Amidst the gridlock on Capitol Hill and in State Houses across the country on many policy priorities, there seems to be one issue related to corporate governance that brings both parties together. In response to a tidal wave of security incidents, both policymakers and regulators are passing and debating new rules regulating how companies must respond to a data breach.
Along with managing internal expectations from the rest of the C-suite and board on how a data breach needs to be handled, risk managers now face a continually shifting regulatory landscape. It is essential that risk managers are up to speed on the latest policy developments and understand how they will influence how a company responds to an incident. In a policy white paper released by Experian, we found the following to be some of the most significant trends changing the regulatory landscape.
State Laws and Regulator Expectations
Today, when a data breach occurs, risk management professionals need to take into account 49 different laws and regulations across states, the District of Columbia and Puerto Rico. The nuances between each law require careful review, especially for businesses that operates in multiple locations.
Further complicating matters, many states are actively making updates to their laws:
- Oregon recently signed a law requiring that notification of a data breach be provided to the state attorney general if a company experiences a breach that affects more than 250 consumers.
- Connecticut added a requirement that companies provide credit monitoring for at least 12 months to impacted parties, as well as provide notice of a breach within 90 days of the incident’s discovery.
- Rhode Island now requires consumer notice no later than 45 days after breach discovery and expanded the definition of personal information to include email addresses combined with passwords.
- Illinois is considering legislation that would move the definition of personal information to include marketing data.
State attorneys general are also increasingly scrutinizing how companies respond to a data breach, and are often vocal if they think a company is not taking the proper steps to protect affected constituents. In addition to conducting more official investigations, state attorneys general are leveraging the power of the press to make their point.
Congress Looking to Reach Consensus
The current complexity caused by evolving state laws could soon become a non-issue if Congress is able to pass a comprehensive federal data breach notification bill. Lawmakers have made passing a national federal data breach and data security standard a priority in the current Congressional session. One bill, the Data Security and Breach Notification Act of 2015, has already been passed by the House Energy and Commerce Committee and could make its way to a full vote. In the Senate, there are also a number of competing pieces of data breach legislation being debated that are fighting for support.
This is not the first time Congress has attempted to pass a comprehensive bill.
Several bills were previously introduced and passed by House and Senate committees, but were unable to make it any further in the process due both to lack of support and not being high on the priority list. However, while reaching consensus may not come easy, there is pressure today on federal lawmakers to pass a bill, which is driving more action in the space.
Lending to the cause, President Obama is also a vocal advocate for a national uniform breach notification standard. He explicitly referenced the need for comprehensive legislation during his latest State of the Union Address, and gave a speech to the FTC in January 2015 that outlined his version of a draft data security bill – the Personal Data Notification and Protection Act. In addition to data breach law, recent high profile security incidents also led Obama to encourage Congress to pass legislation that regulates and supports voluntary sharing of cyber threat information between companies and the government. With attention and support from the executive branch on cyber security, it is much more likely we will see progress on the topic from Congress.
Staying Informed and Prepared
The reality is that data breaches pose a risk that will always need to be addressed, and until the U.S. passes comprehensive data breach notification legislation, the responsibility falls to risk managers and relevant colleagues to track policy changes. This is why it is important to enlist outside experts such as legal counsel familiar with the evolving regulatory landscape. Understanding the landscape is not enough, however. Companies must ensure that any new rules or regulatory agency expectations are accounted for and updated in data breach response plans. As a best practice, companies should review plans at least twice a year.
More information on data breach legislation and resources can be found at the Experian Data Breach Resolution website and the Experian Data Breach Resolution blog.