Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

2023

Shaping the future of digital and cybersecurity governance

In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

cybersecurity_square_800x800_4

Prioritizing cybersecurity at the corporate level

In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

digital mesh

Cybersecurity Developments and Legal Issues

The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.

client alert image

Directors face personal liability over cybersecurity failures

In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".

wafer circuit detail

2022

Director liability for cyber breaches: transatlantic warning signs?

Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.  

arrow

2021

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

2020

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

2019

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

Proposal on the Application of the NIS Regulations post-Brexit

Alert
|
5 min read

World in Transition

Our views on changing dynamics in energy, ESG, finance, globalization and US policy.

Organisations offering certain digital services in the United Kingdom (UK) and European Union (EU) should consider the impact of Brexit and their obligations under applicable cybersecurity law.

 

Introduction

The UK Government recently issued a proposal regarding the application of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) to non-UK "digital service providers" (DSPs) once the UK exits from the EU.

DSPs established inside and outside of the UK should understand the impact of the UK Government's proposal and start planning now to ensure compliance post-Brexit.

 

The NIS Regulations

The NIS Regulations implement an EU directive, the Network and Information Systems Directive (EU) 2016/148 (NIS Directive). The aim of the NIS Directive is to create common standards on network and information security across the EU.

The NIS Directive, and the UK's NIS Regulations, are an attempt by lawmakers to address some of the risks posed to individuals and the wider economy that can arise from security incidents affecting key networks and information systems.

The NIS Regulations apply to "operators of essential services" (such as organisations operating in the energy, transport, health, water and digital sectors) and DSPs. The DSP category includes organisations providing one of the following digital services:

  • Online marketplace;
  • Online search engine; and
  • Cloud computing service.

See our previous article on the NIS Regulations for further information on some of the key obligations and the consequences associated with non-compliance.

 

The NIS Regulations post-Brexit

Perhaps unsurprisingly, the UK Government has confirmed that the NIS Regulations will continue to apply in the UK after Brexit.

In practice, unless and until the NIS Regulations are repealed, the essential requirements of the NIS Directive will continue to apply to in-scope organisations in the UK through the application of the NIS Regulations.

 

Obligations of UK-based DSPs post-Brexit

The NIS Directive requires DSPs not established in the EU, but which offer their services within the EU, to designate a representative in an EU Member State where the DSP offers its services.1

Once a representative in the EU has been designated, the DSP is required to comply with the domestic legislation giving effect to the NIS Directive in the EU Member State where its nominated representative is established. The representative is required to act on behalf of the DSP and be the point of contact with the relevant authorities.

Once the UK is no longer a Member State of the EU, the NIS Directive requirement to appoint a representative in the EU will apply to DSPs established in the UK (and which are not established in the EU) and which offer their services within the EU. Such DSPs are then required to designate a representative in an EU Member State where they offer their services.

In practice, this may result in some UK-based DSPs being responsible for complying with the NIS Regulations in the UK, and the domestic legislation giving effect to the NIS Directive of an EU Member State. This could lead to complexities and an increase in resource costs associated with compliance, especially if the EU and the UK regimes develop differently over time. For example, a UK-based DSP impacted by a cybersecurity incident may have to notify and liaise with multiple regulators in the UK and the EU, each with their own notification requirements and expectations.

 

Obligations of DSPs not based in the UK post-Brexit

In its proposal to regulating non-UK based DSPs post-Brexit, the UK Government has outlined its intention to introduce a requirement for DSPs not established in the UK, which offer their services within the UK, to appoint a UK-based representative.

The UK Government intends to implement legislation amending the NIS Regulations to give effect to its proposal, which will become effective on the twentieth day after the UK leaves the EU.

The UK Government's proposal is that the UK-based representative:

  • can be any person (natural or legal) established in the UK, and who is able to act on behalf of the relevant DSP with regard to its obligations under the NIS Regulations;
  • must be designated in writing;
  • must be contactable by the Information Commissioner's Office (which is responsible for regulating DSPs for the purposes of the NIS Regulations) or GCHQ for the purposes of ensuring compliance with the NIS Regulations;
  • is nominated without prejudice to any legal action which could be initiated against the DSP which nominates the representative; and
  • must be nominated within three months of the amendment to the NIS Regulations coming into force, or within three months of the relevant organisation becoming an in-scope DSP.

Similar to UK-based DSPs offering their services within the EU post-Brexit, some DSPs based outside of the UK will be responsible for complying with the NIS Regulations in the UK, and the domestic legislation giving effect to the NIS Directive of an EU Member State. The same issues facing the UK DSPs mentioned above may also be faced by non-UK DSPs.

 

Impact for Business

DSPs established in the UK (and not established in the EU), which offer services within the EU, should establish plans to appoint a representative in the EU post-Brexit. Similarly, DSPs established outside of the UK, which offer services within the UK, should establish plans to appoint a representative within the UK post-Brexit.

DSPs that will be subject to both the NIS Regulations and Member State domestic law giving effect to the NIS Directive should consider implementing procedures to ensure regular monitoring and effective and efficient compliance with each regime.

Failure to comply with the relevant requirements of the NIS Regulations in the UK exposes organisations to enforcement action, including the imposition of fines of up to £17 million.

 

1 Article 18(2) of the NIS Directive

 

 

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP

Top