Cybersecurity: Legal implications and risk management
What's inside
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Key issues
Why?
Reputation
Fines
Breach of contract
M&A due diligence
Insurance
Proprietary information
Litigation
Criminal offences
Negligence
Be prepared
Risk Assessment
Key Information
Assets
Key Systems
Threat Analysis
Security Measures
Toolkit
Scripts
Internal and
External
Communications
Employee contacts
Response Plan
Live Training
Business Continuity Plan
Key considerations
Customer/individual rights
Requests for data
Data Protection Authority Complaints
Group litigation orders
Resolution mechanisms
B2B relationships
Contractual obligations
Contractual liability
Tort
Reputationmanagement
Media strategy
Customer interaction
Employee engagement
Commercial
Proprietary
Information/Trade Secrets
System Disruption
Regulatory issues
Data Protection Authority
Financial Regulators
Market authorities
Other regulators
Privacy & data protection
Jurisdictions involved
Reporting obligations
individuals
authorities
Evidence
Law Enforcement Involvement
Legal Privilege
Preservation of Evidence
Response
Crisis Team
Legal (internal and external)
IT/IT Forensics
PR
Regulatory
DPO
Executive committee
HR
Vendor manager
Key Actions
Work with forensic investigators to:
Identify and contain breach
Gather/preserve evidence
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Communications
Regulatory notifications
Articles
2024
Judge Rejects SEC’s Aggressive Approach to Cybersecurity Enforcement
On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.
SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
The SEC’s Charges Against SolarWinds and its Chief Information Security Officer Provide Important Cybersecurity Lessons for Public Companies
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
Shaping the future of digital and cybersecurity governance
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Compensating non-material damages based on Article 82 GDPR
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Cybersecurity Risk: Top 5 strategies to build resilience
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Trending: Legal protection for cryptoasset stakeholders
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
Germany's Federal Constitutional Court holds that the question should be referred to the European Court of Justice
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? The answer to this question is unresolved in Germany, and according to the Federal Constitutional Court ("FCC"), the European Court of Justice ("ECJ") will need to answer it.
The outcome could have major implications for controllers and processors. If a data subject needs not prove any kind of quantifiable, material damages when his or her GDPR rights have been allegedly infringed, controllers and processors face the prospect of compensating countless individuals who need not prove any sort of concrete, cognizable damages before a court. If a controller falls victim to a hacker, for example, then any data subject who shows their data being compromised in some fashion could be entitled to compensation, even if the hack did not cause any damage to the data subject (other than the fact that their data was exposed). Even with small individual compensations, aggregate totals could quickly add up for controllers and processors if they are required to compensate aggrieved data subjects.
Case Background
The case itself stems from an unsolicited commercial email sent by a retailer to its customer who seemingly did not consent to the sending of advertising emails. Plaintiff sought compensation based on Article 82 para. 1 GDPR for non-material damages he suffered by receiving the email. Article 82 para. 1 GDPR provides:
"Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."
Plaintiff left the amount to be compensated to the discretion of the court but requested no less than EUR 500.
The Magistrate Court of Goslar ("Magistrate Court") dismissed Plaintiff's claim, ruling that he was not entitled to compensation under Article 82 GDPR because he failed to show that he suffered any relevant damages from the unsolicited email that met the de minimis threshold of impairment.1 Following an unsuccessful appeal (Anhörungsrüge) to the Magistrate Court, Plaintiff filed a constitutional complaint (Verfassungsbeschwerde), arguing that the decision violated his right to a trial before a legal judge under the German Constitution. Plaintiff argued that the Magistrate Court had wrongly applied its own interpretation of the law rather than referring to the ECJ the question of whether it is necessary to meet a de minimis threshold of impairment to be entitled to compensation of non-material damages under Article 82 GDPR.
The FCC agreed with Plaintiff, ruling that the Magistrate Court was indeed obliged to turn to the ECJ in accordance with Article 267 para. 3 TFEU.2 This obligation exists, the FCC found, whenever a question of EU law arises in a proceeding to be decided by the national court unless (i) the court has determined that the question is not relevant to the decision, (ii) the provision in question has already been interpreted by the ECJ (acte éclairé), or (iii) the correct application of the law is so obvious that there is no room for reasonable doubt (acte clair).
The FCC held that the proceeding clearly raised the question of how to interpret Article 82 para. 1 GDPR, namely, under what circumstances Article 82 para. 1 GDPR entitles monetary compensation for non-material damages. This was particularly true, according to the FCC, given Recital 146 sentence 3 of the GDPR's broad interpretation of the concept of damages.3
Indeed, the FCC pointed out that the Magistrate Court was well aware that this area was not settled law. The Magistrate Court's decision had already recognized that there was a question of whether to apply case law from the Federal Court of Justice (Germany's highest court for civil matters) concerning the availability of monetary compensation for non-material damages, as that case law might be inconsistent with the objectives discussed in Recital 146 sentence 3 of the GDPR. The Magistrate Court, however, side-stepped this issue and claimed that because Plaintiff failed to show he had suffered any relevant damages, no compensation under Article 82 para. 1 GDPR could be awarded, and the claim could be dismissed. The FCC found that the ECJ had not yet weighed in on whether the relevance of the violation impacted the availability of Article 82 damages (thus, it was not an acte éclairé), nor could the Magistrate Court's view be derived directly from the GDPR itself (thus, it was not an acte clair). Given conflicting views on the topic within Germany (discussed further below), the FCC found that the Magistrate Court could not unilaterally reach a decision on the question without depriving Plaintiff of his constitutional rights, and the question would have to be referred to the ECJ for consideration.
Differing views
German courts and legal scholars have offered competing viewpoints on whether Article 82 GDPR entitles a plaintiff to monetary compensation for non-material damages under the GDPR.
On the one hand, compensating for non-material damages is a relatively rare occurrence in German tort law. Typically, a civil court would only award compensation for non-material damages under exceptional circumstances, where a plaintiff's rights have been severely infringed and where, without compensation, a plaintiff would have no real remedy. Violations that only constitute an "individually perceived inconvenience" would not entitle a plaintiff to compensation.4 Though this school of thought agrees that there is a materiality/de minimis threshold, there is some discrepancy on where that threshold actually lies.
On the other side is the view that a loss of control over personal data, on its own, is a sufficient basis to entitle a plaintiff to compensation; the severity of the violation is immaterial. Proponents argue that awarding compensation for non-material damages furthers the effectiveness ("effet utile") of the law by deterring wrongdoing (although deterrence is not generally recognized as a reason for awarding damages under German tort theory), finding it best comports with the broad interpretation of Article 82 GDPR discussed in Recital 146, sentences 3 and 6 (requiring "full and effective compensation"). A number of German labor courts adopt this more "modern" view.5
Conclusion
The FCC referred the matter to the Magistrate Court, which is to hear it once again and is to decide on it, in particular on the referral to the ECJ. If the ECJ adopts the latter view and finds that a plaintiff needs not to meet a de minimis threshold to be entitled to damages under Article 82 para. 1 GDPR, controllers and processers subject to the GDPR may face a somewhat harrowing prospect - the potential for any data subject whose GDPR rights have been violated to be entitled to de facto compensation even in the absence of concrete, material damages. It’s not difficult to imagine damages totals escalating quickly, particularly for companies with millions (or more) of customers or users; any alleged, systemic infringement of a user’s GDPR rights would subject the company to countless individual damages claims, or, where collective redress is available, high (monetary) stakes litigation.
1 Judgment dated September 27, 2019, 28 C 7/19.
2 Order dated January 14, 2021, 1 BvR 2853/19.
3 Recital 146, sentence 3 of the GDPR states: "The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation.". 4 Magistrate Court Hannover, decision of March 9, 2020 – 531 C 10952/19, BeckRS 2019, 43221, Rn. 20; Magistrate Court Diez, decision of November 7, 2018 - 8 C 130/18, BeckRS 2018, 28667, Rn. 6.
5 See, e.g., Labor Court Dresden, decision of August 26, 2020 – 13 Ca 1046/20, BeckRS 2020, 26940; Labor Court Lübeck, decision of June 20, 2019 – 1 Ca 538/19, ZD 2020, 422; Regional Court Darmstadt, decision of May 26, 2020 – 13 O 244/19, ZD 2020, 642; Magistrate Court Pforzheim, decision of March 25, 2020 – 13 C 160/19, BeckRS 2020, 27380; Labor Court Düsseldorf, decision of March 5, 2020 – 9 Ca 6557/18, BeckRS 2020, 11910.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.