New York State Passes Legislation Expanding Data Security Prevention and Notification Requirements

On July 25, 2019, New York state passed a substantial expansion of its data security law in the form of two new pieces of legislation: the Identity Theft Prevention and Mitigation Services Act (ITPMS Act) and the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act). The ITPMS Act is less impactful for businesses, but perhaps more useful for consumers. First, it requires credit reporting agencies that experience a breach involving Social Security numbers to give consumers the right to freeze their credit score… Continue Reading

Fedex Becomes Victim of Latest Spat of Large Scale Cyber-Related Securities Class Actions

As if anyone needed yet another reminder of the invasive effect a cybersecurity event can have on a business, we need not to look any further than the  putative securities fraud class action lawsuits filed against global logistics giant FedEx. On June 26, 2019, the first lawsuit against FedEx was filed in the Southern District of New York. The complaint generally alleges that FedEx violated federal securities laws when it made allegedly fraudulent disclosures concerning the extent of the impact caused by the NotPetya malware… Continue Reading

Internet of Things Cybersecurity Improvement Act

On January 1, 2020, California’s “Security of Connected Devices” law (Senate Bill No. 327), which was enacted in 2018, will require companies that manufacture any device that connects “directly or indirectly” to the Internet that is sold in California to incorporate within the device “a reasonable security feature or features.” What constitutes as a “reasonable security feature” is largely undefined, but if the device is capable of authentication outside of a local area network (LAN), then the security will be deemed reasonable if a preprogrammed… Continue Reading

Federal Court Rejects Data Breach Suit Alleging a Breach of a Privacy Policy Involving Major Airline

Even as federal courts become more lenient with affording standing in data breach lawsuits, limits remain to the type of claims courts will permit to proceed. The United States District Court for the Central District of California provided a recent example on June 18, 2019, in dismissing a suit against Delta Air Lines arising from a data breach suffered in 2017 by a vendor for Delta that supports the company’s website by providing chat services and collecting customer data.  In McGarry v. Delta Air Lines, Continue Reading

Walking Back Spokeo: Does the 11th Circuit Make Data Breach Standing Even Easier?

In the context of data-breach litigation, Article III standing has historically been a hurdle for the plaintiffs’ bar. This “standing hurdle” is more than just an oxymoronic phrase.  And after the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), many believed that would be data-breach plaintiffs would find it even more difficult to establish Article III standing.  Under Spokeo, the data breach plaintiffs are required to show an “injury-in-fact” that is “concrete and particularized” and “actual or imminent, not… Continue Reading

Lawyers Still Lag in Information Security Risk Management

The frequency and scope of data breaches are growing every day. Hackers have set their sights on law firms because of the treasure trove of valuable data they hold. News of cyberattacks against the legal community has been splashed across the covers of business publications and warned about by professional organizations for a number of years, so this isn’t anything new. What is astonishing, however, is that law firms are still lagging behind with respect to insurance coverage for cyber risks and the implementation of… Continue Reading

Security Breach Compromises 50 Million Facebook Accounts

In the wake of concerns that the social media giant collects too much personal data, Facebook, Inc. discovered a security breach on September 25, 2018 that affected almost 50 million accounts. Recent privacy regulations, including those recently enacted in the European Union, may have forced Facebook into promptly reporting the breach just three days after it was discovered. Based on the breaking-news reports, the FBI is working with Facebook to investigate the breach to determine the extent of the breach, what information was accessed, whether… Continue Reading

The FTC Gang’s All Here, Part III

As we noted in a previous post, the United States Senate has confirmed five new commissioners, bringing a full complement to the Federal Trade Commission (FTC). Four of those commissioners have taken their seats, with the fifth likely to join in the Fall. Here we will provide the biographies of the last two commissioners (based on seniority).  We have already discussed the other three new commissioners. Commissioner Rebecca Kelly Slaughter – Commissioner Slaughter was sworn in in May 2018. She comes to the… Continue Reading

Health Care Organizations Seek Regulatory Changes To Improve Access To Cybersecurity Tools

Cybersecurity presents thorny problems specific to healthcare organizations. Not only are their protection of personal health information strictly regulated by the HIPAA and HITECH laws, but such organizations are also more frequently the targets of cyberattacks due in part to the highly personal information collected by such organizations, and in part due to the relative lack of resources available to battle cyber-threats. One set of healthcare regulations not directly related to cybersecurity, the Stark anti-kickback law, has potentially hindered healthcare organizations in adapting to an… Continue Reading

Cyber Survey Underscores Perspective of In-House Lawyers

In May, the Association of Corporate Counsel (ACC) Foundation released its “State of Cybersecurity Report: An In-House Perspective,” This report conveys the results of the organization’s far-ranging survey on this topic. In addition to the statistics elicited from 617 in-house lawyers (based in 33 countries), the report also includes many comments from the respondents. This report is full of interesting statistics.  Some of the highlights include:
  • One in three respondents indicated that either their current company or a previous employer had experienced a
Continue Reading