Source: https://www.hldataprotection.com/2009/09/articles/cybersecurity-data-breaches/draft-federal-legislation-may-bring-changes-to-data-breach-practices/
Timestamp: 2020-06-02 00:47:26
Document Index: 416222710

Matched Legal Cases: ['§ 102', '§ 312', '§ 312', '§ 317', '§ 319', '§ 3', 'CJEU ']

Draft Federal Legislation May Bring Changes to Data Breach Practices | HL Chronicle of Data Protection
Home > Cybersecurity & Data Breaches > Draft Federal Legislation May Bring Changes to Data Breach Practices
Posted on September 28th, 2009 By Mark Paulding Posted in Cybersecurity & Data Breaches
Draft Federal Legislation May Bring Changes to Data Breach Practices
On July 22, 2009, Sen. Patrick Leahy (D-VT) reintroduced S. 1490, the Personal Data Privacy and Security Act (“PDPSA”), which has been referred to the Senate Judiciary Committee. The reintroduced PDPSA is substantially similar to the prior version reported out by the Judiciary Committee in 2007, which was co-sponsored by then-Sen. Barack Obama. Among the provisions of the proposed law are a mandated adoption and maintenance of a comprehensive information security program, a national data breach notification law, and regulation of data broker services. Further, while the bill as currently drafted reflects many commonly accepted principles of data privacy and security underlying existing federal and state laws, it deviates from current laws and standards regarding data security and breach notification on several noteworthy points. Although passage of this legislation during the current session of Congress is far from certain, the existing PDPSA draft may foreshadow future legislative and regulatory trends.
Federal Data Breach Notification Requirement including Federal Criminal Penalties and State
Title III, Subtitle B of the currently drafted PDPSA contains a data breach notification requirement in the event of unauthorized access (or reasonable belief that unauthorized access has occurred) to sensitive personally identifiable information (“SPII”) of any resident of the United States. Notification may be provided in writing, by telephone, or via email (if the affected individual has consented to email notice). In addition to standard provisions for notice to national credit reporting agencies and media outlets, the proposed law requires notification to the U.S. Secret Service within 14 days if the security breach involves:
· the acquisition (or is reasonably believed to involve the acquisition) of the SPII of more than 10,000 individuals by an unauthorized person;
· a database or other system containing the SPII of more than 1,000,000 individuals;
· a database owned by the federal government; or
· the SPII of federal law enforcement or national security personnel.
Criminal Penalties for Concealment of a Security Breach
Under the current draft of PDPSA, knowing concealment of a security breach that results in economic damage to any person would be subject to criminal penalties including fines and imprisonment for up to 5 years. See PDPSA § 102. Notification may be exempted if a written certification that notification would damage national security or hinder a law enforcement investigation is transmitted to, reviewed by, and approved by the Secret Service. While this provision appears to be intended to increase the number of reported breaches, the risk of criminal prosecution depends upon a showing of economic damage to an individual. Historically, courts have found it quite difficult to trace economic harm to a specific data breach. Nevertheless, the specter of criminal sanctions would be impossible to ignore.
Encryption Safe Harbor
The draft legislation contains a safe harbor from the notification requirement if a risk assessment concludes that there is no significant risk of harm to individuals because the compromised data was encrypted or otherwise rendered indecipherable or inaccessible. See PDPSA § 312(b). Safe harbor risk assessments must be provided to the Secret Service within 45 days of discovery. Covered entities may rely upon the risk assessment if the Secret Service has not informed the entity otherwise within 10 days thereafter. This continues the trend of breach notification laws designed to encourage encryption of sensitive information, particularly on backup tapes, laptops, and other portable devices. It should be noted that the proposed law explicitly includes access controls among the list of ways to render SPII inaccessible, which would be a noticeable evolution in breach notification law. Ultimately, it would be left to the discretion of the Secret Service to determine whether any access controls were sufficiently secure to render the risk of public harm insignificant.
Fraud Prevention Program Exemption
The draft PDPSA does not require notification for breaches that involve only credit card numbers or security codes if the covered entity participates in a fraud prevention program designed to block unauthorized transactions before they are charged to an individual’s account. See PDPSA § 312(c). However, if the breach involves any other form of SPII or credit card numbers combined with an individual’s name, entities are still obligated to provide appropriate notice.
Justice Department and State AGs Authorized to Pursue Civil Enforcement Actions
In addition to the criminal penalties discussed above, the United States Department of Justice and state Attorneys General would be authorized to bring civil enforcement actions for violations of the data breach notification rules. See PDPSA §§ 317-318. The draft PDPSA authorizes equitable relief and civil penalties of up to $1,000 per day per affected individual up to a maximum value of $1,000,000 per violation unless the violation is found to be willful or intentional. Similar to the criminal penalties provision, this appears to be intended to increase the number of breaches that are reported to the public, as well as indirectly incentivize covered entities to harden security measures protecting SPII.
Broad Preemption Clause
The provisions of the draft PDPSA expressly preempt all federal and state data breach laws. See PDPSA § 319. If passed into law, this clause would establish one uniform breach notification regime for all entities engaged in interstate commerce, superseding the existing patchwork of state notification laws as well as the federal health data breach notification requirements recently introduced by the HITECH Act.
Expansive Definition of Sensitive Personal Identifiable Information
The draft PDPSA contains a definition of SPII that is more expansive than existing data security and breach notification regimes. SPII includes the following categories of data:
1. A financial account number or credit/debit card number with the associated security code or PIN.
2. A person’s first name and last name or first initial and last name combined with:
a. a non-truncated Social Security Number or government identification number;
b. unique biometric data;
c. unique account identifier, electronic identification number, user name, or routing code combined with any associated security code or password required to obtain money, goods, services, or any other thing of value; or
d. any two of
i. home address or telephone number,
ii. mother’s maiden name, and/or
iii. month, day, and year of birth.
See PDPSA § 3(12). Accordingly, the required data security program and data breach notification procedures would apply to a greater amount of information than current regulatory schemes. For example, a table of user names and passwords maintained by a web merchant may be subject to a covered entity’s information security program and breach notification requirements, which would ordinarily not be the case under current state and federal law. This may be particularly true for merchants that allow customers to use email addresses as their user ID because many email addresses contain the first and last name or first initial and last name of the user. Similarly, web merchants that allow users to select freeform user IDs may find that many customers use their actual names.
Tags: breach, Data, legislation, Patrick Leahy, S. 1490, S. 495
Facial Recognition Challenged by French Administrative Court
EDPB Signals Efforts on International Data Transfers as CJEU Review of Current Tools Draws Near
Brazil Update: Congress Sends Bill Delaying LGPD Sanctions but not Effective Date to President
California Privacy Compliance Obligations May Soon Change Under CPRA Ballot Initiative
Hogan Lovells Launches Global Privacy Guide to Support Businesses with COVID-19 Exit Plans
Archives Select Month May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 February 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 June 2017 May 2017 April 2017 March 2017 February 2017 January 2017 December 2016 November 2016 October 2016 September 2016 August 2016 July 2016 June 2016 May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015 February 2015 January 2015 December 2014 November 2014 October 2014 September 2014 August 2014 July 2014 June 2014 May 2014 April 2014 March 2014 February 2014 January 2014 December 2013 November 2013 October 2013 September 2013 August 2013 July 2013 June 2013 May 2013 April 2013 March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 August 2012 July 2012 June 2012 May 2012 April 2012 March 2012 February 2012 January 2012 December 2011 November 2011 October 2011 September 2011 August 2011 July 2011 June 2011 May 2011 April 2011 March 2011 February 2011 January 2011 December 2010 November 2010 October 2010 September 2010 August 2010 July 2010 June 2010 May 2010 April 2010 March 2010 February 2010 January 2010 December 2009 November 2009 October 2009 September 2009 August 2009
(c) 2020 Hogan Lovells. All rights reserved. “Hogan Lovells” or the “firm” refers to the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses, each of which is a separate legal entity. Attorney advertising. Prior results do not guarantee a similar outcome.
Copyright © 2020, Hogan Lovells US LLP and Hogan Lovells International LLP. All Rights Reserved. Strategy, design, marketing & support by LexBlog