 2007). In bad news for merchants defending these FACTA suits, the U.S. Supreme Court ("USSC") upheld a broad interpretation of "willful violation" of FACTA. However, in good news for merchants, citing potential bankruptcy-inducing damages ranging from $340 million to $3.4 billion, a U.S. District Court in California refused to certify a 3.4 million person class alleging FACTA violations

FACTA Summary

As discussed in April, a rash of over 100 class action lawsuits have been filed alleging violation of the Fair and Accurate Transaction Act of 2003 ("FACTA"), which limits the information that can be shown on an electronically-printed credit card receipt to the last five digits of the credit card number, and specifically prohibits printing a credit card's expiration date on the receipt. A single willful violation of FACTA could result in damages ranging from $100 to $1,000 (FACTA is incorporated into and part of the Fair Credit Reporting Act ["FCRA"]), without the plaintiff having to establish that he or she suffered actual harm. Class plaintiffs are alleging hundreds of millions of dollars in statutory damages against such household names as Urban Outfitters, IKEA, Cost Plus and Toys-R-Us.

Perhaps the key issue to date for these cases is the meaning of "willful violation." In two separate FRCA cases in a different context (Geico v. Edo and Safeco Ins. v. Burr), the U.S. Court of Appeals for the Ninth Circuit ruled as follows:

In sum, if a company knowingly and intentionally performs an act that violates FCRA, either knowing that the action violates the rights of consumers or in reckless disregard of those rights, the company will be liable under 15 U.S.C. § 1681n for willfully violating consumers' rights.

Both of these Ninth Circuit cases were appealed to the USSC, which was asked to rule on whether the Ninth Circuit's interpretation of "willful violation" was valid. The general consensus among commentators was that the Ninth Circuit's interpretation would make it less difficult to collect statutory damages for FACTA credit card receipt violations, and that a narrow interpretation had the potential to cripple these FACTA class action suits for plaintiffs.

U.S. Supreme Court's Ruling on "Willful Violations" Under FACTA

In Geico and Safeco, the class plaintiffs alleged that the insurance company defendants violated the FCRA by failing to provide notice of insurance policy changes based on the plaintiffs' credit scores. The plaintiffs argued that "willful violation" included not only "knowing" violations of FCRA, but also reckless disregard of FCRA statutory duties. Turning to precedent interpreting similar language in other statutes and under common law, the USSC ruled against the insurance companies and concluded that the Ninth Circuit's ruling was correct: one can "willfully violate" FRCA by knowingly violating the statute or acting in reckless disregard of the FCRA obligations.

In short, the USSC adopted a more lenient standard of proof for plaintiffs to establish FCRA obligations. Plaintiffs will still face obstacles in proving recklessness disregard. However, a merchant's claim that it did not know of the FACTA requirements may not serve as a complete bar; plaintiffs will likely be able to present evidence concerning the merchant's efforts to discover its FACTA obligations and whether or not the merchant should have known about the FACTA credit card requirements.

FACTA Class Action Certification Denied

In good news for merchants, in May 2007 the U.S. District Court for the Central District of California rejected a motion to certify a class action in Spikings v. Cost Plus, Inc. The Court focused on whether a class action would be superior to other methods of adjudication as required under Rule 23(b)(3) of the Federal Rules of Civil Procedure. The Court cited other cases ruling that Rule 23(b)(3)'s "superiority requirement" was not met where the defendant's liability "would be enormous and completely out of proportion to any harm suffered by the plaintiff." It also listed other cases that generally denied class certification, including an FCRA case, where the damages would be "absurd" relative to harm suffered.

In this case, the Court noted that if the class was certified the potential statutory penalties ranged from $340 million to $3.4 billion (based on a penalty ranging from $100 to $1000 per violation for 3.4 million class defendants), despite the fact that the lead plaintiff testified that it did not suffer any actual damages. The court noted that the entire Cost Plus organization was worth approximately $316 million and that a judgment on a class action in this case for even the minimum fine would bankrupt it. The Court further noted that Cost Plus began truncating its credit card receipts as soon as it became aware of the technical violation of FACTA, and that it was possible for the class plaintiffs to file individual suits to recover damages. Finally, the court noted that certifying the class opened the potential for abuse by plaintiffs' attorneys in the form solicitation of unnecessary litigation. Based on the foregoing, the Court denied the plaintiffs' motion for class certification.

Conclusion

While the USSC's decision concerning "willful violation" of FACTA may be disappointing for merchants under suit, if the Spikings decision survives appeal the "teeth" associated with these lawsuits may have been extracted. The same logic that applied in the Cost Plus matter could apply to other retailers that face insolvency if they lose a class action suit. Its hard to imagine courts desiring to put some of the top U.S. retail brands out of business when no actual harm has been shown to have occurred. Paradoxically the reason that these suits are being filed in the first place (the large number of plaintiffs and the potential for a large pay-off for plaintiffs' attorneys through class action) is the same reason they may ultimately be unsuccessful. If plaintiffs' lawyers cannot proceed using the class action mechanism it will not likely be cost effective to pursue individual cases.

Nonetheless, it is premature to come to any firm conclusions on the reasoning set forth in the Spikings decision since it will likely be appealed and there also may be other district courts across the country that could rule differently. If Spikings is overruled, the USSC's decision may provide plaintiffs' counsel with significant arguments and settlement leverage. At the bare minimum, until some of these issues are resolved by higher courts, merchant-defendants will have to incur significant legal fees to fight these matters.

InfoSecCompliance will keep you updated concerning any other material developments in this matter.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

"As we know, there are known knowns. There are things we know we know. We also know there are known unknowns. That is to say we know there are some things we do not know. But there are also unknown unknowns, the ones we don't know we don't know."

--Donald Rumsfeld, Feb. 12, 2002

Regardless of what one thinks of Donald Rumsfeld's tenure as Secretary of Defense, these words hold a pearl of wisdom that applies to organizations struggling to comply with privacy and security laws. One of the major difficulties for modern organizations working with private personal information is simply knowing what privacy and security laws apply to their operations. This problem is exacerbated by the fact that, even for smaller- and medium-sized organizations, modern commerce often involves transacting with consumers in multiple legal jurisdictions (e.g. local, State, Federal and international). In short, since privacy and security laws from several jurisdictions may apply, it is highly likely that a lot of "unknown unknowns" exist, which can cause adverse impacts. This month's newsletter explores an instance where unknown unknowns may have come into play in the privacy context, and how organizations can begin to address the problem.

Too Much Information?

FACTA Credit Card Receipt Class Action Suits a Cause for Serious Concern.

In what appears to be a classic case of "unknown unknowns," a rash of over 100 class action lawsuits have been filed in California alleging violation of the Fair and Accurate Transaction Act of 2003 ("FACTA"). Section 15 U.S.C. § 1681c(g) of FACTA limits the information that can be printed on an electronically printed credit card receipt to the last five digits of the credit card number, and specifically prohibits printing a credit card's expiration date on the receipt. Organizations were provided with a three-year grace period to comply with this Federal law (December 4, 2006 was the first date that compliance was required).

A single willful violation of FACTA (which is incorporated into and part of the Fair Credit Reporting Act ["FCRA"]) could result in damages ranging from $100 to $1,000. Plaintiffs are also entitled to actual damages if they can prove a negligent violation of the FACTA. With companies processing millions of credit card transactions each year the damage potential for these lawsuits is staggering.

These class action suits have been filed against companies such as: Urban Outfitters; IKEA; Chanel Inc.; Toys-R-Us Delaware Inc.; Oakley, Inc.; Rite Aid Corp.; Costco Wholesale Inc.; The Walt Disney Parks and Resorts; California Pizza Kitchen Inc.; El Pollo Loco; Levy Restaurants; United Artists Theatre Circuit Inc.; FedEx Kinkos Office and Print Services Inc.; Valero Energy Corp.; and Avis Rent-A-Car Systems Inc. Lawsuits are also spreading outside of California - two lawsuits were filed on March 14, 2007 in the Western District of Pennsylvania.

Thus far, many of the cases have survived motions to dismiss. Defendants have argued that dismissal is warranted because, while section 1681c(g) of FACTA applies to "cardholders," private rights of action are only available to "consumers" under section 1681n of FCRA. This argument was rejected by California courts when raised by Oakley, Inc. and IKEA.

The success of these cases could ultimately hinge on the meaning of "willfully fails to comply" under section 1681n of FCRA. Two 9^th Circuit cases (the Federal Appellate Court for California and other western States) have ruled on the meaning of "willfully." In Geico v. Edo, the court alluded to a "recklessness" standard:

In sum, if a company knowingly and intentionally performs an act that violates FCRA, either knowing that the action violates the rights of consumers or in reckless disregard of those rights, the company will be liable under 15 U.S.C. § 1681n for willfully violating consumers' rights. A company will not have acted in reckless disregard of a consumers' rights if it has diligently and in good faith attempted to fulfill its statutory obligations and to determine the correct legal meaning of the statute and has thereby come to a tenable, albeit erroneous, interpretation of the statute. In contrast, neither a deliberate failure to determine the extent of its obligations nor reliance on creative lawyering that provides indefensible answers will ordinarily be sufficient to avoid a conclusion that a company acted with willful disregard of FCRA's requirement. Reliance on such implausible interpretations may constitute reckless disregard for the law and therefore amount to a willful violation of the law (emphasis added).

This interpretation differs from interpretations in other Federal Appellate Districts, and this issue has now been argued before the U.S. Supreme Court (additional Supreme Court briefs and other information can be found here). If the Supreme Court disagrees with the 9^th Circuit's (and the 3^rd Circuit's) interpretation of "willfully," then these class actions may be difficult for plaintiffs to win (it is doubtful that plaintiffs will be able to establish actual damages to recover for "negligent" failure to comply with FCRA).

Many corporate defendants reported that they were "surprised" by the FACTA credit card receipt requirements despite the three-year grace period to achieve compliance. That seems like a plausible explanation considering that most rational companies, had they known of this requirement, would most likely have chosen to limit the information on their credit card receipts rather than face a potential fine of up to $1000 per violation and expensive attorney fees to defend class action lawsuits. Nonetheless, these companies are now experiencing the risks and expense associated with unknown privacy laws.

What should companies do to address "unknown unknowns" when it comes to privacy laws?

Organizations are not omnipotent - they cannot possibly know all things at all times at all places. However, they can take action to minimize their risk of unknown privacy and security laws, including: (1) designing their privacy programs consistent with Fair Information Practice Principles; (2) acquiring resources to stay on top of privacy and security regulations and case law; and (3) insuring against the unknown.

Fair Information Practice Principles. While the legal requirement to limit credit card receipt data may not be intuitive to all companies, there are certain general activities that rational actors know could get them into trouble when it comes to handling customer information. For example, selling or collecting personal information without notice or consent can obviously be problematic, and as a result there are laws that address those general categories of privacy violations. Addressing general privacy activities and principles can decrease risk even if specific regulatory requirements are unknown.

In fact many, if not most, privacy and security-related laws reflect the principles and framework set forth in the Fair Information Practice Principles ("FIPP"). FIPP includes: notice/awareness, choice/consent, access/participation, security/integrity and enforcement/redress. If FIPP is the goal and the organization strives to meet that goal with due diligence, that organization will likely have reduced its regulatory privacy risks (relative to organizations that do not consider FIPP).

The problem, of course, is that FIPP does not address every single detail of every privacy law. Some organizations that follow FIPP may have missed the specific requirements of FACTA or may not be aware of the specific notices (and fines) required under the CAN-SPAM Act, HIPAA, GLB and other more obscure laws. These class action lawsuits demonstrate how compliance to FIPP can help. Those companies diligently concerned about the security/integrity prong of FIPP, even without knowledge of FACTA's specific legal requirement, may have made an independent determination that truncating credit card numbers on receipts is a good practice to secure credit card information from identity theft. In fact, some organizations likely adopted this practice prior to the FACTA law as the result of due diligence with general privacy principles.

Due Diligence Investigation. Legal violations arising out of privacy or security incidents increasingly threaten organizations in terms of reputation damage, legal fees and damage awards. In fact, more and more companies are dedicating specific resources toward addressing privacy and security legal compliance. The first step is establishing accountability within the organization by creating a manager solely responsible for privacy compliance (a C-level executive with direct reporting to the CEO is a best case), and providing he or she with a budget. The lead privacy compliance officer should hire or work with attorneys to develop a formal process for inventorying the personal information the company handles, tracking the flow of that information across jurisdictions from collection to storage/disposal and determining the laws that apply to the organization.

Companies should attempt to address the lowest hanging fruit first. In certain industries, such as finance and healthcare, comprehensive privacy laws exist such as GLB and HIPAA. If the personal information of European or Canadian companies is at issue, the national privacy law of those countries should be considered.

Determining the applicability of privacy and security laws requires a continuous effort that considers changes in both the organization's internal privacy practices and the law. Those responsible for privacy compliance should engage in frequent and comprehensive communications with business managers whose units collect and handle personal information. Companies should track laws and legislation, and subscribe to privacy and security reporters and websites (feel free to contact me for a list of sources). A person who can make the link between organizational practices and changes in privacy laws, and how those practices laws might impact the organization, should be dedicated to tracking internal practices and privacy laws.

Privacy and Security Liability Insurance - Risk Transfer. Insurance is a very important tool for managing the "unknown unknowns." For companies that operate across multiple jurisdictions, it is virtually impossible to know every law and how every part of an organization is reacting or failing to react to that law. This means that residual risk exists that must either be tolerated by the organization or transferred to a third party.

Privacy and security liability insurance is an excellent tool for decreasing a company's risk load under these circumstances. While the uncertainty inherent in complying with every security or privacy law still exists for insurers, insurers can spread their risk across thousands of organizations. Moreover, even if aggregated events occur, as long as the insurer has a good financial rating, they should be able to absorb the loss. Even insurance companies without the highest financial ratings are typically reinsured by large reinsurers who are able to weather adverse situations.

The ability of insurers to underwrite privacy and security liability risks in a world where such risks are sometimes "unknown" addresses the main problem of modern organizations. Instead of expending huge amounts of resources to achieve an unattainable level of "perfect security," or researching, discovering and analyzing every possible privacy law that applies to them, insurers can take the risk and help their insureds avoids those expenses.

That is not to say that insurers will insure companies with bad privacy practices or poor information security. To be insurable, at a minimum, "reasonable" security and privacy practices must be present (and what is reasonable can vary from insurer to insurer). Nonetheless, most companies that can establish "due diligence," and have practices and policies adhering to FIPP and generally accepted security standards such as ISO 17799, will likely be insurable.

There are two key challenges for companies that want to use insurance as a risk management tool in this context. First is implementing security and privacy practices that meet a level of reasonableness at the lowest price. As long as insurance is available, spending more to achieve "more than reasonable" privacy/security may not be cost-effective. Moreover, large security and privacy overhauls can be disruptive to business. The risk avoided by implementing costly controls can be transferred for the price of an insurance policy which typically costs less than the controls.

Second, and perhaps most important for an organization that wants to manage risk through insurance, is ensuring that the privacy and security insurance policy it chooses actually covers the risks the organization desires to transfer. If it does not, the organization will be left handling the costs of that risk on its own. It takes a concerted effort by risk managers and key business stakeholders to understand not only the potential risks, but also how they might impact the organization if the risk is realized.

On the other side of the equation, since the current crop of security and privacy policies vary in their approach and coverage scope, it is not always easy to get a clear picture of what is covered. Organizations should make sure they have good brokers or insurance consultants who understand the specific risks of their company and the insurance products available to cover such risks. In all, if some time and effort is taken to understand the range of security and privacy insurance options, insurance can be a very cost-effective and efficient tool for dealing with "unknown unknowns."<

Conclusion

While the risks and problems associated with unknown privacy or security regulations may never be fully solved, the awareness of organizations and the skill and talent available to address the problem are probably at their highest. Companies simply need to acknowledge the fact that unknown unknowns exist in the privacy world, and dedicate time and resources toward at least converting them into "known unknowns." Even unaddressed privacy laws are better than unknown laws because at least the organization is aware of some risk and presumably has factored it into their overall risk management scheme. Organizations that are serious about understanding the full scope of their risk need to engage in a due diligence investigation, and need to at least try to adhere to common industry privacy practices and security standards. Companies should also seriously consider transferring their residual risk rather than engaging in potentially never-ending and expensive attempts to "eliminate" their risk. When these steps are taken, organizations can decrease the risk and loss associated with unknown security and privacy laws.

• Email This
• Print
• Comments
• Trackbacks
• Share Link