Antitrust Law Daily Wrap Up, PRIVACY NEWS: New York AG to propose bill requiring companies to take stronger data protection measures, (Jan 15, 2015)

By Dan Selcke, J.D.

New York Attorney General Eric T. Schneiderman plans to propose legislation that would broaden the scope of information companies in New York are responsible for protecting, require stricter technical and physical safeguards for personal information, and create a safe harbor for organizations that voluntarily meet heightened security standards, the Attorney General announced today.

Schneiderman developed the bill in response to a report issued by his office in July 2014. According to that report, the number of data security breaches in New York more than tripled between 2006 and 2013, and cost the state’s public and private sectors upward of $1.37 billion in 2013 alone.

Currently, companies in New York are only required to notify individuals of data breaches if any of their “private information” is compromised. Among other things, Schneiderman’s bill would expand the definition of “private information” to include both the combination of an email address and password and an email address in combination with a security question and answer. The expanded definition would also include medical information, including biometric and health insurance information.

The bill would also require all entities that collect and/or store private information to strengthen the security measures they have in place to protect that information. Those measures would include administrative safeguards, such as training employees concerning how to protect against data breaches; technical safeguards that would identify risks in an organization’s information processing system, respond to attacks, and perform regular monitoring; and physical safeguards that would guard the actual areas where information was stored. If entities showed compliance with these requirements, they would be assumed to have reasonable data security measures in place if an issue regarding a breach of their data ever ended up in court.

To encourage companies to adopt robust security measures on their own, the bill would offer a safe harbor that could eliminate liability for breaches altogether. To qualify, companies would have to categorize all of their information systems based on the level of risk posed by a potential breach, implement and follow a security plan, and receive a certification.

Finally, the bill would encourage companies to share forensic reports with law enforcement agencies by ensuring that disclosure of such reports for the purpose of investigating those responsible for a data breach would not affect any privilege or protection.

“With some of the largest-ever data breaches occurring in just the last year, it’s long past time we updated our data security laws and expanded protections for consumers. We must also remind ourselves that companies can be victims, and that those who take responsible steps to safeguard customer data deserve recognition and protection,” Schneiderman said. “Our new law will be the strongest, most comprehensive in the nation. Let’s act now to make our state a national model for data privacy and security.”

News: ConsumerProtection Privacy NewYorkNews