One of the biggest risks to data security is lack of vendor (third-party) and vendor subcontractor (fourth-party) management. Companies can mitigate ever-increasing vendor data security risk through purchasing appropriate cyber insurance and implementing a vendor risk management program that includes processes for systematically conducting due diligence and contract negotiations.

If primary vendors are not properly assessed, or controls are not placed on subcontractors (i.e., “fourth parties”) that may be used to render primary vendors’ services, numerous unknown parties with varying degrees of security controls can have access to sensitive information without the companies’ knowledge. Companies can contractually address this exposure by requiring pre-approval of fourth parties, imposing security requirements that must be met by fourth parties and/or requiring security reviews of such fourth parties. Vendor and fourth-party risk can also be managed by cyber insurance policies. Continue Reading Cyber Risk: Addressing the Elephant in the Room

The New York State Department of Financial Services (“DFS”) Cybersecurity Regulation (“Regulation”) took effect on March 1, 2017, and applies to those entities operating or required to operate under New York banking, insurance and finance laws (“Covered Entities”). Covered Entities should have been in compliance with portions of the Regulation as of August 28, 2017, for which they certified compliance on February 15, 2018. Continue Reading Be Prepared for the September 3, 2018 Deadline for New York State Department of Financial Services Cybersecurity Regulation Requirements

The SEC’s recent enforcement action and settlement with Altaba (formerly known as Yahoo) over the company’s major data breach provides a suggested roadmap for how companies may want to proactively approach data breach issues. Some major takeaways are: (1) companies should have effective controls in place to assess disclosure obligations; (2) known cyberattacks should, when appropriate, be included in disclosures in public filings; and
(3) if known cyberattacks have a material impact on the business, it requires disclosure. Continue Reading SEC’s Yahoo Enforcement Action and Settlement Provides Further Direction for Companies Following the SEC’s 2018 Cybersecurity Guidance

With Alabama’s recent enactment of the Alabama Data Breach Notification Act of 2018 (“Act”), all 50 states now have their own data breach reporting statutes. Given the complexity of the current U.S. data breach reporting regime, which also includes statutory reporting obligations in jurisdictions like Puerto Rico and the District of Columbia, businesses with customers in more than one state must coordinate with advisors who have experience navigating this patchwork quilt of statutes.

On March 28, 2018, Alabama became the 50th (and final) state to enact a data breach notification law. The Act requires notification where a “good faith and prompt investigation” results in a determination that “sensitive personally identifying information” (“SPII”) of an Alabama resident has been acquired or is reasonably believed to have been acquired by an unauthorized person, “and is reasonably likely to cause substantial harm to the individuals to whom the information relates.”  Continue Reading Now That All U.S. States Have Data Breach Laws, National Breach Reporting Is Even More Complex

Everyone has been to a lot of presentations, read articles and evaluated the General Data Privacy Regulation (“GDPR”) – yet many questions remain.

Many companies continue to struggle with determining whether (1) the GDPR applies to them and, if so, (2) what can be done before the May 25th compliance deadline.

It is not too late to have these questions answered when working with experienced counsel who can navigate the issues at hand. For instance, possession of any European Union (“EU”) resident’s data does not necessary trigger the GDPR. Indeed, making the legal determination regarding the applicability of the GDPR can be completed largely over the phone by discussing key issues and conducting a targeted follow-up investigation. If the GDPR applies, then there are a number of high-impact but manageable tasks that can be accomplished by May 25th. Of course, waiting longer to evaluate these issues only puts businesses at greater risk for the hefty (up to 20 million Euro or 4 percent of annual global revenue, whichever is greater) non-compliance penalties that may be applicable. Continue Reading GDPR – It’s Not Too Late to Work Towards Compliance

Both large and small companies can be overwhelmed by the volume of records that they create both in paper and electronic formats. What does your company do with this mountain of paper and electronic records? How long should your company retain and archive such records when considering the myriad of complex federal record retention requirements, state-specific record retention requirements and other government agency standards? A blanket indefinite retention and storage policy related to all of your company’s paper and electronic records is impractical, costly and not the answer! Continue Reading Protecting Your Business: The Significance of Record Management and Retention Policies

The New York Department of Financial Services (“DFS”) recently issued two additional answers to frequently asked questions related to filing procedures required by the DFS Cybersecurity Regulation (“Regulation”). The new FAQs come in the wake of the Regulation’s first annual Certification of Compliance filing deadline of February 15, 2018. The DFS clarified that individual licensees who are required to file a Certification of Compliance are acting as a “Senior Officer” as defined in the Regulation. The DFS also offered guidance to Covered Entities regarding the use of an “Entity ID” to complete required filings via the DFS’ cybersecurity portal. Continue Reading DFS Answers New FAQs Regarding Filing Procedures Under DFS Cybersecurity Regulation

South Dakota is the latest state to add notice requirements for data breaches, mandating notice within 60 days of the breach. Like many others before it, South Dakota armed the mandate with steep monetary penalties of up to $10,000 per day, per violation.

Alabama — the sole remaining U.S. state without a data breach law — ushered a data breach bill through the state legislature earlier this week. If Governor Kay Ivey signs the bill into law, all 50 states will have data breach legislation on the books.

The Department of Financial Services (“DFS” or “Department”) has issued notices to entities and licensees that it believes have failed to file a Certification of Compliance (“Certification”) pursuant to the Department’s Cybersecurity Regulation (“Regulation”). The Regulation required all DFS-regulated entities and licensed persons to submit a Certification by February 15, 2018 to verify compliance with the portions of the Regulation that were in effect at the end of 2017.

For an overview of the Regulation and its key compliance dates, please refer to the full DFS Regulation Client Alert.

For additional information regarding the DFS Regulation notices, please see our most recent Client Alert.

For additional questions about the recently issued Cybersecurity Regulation notices, please contact Jennifer A. Beckage at (716) 847-7093, jbeckage@phillipslytle.com, or any member of the firm’s Data Security & Privacy Practice Team.

On February 21, 2018, the U.S. Securities and Exchange Commission (“SEC”) issued updated guidance to assist public companies with disclosure obligations under the federal securities laws relating to cybersecurity risks and incidents (“Guidance”). In addition to expanding upon the SEC’s prior guidance on cybersecurity, which focused on the disclosure of cybersecurity risks and incidents, the Guidance addresses two new issues – the implementation of cybersecurity policies and procedures and the examination of insider trading prohibitions in the wake of cybersecurity incidents. For additional information regarding the SEC’s new Guidance, please refer to the full Data Security & Privacy Client Alert. For a chronology summary of upcoming key dates and corresponding obligations under the Regulation, please see our most recent Data Security & Privacy Client Alert.