Cybersecurity: Legal implications and risk management
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Breach of contract
M&A due diligence
Business Continuity Plan
Requests for data
Data Protection Authority Complaints
Group litigation orders
Data Protection Authority
Privacy & data protection
Law Enforcement Involvement
Preservation of Evidence
Legal (internal and external)
Work with forensic investigators to:
Identify and contain breach
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators. Traditionally, cybersecurity compliance that is tied to the protection of personal information generally has required entities to implement "reasonable security," without much guidance on what "reasonable security" means. At the federal level, the Federal Trade Commission ("FTC") has led the charge with enforcing cybersecurity requirements related to consumer privacy based on this "reasonable security" standard. At the state level, a reasonableness standard for the protection of personal data persists as well, although over a decade ago Massachusetts notably required companies to implement a Written Information Security Policy to further protect their citizens' information.1
Companies may become subject to far more exacting cybersecurity standards when either the underlying personal data is especially sensitive or when critical infrastructure is at risk. At the federal level, examples include a specific "Security Rule" adopted by the US Department of Health and Human Services ("HHS") to safeguard protected health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"),2 and a myriad of demanding requirements that are enforced across the financial and energy sectors.
Meanwhile, at the state level, the most comprehensive cybersecurity requirements have occurred within the context of financial services regulation, and in particular, emanate from the New York Department of Financial Services Cybersecurity ("NYDFS") Requirements for Financial Services Companies ("Cybersecurity Regulation").3 The NYDFS Cybersecurity Regulation was promulgated in 2017, went into effect in early 2018, and established initial compliance deadlines in August of that year. The regulation sets forth specific administrative, technical and physical requirements, which we have explored previously at length.4 The rules require covered banks, insurance companies and other financial services institutions to implement a thorough, 14 point cybersecurity policy and submit an annual certification that confirms their compliance with the rules. Covered entities must also document improvements they may need to make to their cybersecurity programs. These covered entities not only have to consider "relevant risks" to their businesses but also must "keep pace with technological advances."
Financial services companies are holding their breath as NYDFS recently set an October 2020 hearing date for the first enforcement action under the Cybersecurity Regulation. In that matter, a regulated entity allegedly exposed more than 850 million documents, many of which included sensitive, non-public information such as consumer financial records. Only time will tell whether NYDFS is sounding the alarm to covered entities that, despite a two-year enforcement hiatus, the Cybersecurity Regulation is alive and well, and perhaps especially hungry after having been so long in hibernation.
FTC Cybersecurity Enforcement Approach
Pursuant to its authority under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has brought nearly 70 enforcement actions against companies for failing to implement reasonable security. Consistent with the FTC's authority to protect consumers, FTC enforcement of data security requirements focuses on the security of consumer information. Until recently, the FTC's standard for "reasonable security" was fairly amorphous. Enforcement actions would often result in consent orders that generally required entities to implement a cybersecurity program that provided little in the form of specific policies, processes and controls.
In 2018, the FTC's approach suffered a heavy defeat when a court rendered one of the FTC's cease and desist orders to be unenforceable because it failed to specify the precise cybersecurity measures that the respondent was required to implement. In the long-running LabMD matter, the FTC alleged that LabMD failed to implement reasonable and appropriate measures to prevent unauthorized access to consumers' personal data stored on its computer systems. As a result, unauthorized individuals (in the form of a security company) were able to access sensitive information including patient names, dates of birth, Social Security numbers and bank account information. According to the FTC, the inadequacy of LabMD's data security program constituted an "unfair act or practice" under the FTC Act.
The 11th Circuit determined that an FTC Consent Order requiring LabMD to implement "a comprehensive information security program reasonably designed to protect the security and confidentiality of the personal consumer information in its possession" was unenforceable. The Court based its determination on the fact that the order did not identify any specific act or practice of LabMD for remediation and required conformance with an "indeterminable standard of reasonableness."
Since the LabMD decision, the FTC has taken steps to reframe its approach to reviewing the "reasonableness" of the data security practices of companies. In its recently released 2019 Privacy and Data Security Update, the FTC notes that it has "strengthened its standard orders in data security cases" and has required companies to "implement a comprehensive security program, obtain robust biennial assessments of the program, and submit annual certifications by a senior officer about the company's compliance with the order." The FTC stated in a recent enforcement action that it has implemented "additional and significant improvements" to its data security orders that identify safeguards to address specific allegations in an FTC complaint, including access controls, vendor management, encryption of sensitive data, and vulnerability and penetration testing. According to the FTC, future orders likely will also address governance issues, requiring the involvement of executive management and use of third-party assessors in evaluating risks.
NYDFS Begins Enforcement
On July 22, 2020, NYDFS submitted a Statement of Charges and Notice of Hearing ("SOC") alleging that First American Title Insurance Company ("First American") exposed tens of millions of documents containing sensitive consumer personal information, such as bank account numbers, Social Security numbers and drivers' license images. According to the FTC, the exposure was due to a vulnerability in the company's public-facing website that permitted the URL to be manipulated to view personal information in First American's consumer files. NYDFS alleged that the company was aware of the vulnerability but failed to properly designate the severity of, and to timely remediate, the vulnerability in accordance with its own policies. Specifically, the SOC alleged multiple violations of the Cybersecurity Regulation, including:
Failure to perform a risk assessment for data stored or transmitted within its information technology system that was sufficient to inform the design of the cybersecurity program
Failure to maintain and implement data governance and classification policies suitable to its business model and associate risks
Failure to implement reasonably adequate access control to prevent access to nonpublic information
Failure to provide data security training to employees and agents responsible for identifying sensitive data
Failure to encrypt sensitive data on the company's information technology system.
Perhaps most significantly, NYDFS alleged egregious failures in the company's remediation efforts after its own cybersecurity experts ultimately identified the underlying issues and encouraged the company to address those issues as soon as possible. Notably, although the NYDFS enforcement action occurred in the context of a vulnerability that exposed a massive amount of data to the public, it does not allege that any harm occurred to any consumers or to the business at large.
In addition to requiring the entity to remedy its violations, the NYDFS is seeking penalties that could prove substantial. NYDFS asserted in the SOC that upwards of 850 million documents may have been improperly exposed. The agency has claimed it can seek penalties of up to $1,000 per violation, noting that "each instance of Nonpublic Information encompassed within the charges constitutes a separate violation." A hearing is scheduled for October 26, 2020, to determine whether any violations have occurred and, if so, the amount of penalties.
The Future of US Mandated Cybersecurity
While the NYDFS Cybersecurity Regulation imposes significant administrative, technical and physical compliance obligations on covered entities regarding all non-public information (going well beyond personal data) and the integrity and resilience of the financial networks themselves, the regulation does so with precision and specificity that historically has been lacking under cybersecurity enforcement actions by regulators focused strictly on consumer data. Although burdensome, the detailed requirements under the Cybersecurity Regulation gives entities a clear roadmap of the precise measures, processes and controls necessary for compliance.
At the federal level, and in the wake of LabMD, the FTC appears to be aligning with the NYDFS standard by moving toward more precise rules and clarifying expectations. The FTC continues to do so not only through consent orders, but also in changes to data security guidelines promulgated under other statutes for which the FTC has enforcement authority. For example, in 2019, the FTC proposed amendments to the Safeguards Rule under the Gramm-Leach-Bliley Act to incorporate more "detailed guidance as to what an appropriate information security program entails" for financial institutions.
As more precise cybersecurity requirements arise, including with specific regard to consumers such as under the New York SHIELD Act,5 and enforcement activity increases, organizations should expect that cybersecurity requirements will begin to demand greater alignment with popular or industry-recognized standards. The future of US cybersecurity compliance will necessitate a thorough review of existing processes, and implementation of relevant and appropriate controls, according to prescriptive requirements provided by regulators. Increasing enforcement activity coupled with specific requirements should prompt directors and executive management to prioritize compliance as a first step, and ensure that adequate resources are available that go beyond mere compliance and result in a cybersecurity program that aligns against the company's risk profile as well.