Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

InTheMedia_800x800.jpg

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

US Cybersecurity Standards to Get Tougher and More Specific: FTC and NYDFS Lead the Way

Alert
|
9 min read

World in Transition

Our views on changing dynamics in energy, ESG, finance, globalization and US policy.

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators. Traditionally, cybersecurity compliance that is tied to the protection of personal information generally has required entities to implement "reasonable security," without much guidance on what "reasonable security" means. At the federal level, the Federal Trade Commission ("FTC") has led the charge with enforcing cybersecurity requirements related to consumer privacy based on this "reasonable security" standard. At the state level, a reasonableness standard for the protection of personal data persists as well, although over a decade ago Massachusetts notably required companies to implement a Written Information Security Policy to further protect their citizens' information.1 

Companies may become subject to far more exacting cybersecurity standards when either the underlying personal data is especially sensitive or when critical infrastructure is at risk. At the federal level, examples include a specific "Security Rule" adopted by the US Department of Health and Human Services ("HHS") to safeguard protected health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"),2 and a myriad of demanding requirements that are enforced across the financial and energy sectors.

Meanwhile, at the state level, the most comprehensive cybersecurity requirements have occurred within the context of financial services regulation, and in particular, emanate from the New York Department of Financial Services Cybersecurity ("NYDFS") Requirements for Financial Services Companies ("Cybersecurity Regulation").3 The NYDFS Cybersecurity Regulation was promulgated in 2017, went into effect in early 2018, and established initial compliance deadlines in August of that year. The regulation sets forth specific administrative, technical and physical requirements, which we have explored previously at length.4 The rules require covered banks, insurance companies and other financial services institutions to implement a thorough, 14 point cybersecurity policy and submit an annual certification that confirms their compliance with the rules. Covered entities must also document improvements they may need to make to their cybersecurity programs. These covered entities not only have to consider "relevant risks" to their businesses but also must "keep pace with technological advances."

Financial services companies are holding their breath as NYDFS recently set an October 2020 hearing date for the first enforcement action under the Cybersecurity Regulation. In that matter, a regulated entity allegedly exposed more than 850 million documents, many of which included sensitive, non-public information such as consumer financial records. Only time will tell whether NYDFS is sounding the alarm to covered entities that, despite a two-year enforcement hiatus, the Cybersecurity Regulation is alive and well, and perhaps especially hungry after having been so long in hibernation.

 

FTC Cybersecurity Enforcement Approach

Pursuant to its authority under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has brought nearly 70 enforcement actions against companies for failing to implement reasonable security. Consistent with the FTC's authority to protect consumers, FTC enforcement of data security requirements focuses on the security of consumer information. Until recently, the FTC's standard for "reasonable security" was fairly amorphous. Enforcement actions would often result in consent orders that generally required entities to implement a cybersecurity program that provided little in the form of specific policies, processes and controls.

In 2018, the FTC's approach suffered a heavy defeat when a court rendered one of the FTC's cease and desist orders to be unenforceable because it failed to specify the precise cybersecurity measures that the respondent was required to implement. In the long-running LabMD matter, the FTC alleged that LabMD failed to implement reasonable and appropriate measures to prevent unauthorized access to consumers' personal data stored on its computer systems. As a result, unauthorized individuals (in the form of a security company) were able to access sensitive information including patient names, dates of birth, Social Security numbers and bank account information. According to the FTC, the inadequacy of LabMD's data security program constituted an "unfair act or practice" under the FTC Act.

The 11th Circuit determined that an FTC Consent Order requiring LabMD to implement "a comprehensive information security program reasonably designed to protect the security and confidentiality of the personal consumer information in its possession" was unenforceable. The Court based its determination on the fact that the order did not identify any specific act or practice of LabMD for remediation and required conformance with an "indeterminable standard of reasonableness."

Since the LabMD decision, the FTC has taken steps to reframe its approach to reviewing the "reasonableness" of the data security practices of companies. In its recently released 2019 Privacy and Data Security Update, the FTC notes that it has "strengthened its standard orders in data security cases" and has required companies to "implement a comprehensive security program, obtain robust biennial assessments of the program, and submit annual certifications by a senior officer about the company's compliance with the order." The FTC stated in a recent enforcement action that it has implemented "additional and significant improvements" to its data security orders that identify safeguards to address specific allegations in an FTC complaint, including access controls, vendor management, encryption of sensitive data, and vulnerability and penetration testing. According to the FTC, future orders likely will also address governance issues, requiring the involvement of executive management and use of third-party assessors in evaluating risks.

 

NYDFS Begins Enforcement

On July 22, 2020, NYDFS submitted a Statement of Charges and Notice of Hearing ("SOC") alleging that First American Title Insurance Company ("First American") exposed tens of millions of documents containing sensitive consumer personal information, such as bank account numbers, Social Security numbers and drivers' license images. According to the FTC, the exposure was due to a vulnerability in the company's public-facing website that permitted the URL to be manipulated to view personal information in First American's consumer files. NYDFS alleged that the company was aware of the vulnerability but failed to properly designate the severity of, and to timely remediate, the vulnerability in accordance with its own policies. Specifically, the SOC alleged multiple violations of the Cybersecurity Regulation, including:

  • Failure to perform a risk assessment for data stored or transmitted within its information technology system that was sufficient to inform the design of the cybersecurity program
  • Failure to maintain and implement data governance and classification policies suitable to its business model and associate risks
  • Failure to implement reasonably adequate access control to prevent access to nonpublic information
  • Failure to provide data security training to employees and agents responsible for identifying sensitive data
  • Failure to encrypt sensitive data on the company's information technology system.

Perhaps most significantly, NYDFS alleged egregious failures in the company's remediation efforts after its own cybersecurity experts ultimately identified the underlying issues and encouraged the company to address those issues as soon as possible. Notably, although the NYDFS enforcement action occurred in the context of a vulnerability that exposed a massive amount of data to the public, it does not allege that any harm occurred to any consumers or to the business at large.

In addition to requiring the entity to remedy its violations, the NYDFS is seeking penalties that could prove substantial. NYDFS asserted in the SOC that upwards of 850 million documents may have been improperly exposed. The agency has claimed it can seek penalties of up to $1,000 per violation, noting that "each instance of Nonpublic Information encompassed within the charges constitutes a separate violation." A hearing is scheduled for October 26, 2020, to determine whether any violations have occurred and, if so, the amount of penalties.

 

The Future of US Mandated Cybersecurity

While the NYDFS Cybersecurity Regulation imposes significant administrative, technical and physical compliance obligations on covered entities regarding all non-public information (going well beyond personal data) and the integrity and resilience of the financial networks themselves, the regulation does so with precision and specificity that historically has been lacking under cybersecurity enforcement actions by regulators focused strictly on consumer data. Although burdensome, the detailed requirements under the Cybersecurity Regulation gives entities a clear roadmap of the precise measures, processes and controls necessary for compliance.

At the federal level, and in the wake of LabMD, the FTC appears to be aligning with the NYDFS standard by moving toward more precise rules and clarifying expectations. The FTC continues to do so not only through consent orders, but also in changes to data security guidelines promulgated under other statutes for which the FTC has enforcement authority. For example, in 2019, the FTC proposed amendments to the Safeguards Rule under the Gramm-Leach-Bliley Act to incorporate more "detailed guidance as to what an appropriate information security program entails" for financial institutions.

As more precise cybersecurity requirements arise, including with specific regard to consumers such as under the New York SHIELD Act,5 and enforcement activity increases, organizations should expect that cybersecurity requirements will begin to demand greater alignment with popular or industry-recognized standards. The future of US cybersecurity compliance will necessitate a thorough review of existing processes, and implementation of relevant and appropriate controls, according to prescriptive requirements provided by regulators. Increasing enforcement activity coupled with specific requirements should prompt directors and executive management to prioritize compliance as a first step, and ensure that adequate resources are available that go beyond mere compliance and result in a cybersecurity program that aligns against the company's risk profile as well.

 

1 201 C.M.R. 17.00 et seq.
2 The HIPAA Security Rule is located at 45 CFR Part 160 and Subparts A and C of Part 164.
3 23 NYCRR 500.
Sign and Submit by February 15, 2018: NYDFS Cybersecurity Certification Due Date Nears as Additional Compliance Requirements Close In  (Jan. 24, 2018);  New York cybersecurity regulations may apply globally (March 27, 2018);  NYDFS Cybersecurity Regulations Compliance Guide: Applicability, Exemptions and Penalties (March 9, 2017).
New York Continues State's Charge to Protect Consumers' Personal Information (Aug. 2, 2019).

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2020 White & Case LLP

Top