Ping Service
Feedback Forms

Will Your Tech E&O Insurance Cover Your Retention of Someone Else’s Electronic Data?

 

The following was written by my good friend Scott Godes. While Scott may be intellectually dishonest, he is an effective advocate and counselor to his policyholder clients. Thanks Scott.

Court Offers Narrow Interpretation of Cyberinsurance.

If you’ve been paying attention to the news or any of your social media channels, you’ve probably heard people talking about cyberinsurance and that your company needs it. You might even have been told that cyberinsurance is a panacea for all risks related to cybersecurity and data privacy. To date, there has been very little publicly available litigation about the meaning of cyberinsurance policies. One federal court changed that with a decision issued on May 11, 2015 in Travelers Property Casualty Co. of America v. Federal Recovery Services, Inc., No. 2:14-cv-170 TS, slip op. (D. Utah May 11, 2015). Unfortunately, the decision ruled against the policyholder and offered a narrow interpretation of the cyberinsurance policy involved in the dispute.

 

Read the rest of this entry »

SCOTUS TO DECIDE STANDING: WILL CYBER BREACH PLAINTIFFS BE TOLD TO TAKE A SEAT?

supreme-court-smallerOn April 27, 2015, the United States Supreme Court granted certiorari on the seminal question of whether a putative class of consumers’ allegations of statutory violations under the Fair Credit Reporting Act (“FCRA”), without concomitant actual injury, are sufficient to withstand a motion to dismiss for lack of standing. Spokeo, Inc. v Robins. In other words, do they have to prove actual injury or is fear of future harm sufficient. The implications for cyber breach plaintiffs could be palpable, as the vast majority of consumers have been unable to demonstrate tangible harm. In such cases, plaintiffs typically allege that they have suffered lost time and angst as the result of their efforts to deal with the theft of their personally identifiable information (“PII”) such as their names, social security numbers, and physical and email addresses.

Spokeo follows the Supreme Court’s decision in Clapper v. Amnesty International USA, where the Court again enumerated the principle that speculative or conceptual injury is insufficient and that plaintiffs must demonstrate “concrete, particularized and actual or imminent” harm in order to establish Article III standing. Since then, lower courts have been split on whether fear of future harm is enough to overcome the Constitution’s standing requirement.

In Spokeo, plaintiffs alleged that Spokeo’s publication of inaccurate information in violation of the FCRA would adversely impact their employment prospects without showing tangible and concrete harm. Rather, they simply claim that their increased risk of harm satisfied the standing requirement.

The predicate for the Spokeo lawsuit parallels that in cyber breach actions, albeit in those cases, plaintiffs oftentimes allege common law claims. Still, it is the rare consumer who incurs expense or suffers actual harm as the result of a cyber intrusion. They simply allege the risk of future harm. Is that enough? The Supreme Court will resolve the split of court authority in the statutory context this term.

 

 

 

 

 

 

PDF Printer    Send article as PDF   

Insurers: Assert Your Subrogation Rights

j0295158The following column was first published in 2012. It is as fresh today as it was then. Its time to take it to heart.

Rick

It is axiomatic to say that insurance products evolve. Indeed, like virtually every organic structure, its development, growth and nimbleness are necessary to meet the progress of maturing, service-based economies. Hence, the advent of cyber/tech/privacy liability (CTP) insurance. At present, there are over 50 markets selling some type of CTP coverage. Many insurers sell standalone products. Others bolt on new coverage parts to their existing products. Still others add endorsements that attempt to extend coverage to address an existing client’s business model. Read the rest of this entry »

A Technology Subrogation Claim. Finally.

neon-insuranceThank you to Travelers Casualty and Surety Company. In Travelers v. Ignition Studio, Inc., No. 1:15-cv-00608 (N.D. Ill.), Travelers brought a subrogation suit against Ignition Studio, Inc., a web design company, for allegedly negligently maintaining a community bank’s website and enabling hackers to steal bank customers’ information.

As discussed on this blog (here), insurers who pay claims have the legal right to initiate and pursue legitimate subrogation claims.  Regrettably, too many are foregoing this right. Travelers is the exception.

In Travelers, filed in January 2015, the insurer accused Ignition of failing to deploy basic anti-malware software on the server where the bank’s website was hosted. A breach occurred and Travelers paid its insured’s claim for resulting Loss. According to Travelers complaint, Ignition’s security applications were inappropriate for a bank website as Ignition did not install key software patches or adequately encrypt customer data.

Read the rest of this entry »

US District Court in Pennsylvania Dismisses Data Breach Class Action on Article III Standing

In Storm & Holt v. Paytime, Inc., 1:14-cv-01138-JEJ (MD Penn. Mar. 13, 2015), the United States District Court for the Middle District of Pennsylvania addressed the Article III standing issue of when a cause of action may exist for a malicious data breach.

The case involved two consolidated putative class actions related to a data security breach of Paytime, Inc.’s systems. Paytime is a national payroll service company. The Plaintiffs were current or former employees of entities that used Paytime as its payroll servicing provider. The Plaintiffs’ employers provided Paytime with the Plaintiffs’ confidential information, including full legal names, addresses, bank account information, Social Security numbers, and dates of birth in furtherance of Paytime’s payroll services to the employers. Unknown third parties then accessed the Paytime systems without authority. Paytime did not become aware of the security breach until twenty-three days following the breach. The Plaintiffs alleged that Paytime delayed an additional thirteen days prior to notifying affected parties of the breach. Playtime later confirmed that the data breach occurred and that the unknown third parties had gained access to the confidential information.

Read the rest of this entry »

US District Court in Texas Finds Plaintiffs Lack Article III Standing in PHI Breach

Hackers-Responsible-for-Massive-HIPAA-Security-BreachBeverly Peters v. St. Joseph Services Corporation d/b/a St. Joseph Health Care System was a class action that arose out of a data breach of the defendant-health care service provider. It was alleged in the action that malicious hackers obtained PHI of Plaintiff, Beverly Peters, and 405,000 other patients and employees of St. Joseph’s. St. Joseph’s response to the breach included notification and an offer of one year of free credit monitoring and identity theft protection.

Plaintiff sought damages under the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. (“FCRA”) as well as state and common law causes of action sounding in tort and in contract. St. Joseph’s filed a motion seeking to dismiss the claim under FCRA based upon lack of standing or, in the alternative, for failure to state a claim.

The issue, as framed by the Court, was “whether the heightened risk of future identity theft/fraud posed by a data security breach confers Article III standing on persons whose information may have been accessed.” The Court found that Plaintiff did not allege a cognizable injury under Article III of the Constitution and therefore lacked requisite standing to bring the action.

Read the rest of this entry »

Gaps in Security The Increasing Need for Cyber Coverage

The following article was written by Brian Bassett and Guy Hollingsworth.  Brian is a Partner with Traub Lieberman Straus & Shrewsberry, LLP. Guy is a Claims Manager with AmTrust North America. Thanks guys!

Rick

We live in an increasingly digital world. The past several years have seen the growing popularity of social networking websites, the proliferation of Internet-based storage on the Cloud, and an overwhelming number of Apps for everything from shopping and banking to transacting business. As a result, personal and financial data is being gathered and stored electronically by businesses we trust. Businesses are becoming more savvy about how to utilize private information to target and attract customers, but the retention of that information may come at a price. By capturing this information, businesses have become targets for nefarious groups and illicit acts.

In many ways, the insurance industry has adapted to these new and changing risks facing businesses by bridging the gap between traditional insurance policies and the evolution of standalone cyber coverage. However, significant challenges to mitigating cyber risk are still present. Despite the availability of cyber coverage, only 26 percent of companies have purchased it according to the Ponemon Institute. Further, cyber policies remain largely untested by courts. Without a cyber policy in place, a business may find itself drowning in costs and damages resulting from a data breach.

Read the rest of this entry »

California Prosecutors Settle PHI Breach with Retailer

Beginning in 2012, California environmental regulators and others began investigating the grocery store chain Safeway relating to the company’s waste disposal practices. During the investigation, certain documents listing medical and personal information on dozens of pharmacy patients were found among the waste.

In allegations set forth against Safeway by a coalition of 43 California district attorneys and two city attorneys, Safeway was formally accused of improperly disposing of confidential pharmacy records containing private medical information over a period of years in violation of California’s Confidentiality of Medical Information Act. In December 2014, Safeway agreed to a $9.87 million penalty as part of a settlement with California prosecutors related to the claims.

Read the rest of this entry »

New Jersey Imposes New Encryption Standards for PHI

New Jersey recently amended its privacy laws to now require health insurers and care providers that do business in the state to encrypt PHI.

The new requirements apply to insurers authorized to issue New Jersey health benefit plans. Such insurers are prohibited from collecting both personally identifiable information and PHI (including a patient’s name linked with a corresponding Social Security number, driver’s license or other state identification number, address, and other identifiable health information) unless the data is “secured by encryption or by any other method or technology rendering the information unreadable, undecipherable, or otherwise unusable by an unauthorized person.”

The new law requires enhanced security measures including complex passwords and further mandates that health insurance carriers implement safeguards that render PHI “unreadable, undecipherable, or otherwise unusable by someone who can bypass the password protection”. The New Jersey law applies to all end-user computers, desktops, laptops, and all data and information transmitted over public networks.

Read the rest of this entry »

Illinois Court Holds No E&O Coverage for Underlying TCPA Violation

In Margulis v. BCS Ins. Co., 2014 Ill. App. LEXIS 826 (Ill. App. Ct. 1st Dist. 2014), the Appellate Court of Illinois, First District, had occasion to consider whether an insurer has a duty to defend an insurance agent under a professional liability policy against a claim alleging the insured sent unsolicited, automated telephone calls advertising its services to non-clients.

Scott Margulis and other similarly situated individuals brought a class action petition in Missouri state court against Bradford & Associates (“Bradford”), an insurance agent, alleging common law and Telephone Consumer Protection Act (TCPA) violations. Plaintiffs, non-clients of Bradford, allege Bradford transmitted unsolicited, automated telephone calls advertising its services to them.

Bradford tendered the suit to its professional liability carrier, Defendant BCS Insurance Company (“BCS”). The insuring agreement of the BCS policy provided, in part, that BCS would pay, on behalf of Bradford, “damages caused by any negligent act, error or omission by the Insured arising out of the conduct of the business of the Insured in rendering services for others as a licensed [agent or broker].” BCS denied coverage for the suit, asserting that the solicitation of business by advertising and marketing directed to members of the general public with whom one has no established business relationship does not involve the provision of services for others as licensed life, accident and health insurance agent.

Read the rest of this entry »

U.S. District Court in Minnesota Denies Target’s Motion to Dismiss Data Breach Lawsuit

2000px-Target_logo.svg
On December 2, 2014, the U.S. District Court for the District of Minnesota denied Target’s motion to dismiss the claims of a group of five payment-card-issuing banks, credit unions, and savings associations (the “Banks”) that assert in the law suit that Target was negligent in not preventing the widely publicized data breach at Target stores in late 2013.

Plaintiffs in this matter are a putative class of issuer banks whose customers’ data was stolen in the Target data breach. Plaintiffs’ Complaint consists of four claims sounding in negligence, violation Minnesota’s Plastic Security Card Act, negligence per se, and negligent misrepresentation by omission. Target moved to dismiss all claims arguing that Plaintiffs failed to plead sufficient facts to establish any of their claims.

With respect to Plaintiffs’ negligence claim, the Court found Plaintiffs had sufficiently plead that Target’s own conduct in failing to maintain appropriate data security measures and in turning off some of the features of its security measures, created a foreseeable risk of the harm that occurred, and Plaintiffs were the foreseeable victims of that harm. According to the Court, although Plaintiffs’ damages were directly caused by the third-party hackers’ malice, Plaintiffs sufficiently plead in their complaint that Target played a key role in allowing the harm to occur.

Read the rest of this entry »

Snapchat Data Breach – A Case Study

In early October 2014, the popular mobile messaging and social media app Snapchat suffered a very high profile leak of approximately 100,000 to 200,000 user images sourced from the database of a Snapchat third-party client, SnapSaved. Snapchat is a mobile messaging service that promises users the ability to send private messages and media to other users that are immediately deleted from the users’ phones and Snapchat’s database after viewing. The October data breach very publicly challenged the company’s promise of privacy and raised important concerns for the responsibility of both the company as well as the end-users of the application to protect data and provide adequate security.

SnapSaved was one of many “unauthorized” third-party applications that reverse engineered Snapchat’s application programming interface (API) to allow SnapSaved users to physically store images and media sent via Snapchat on SnapSaved’s website and database. In a post on its Facebook page, SnapSaved’s developer elaborated on the hack, stating it resulted from a misconfiguration in its Apache server. This post came in response to rumors and accusations that SnapSaved was purposely created by hackers to access stored Snapchat media and that SnapSaved allowed hackers access to its database. The SnapSaved website now offers users the ability to search whether or not any of their “snaps” were leaked.

Read the rest of this entry »

NIST Framework as Basis for Standard of Care for Cyber Security

When the National Institute of Standards and Technology (“NIST”) released its Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (the “Framework”), (a priority program for the federal Department of Homeland Security), the National Protection and Programs Directorate (“NPPD”) became the working session between the government and the private insurance industry to discuss the impact of the NIST Framework on the cyber-insurance marketplace.

The Framework, released in February 2014, originally drafted to focus on critical infrastructure enterprises, (utilities, data centers, etc.) is also designed to provide other private organizations that maintain protected data (in any electronic form) a roadmap for effectively and methodically creating and improving their cyber-security.

Read the rest of this entry »

Cyber Security Indeed: Derivative Action Dismissed Where Board Proactively Addressed Cyber Risks and Exposures

In the first of what is certain to become a cottage industry of derivative lawsuits involving alleged inadequate cybersecurity and deficient public disclosures, on October 20, 2014, a New Jersey federal court granted a motion to dismiss filed by Wyndham Worldwide Corporation’s directors and officers based on its finding that Wyndham’s Board has duly considered and dismissed the plaintiff’s demand that the company sue its directors and officers.  Palkon v. Holmes, et al, Case 2:14-cv-01234-SRC-CLW.

In Palkon, plaintiff presented the demand following a series of three security breaches through which hackers obtained personal information of over 600,000 Wyndham customers. (This is the same series of events that gave rise to the well-known lawsuit where Wyndham is challenging the FTC’s jurisdiction).

Read the rest of this entry »

Cyber Insurance Primer – An Overview of Coverages

width=

The most common form of third party-liability protection in the typical cyber insurance policy arises in the form of “privacy” or “network security” liability coverage. “Privacy liability” affords coverage to the policyholder for any alleged liability for errors, negligence, or breach of duty to a third-party regarding the maintenance/ storage of protected personal (private) information – data often subject to privacy regulations at both the state and federal level. Importantly, this coverage really has nothing to do with computers and potentially applies to any kind of data breach. “Network security liability” coverage protects the policyholder from failure to protect against unauthorized access (and other cyber risks) to the insured’s own computer systems in general.

The third party data-breach claims are the rather high-profile cases that make the mainstream new media. These include cyber-occurrences covered by this blog including the Sony Playstation Network, Target, or Wyndham Hotel network breaches. These occurrences have led to third-party lawsuits against these entities for failure to protect their customers’ data. Standard commercial general liability or professional liability insurance policies often do not cover these types of claims and many carriers are now expressly excluding data breach / cyber events from coverage.

Read the rest of this entry »

ALJ Denies LabMD’s Motion for Sanctions Against the FTC

Although the litigation between LabMD and the Federal Trade Commission (FTC) continues in the Eleventh Circuit, an administrative law judge has resolved one battle between the two entities. Chief Administrative Law Judge D. Michael Chappell recently issued an order denying LabMD’s motion for sanctions against the FTC.

In 2009, information security firm Tiversa, Inc. notified the FTC that a file containing the personal information of over 9,300 LabMD customers (the “1718 file”) was available in a LimeWire sharing folder installed on a LabMD computer. The file was allegedly found on several LabMD IP addresses. LabMD alleged that Tiversa stole the file from a LabMD workstation in Atlanta, Georgia, and further claimed that the FTC never independently investigated the alleged theft or verified the origin or chain of custody for the 1718 file before commencing its action against LabMD.

Moreover, LabMD alleged an improper relationship between the FTC and Tiversa in that Tiversa benefitted financially from referring companies to the FTC for investigation. Specifically, LabMD alleged that many targets of FTC enforcement actions later became Tiversa clients. Accordingly, LabMD sought an order dismissing the FTC action with prejudice and awarding it attorney fees and costs.

Read the rest of this entry »

Congress Proposes Bill Protecting Student Data

While the protection of private data contained within student records is not a new concern, advances in technology and the accompanying headlines of data breach have caused Congress to reconsider the issue. The Family Educational Rights and Privacy Act (FERPA) currently protects against the unauthorized disclosure of personally identifiable information (PII) contained within student records. PII includes direct identifying information, such as a student’s name, as well as indirect identifying information, such as date or place of birth.

The role computers and networks play in the operation of schools is profound. Like many industries, the issue of data storage for schools is a significant aspect of the information technology infrastructure. Increasingly, schools (mostly public enterprises) migrate and store data in the Cloud, thus placing PII in the hands of third party (mostly private) business associates. Schools also rely on on-line text books, on-line web applications, and software as a service. Much of this did not exist when President Ford signed FERPA into law in 1974. One survey showed only 25 percent of districts notify parents that its students’ data interfaces with the Cloud.

Read the rest of this entry »

P.F. Chang’s CGL Insurer Seeks Declaratory Judgement on Data Breach Claim

P.F. Chang’s China Bistro made headlines when it recently reported that 33 of its restaurant locations spanning 18 states suffered a data breach in connection with the restaurant’s point-of-sale payment systems. While the breach was reported in the news media in June of this year, the unlawful access to its systems may have begun months prior to its discovery.

Two putative class action lawsuits were filed in the Northern District of Illinois and a third was filed in the Western District of Washington. These suits allege that personal information of as many as seven million customers may have been stolen as part of the breach.

On notice of these three putative class actions, on October 10, 2014, Travelers Indemnity Company filed a four-count declaratory judgment action in the District Court of Connecticut seeking a declaration that two commercial general liability (CGL) policies issued to P.F. Chang’s in 2013 and 2014 do not afford coverage for the data breach litigation.

Read the rest of this entry »

California District Court Finds Threat of Future Harm Sufficient to Confer Article III Standing in Data Breach Action

In a departure from the mounting body of case law finding that the “increased risk of future harm” is insufficient to confer Article III standing on victims of a data breach, the U.S. District Court for the Northern District of California recently found that such potential future harm is sufficient to allow a putative class of plaintiffs to proceed in Federal Court.

In re Adobe Sys. Privacy Litig., 2014 U.S. Dist. LEXIS 124126 (N.D. Cal. Sept. 4, 2014), involves various claims against Defendant Adobe Systems, Inc. (“Adobe”) arising out of an intrusion into Adobe’s computer network in 2013 and the resulting data breach. According to Plaintiffs, in July 2013, hackers gained unauthorized access to Adobe’s servers and spent several weeks inside Adobe’s network without being detected. Once the breach was eventually detected, Adobe announced that the hackers accessed the personal information of at least 38 million customers, including names, login IDs, passwords, credit and debit card numbers, expiration dates, and mailing and e-mail addresses. Adobe subsequently disclosed that the hackers were able to use Adobe’s systems to decrypt customers’ credit card numbers, which had been stored in an encrypted form.

Read the rest of this entry »

Ilinois Federal Court Grants Neiman Marcus’ Motion

Standing-Icon-269431Once again, a court finds that data breach plaintiffs do not have the requisite Article III constitutional standing to pursue civil action against a retailer – itself the victim of a cyber attack. Last month, the United States District Court for the Northern District of Illinois, Eastern Division granted high-end retailer Neiman Marcus’ 12(b)(6) motion to dismiss a law suit arising out of a data breach the company suffered in 2013.

In Remijas v. Neiman Marcus Group, LLC, 2014 U.S. Dist. LEXIS 129574 (N.D. Ill. Sept. 16, 2014), Plaintiffs brought an action against Neiman Marcus for negligence, breach of implied contract, unjust enrichment, unfair and deceptive business practices, invasion of privacy, and violations of several state data breach acts.

In 2013, hackers breached Neiman Marcus’ computer network, resulting in the potential disclosure of 350,000 customers’ payment card data and personally identifiable information. Of the payment cards that may have been affected, it appeared that about 9,200 were subsequently used fraudulently elsewhere. Plaintiffs were among the 350,000 customers and alleged that Neiman Marcus failed to adequately protect customer data from breach, and failed to provide timely notice of the breach after it occurred.

Read the rest of this entry »

California Amends Data Breach Law

On September 30, 2014, California joined the trend and enacted amendments to its data security laws.

First, the new law expands its scope to third-party service providers and businesses that do not just “own or license personal information,” but merely “maintain” that data. Previously, the California statute mandating businesses to “implement and maintain reasonable security procedures and practices” only applied to businesses that “own or license personal information.”

Read the rest of this entry »

Congress Proposes Bill Protecting Student Data

While the protection of private data contained within student records is not a new concern, advances in technology and the accompanying headlines of data breach have caused Congress to reconsider the issue.

The Family Educational Rights and Privacy Act (FERPA) currently protects against the unauthorized disclosure of personally identifiable information (PII) contained within student records. PII includes direct identifying information, such as a student’s name, as well as indirect identifying information, such as date or place of birth.

The role computers and networks play in the operation of schools is profound. Like many industries, the issue of data storage for schools is a significant aspect of the information technology infrastructure. Increasingly, schools (mostly public enterprises) migrate and store data in the Cloud, thus placing PII in the hands of third party (mostly private) business associates. Schools also rely on on-line text books, on-line web applications, and software as a service. Much of this did not exist when President Ford signed FERPA into law in 1974. One survey showed only 25 percent of districts notify parents that its students’ data interfaces with the Cloud.

Read the rest of this entry »

Tangible Property Coverage: The Next Frontier in the Tech Insurance Market

In the beginning

The emergence of the Internet as a business platform at the end of the nineties also announced the arrival of new risks to organizations. In those early days, there was a widely held belief that the primary concern was In the beginning.

The emergence of the Internet as a business platform at the end of the nineties also announced the arrival of new risks to organizations. In those early days, there was a widely held belief that the primary concern was operational, amidst concerns about the impact of a computer virus or the actions of a “Hacker”, a new term to many of us then.

Despite the lack of actuarial data, a few underwriters in the US and London started to devise solutions to indemnify business interruption losses and the costs to restore compromised data. Commonly known as “Hacker Insurance”, we found few buyers beyond large US banks. Clients found the underwriting process both intrusive and expensive as insurers demanded onsite security audits.

On July 1st 2003 everything changed.

Read the rest of this entry »

Cyber at Lloyds: Catching the cyber horse in motion

The following article was written by my good friend Tony Ellwood. Tony is senior executive, underwriting, at Lloyd’s Market Association and a thought leader. We are grateful to Tony for allowing us to republish his article, which first appeared in the July 16th edition of Insurance Day.

Rick

LondonThe question of whether a running horse has all four hooves in the air simultaneously was one that perplexed generations. No matter just how closely a horse was observed, the motion of its legs was simply too rapid for the human eye to register accurately. It was not until the advent of photography and an experiment by Eadweard Muybridge in 1878 that the question was answered. He developed a camera that was triggered by wires attached to a horse’s legs allowing him to shoot 24 photographs as the horse ran past, which proved beyond a shadow of doubt that a horse does indeed lose contact completely with the ground in mid-gait.

There are many parallels between Muybridge’s study of the running horse and a new survey the Lloyd’s Market Association (LMA) has launched to understand the full extent of cyber risk being underwritten in the Lloyd’s market. The similarity is the sheer pace with which cyber liability has grown from its beginnings in the mid-1990s to current global premiums in the order of £1.5bn, and still rising sharply. The speed of that growth, combined with the rate at which cyber has evolved as a product, make it a particularly tricky line to pin down. What’s more, the question that has been formulating in the LMA’s collective mind is how much cyber liability is being written at Lloyd’s within other classes of business such as marine or aviation. This survey is the first attempt to comprehensively map that business.

Read the rest of this entry »

CA Court of Appeal: CMIA Is Not All-Inclusive

customLogo.gifIn its recent decision in Eisenhower Medical Center v. Superior Court, 226 Cal. App. 4th 430 (Cal. App. 4th Dist. 2014), the Court of Appeal of California, Fourth District, had occasion to consider whether a medical facility’s disclosure of information concerning a patient that does not contain the medical treatment or history of the patient violates California’s Confidentiality of Medical Information Act (“CMIA”) (Cal. Civ. Code § 1798.82), which requires notification to consumers when security systems are breached.

On March 11, 2011, a computer was stolen from Eisenhower Medical Center (“EMC”) that contained an index of over 500,000 persons to whom EMC had assigned a clerical record number.  The records dated back to the 1980’s.  The information on the index was limited to each person’s name, medical record number, age, date of birth, and the last four digits of the person’s Social Security number.  EMC subsequently advised the patients of the theft, and a number of those individuals filed suit.  The suit was styled as a putative class action and sought nominal damages of $1,000 for EMC’s alleged violations of the CMIA.  The plaintiffs also included a cause of action for violation of the Consumer Records Act (“CRA”).

Read the rest of this entry »

Court Certifies Interlocutory Appeal for the FTC v. Wyndham Matter

TRAUB LIEBERMAN STRAUS & SHREWSBERRY LLP’s Cyber Law Blog previously discussed various aspects of the Federal Trade Commission (“FTC”) action filed against Wyndham Worldwide Corp. (“Wyndham”) under Section 5 of the FTC Act, which prohibits “unfair and deceptive acts or practices.” Recent developments in the FTC action carry implications for cyber liability and how companies handle cyber security and data breaches.

On April 7, 2014, US District Judge Esther Salas denied Wyndham’s motion to dismiss directly challenging the FTC’s authority to regulate cyber security practices. Wyndham’s motion asserted that Congress had not delegated such authority to the FTC under its Section 5 powers, and even if it did, the FTC failed to publish rules or regulations providing companies fair notice of the protections expected and “legal standards” to be enforced by the FTC.

At the time, Judge Salas unequivocally ruled in favor of the FTC’s authority. However, on June 23, 2014, the Court granted Wyndham’s application and certified the matter for an immediate interlocutory appeal to the Third Circuit Court of Appeals.

The appeal involves two questions of law: (1) whether the FTC can bring an unfairness claim involving data security under Section 5 of the FTC Act and (2) whether the FTC must formally promulgate regulations before bringing its unfairness claim under Section 5 of the FTC Act.

Interlocutory appeals are rarely granted, are in the complete discretion of the trial court, and must meet certain requirements under 28 U.S.C. § 1292(b), including whether there is a substantial ground for difference of opinion on the matter. While Judge Salas’s denial of Wyndham’s motion to dismiss was certain as to the FTC’s Section 5 authority and the issue of fair notice, the Order certifying the matter for interlocutory appeal on the other hand, acknowledged Wyndham’s “statutory authority and fair-notice challenges confront this Court with novel, complex statutory interpretation issues that give rise to a substantial ground for difference of opinion.”

The Court further acknowledged that it was dealing with an issue of first impression with “nationwide significance… which indisputably affects consumers and businesses in a climate where we collectively struggle to maintain privacy while enjoying the benefits of the digital age.”
As a result, the Third Circuit will be the first major appellate court to weigh in on the issue of whether the FTC has authority to regulate cyber security practices, and if so whether those regulations require specific legal standards and fair notice to those within the scope of FTC’s enforcement.

– See more at: http://www.traublieberman.com/cyber-law/2014/0710/4801/#sthash.hgIolyzW.dpuf

PDF Creator    Send article as PDF   

Best Practices: Protecting Your Firm From The HIPAA Omnibus Rule

The following article was written by my friend Charlie E. Bernier, Esquire of ECBM, L.P. in Conshohocken, PA. Charlie serves as the Principal Consultant in ECBM’s Lawyers Professional Liability Division. Thanks Charlie.

Rick

hipaa2On September 23, 2013 the Department of Health and Human Services (HHS) began enforcing HIPAA Privacy, Security, Beach Notification, and Enforcement rules under the authority of the Omnibus Final Rule. Though the legislation had been in existence since 1996, it was officially expanded to include law firms and firm subcontractors that handle Protected Health Information (PHI) on behalf of their clients who are regulated by HIPAA. The Omnibus Final Rule now requires that these firms and any subcontractor they do business with comply with the Security Rule, Significant Provisions of the Privacy Rule, and the Breach Notification rule.

HHS is now authorized to (1) audit law firms (2) subject law firms to compliance reviews (3) impose civil monetary penalties for violations and (4) make referrals to the Department of Justice for criminal prosecution.

As a practicing attorney and risk management specialist, I know how inconvenient and costly complying with bureaucratic privacy laws can be. Neglecting to address these laws, however, could potentially cost your firm millions of dollars. The omnibus final rule imposes penalties and fines up to $1.5 million per violation, not including defense and indemnity costs. A security breach that exposes multiple patient records could be financially devastating, which is why thoroughly knowing the law and how to protect your firm is paramount to hedging against potential catastrophic losses.

Read the rest of this entry »

Cyber Liability Insurance: The Value of an Educated Broker in the Age of E-Commerce

I first published this article in 2010. Surprisingly, its as relevant today – perhaps even more relevant – than it was four years ago.

Rick

Introduction: Insurance Products for Cyber Risks

Media reports of cyber intrusions, data thefts and computer system malfunctions involving large, high-profile companies such as Sony PlayStation, Citigroup and Lockheed’s Security Vendor, RSA, have led a rapidly growing number of companies to consider the necessity of insurance coverage for technology and cyber privacy risks. As these businesses become more reliant on electronic communication and data storage, they are also developing a heightened awareness that an unauthorized intrusion could endanger their tangible and intangible assets (including their intellectual property) and, in many cases, their reputations and abilities to conduct business. Consequently, prospective policyholders are becoming more cognizant of the necessity for insurance covering these exposures.

Read the rest of this entry »

The Insurance Industry and ICANN: The Next Frontier

icann-flagsWe all take the Internet for granted.  Short of a power outage taking down phone lines, cell towers and satellite transmissions, the Internet will always be there. Like death and taxes, you can count on it.

Not that the paradigm will change any time soon, but at some point, it might.

On March 14 and 17, 2014, the Wall Street Journal reported on the decision by the National Telecommunications and Information Administration (“NTIA”), part of the Commerce Department, to cede control of the Internet from the Internet Corporation for Assigned Names and Numbers (“ICANN”) (a U.S. non-profit) to an organization of multinational stakeholders.

As readers of Cyberinquirer, know, ICANN is responsible for managing the core of the Internet by distributing domain names and Web addresses.  It’s been doing so since 1998.

Read the rest of this entry »

The Dos and Don’ts of Navigating The Cloud: A Business Guide For Cloud Computing

Cloud computing is the storage of data on remote computer servers and the sharing and transmittal of such information by way of the internet. Use of the cloud enables both businesses and casual users to maintain as much or as little electronic data as they wish on a third party’s mainframes without the need for or the expense of having to buy and maintain their own hardware systems.

The cloud’s economic benefits are clear. Still, clouds can be a legal minefield for companies and their counsel. Data breaches, hosting of illegal content and inaccessibility of critical business information are just a few examples of turbulent situations cloud users can face.

Given the risks and potential rewards of the cloud, consider the following guide before entering into a cloud provider contract:

Read the rest of this entry »

New York Court to Sony: No Personal Injury Coverage for You!

As many of us have been saying since the advent of cyber insurance coverage, cyber policies potentially cover privacy risks and exposures, not Commercial General Liability policies, be it under a property damage or a personal/advertising injury insuring agreement.  In other words, policyholders and their brokers would be mistaken if they deluded themselves into thinking that a standard base CGL policy’s personal injury/advertising injury coverage applies to a typical cyber breach where personally identifiable information is extracted.  Sadly, my good friend Scott Godes falls into this category.

On February 21, 2014, , Judge Jeffrey K. Oing, of the New York Supreme Court, Manhattan Commercial Division ratified this maxim by denying personal injury coverage to Sony for the 2011 breach and theft of personal information from its PS3 gaming platform, among other databases.  Zurich American Insurance Company v. Sony Corporation of America, Index No. 651982/2011 (N.Y. Supreme, filed 7/20/2011). See Complaint here.

Read the rest of this entry »

Cyber class-action litigation: Insurers’ next significant spend?

The following article was first published by my friends at Advisen for their new Cyber Risk Network. For those who haven’t already done so, check it out.

Rick

Virtually every reader is well aware of the decision from the US Court of Appeals for the First Circuit finding that claims by class-action plaintiffs for “mitigation damages” arising from a cyber breach were viable. Anderson v. Hannaford Brothers Co., 659 F.3d 151 (1st Cir. 2011).

There, the court held under Maine law that, in the abstract, certain claimants whose financial information was stolen could recover certain costs incurred in a reasonable effort to mitigate.

Hannaford Brothers is an extreme outlier in the world of cyber class-action litigation. And—as it should have in my view—the case effectively ended when the District Court, on remand, declined to certify the putative class in light of the claimants’ failure to establish that common issues of law and fact “predominate” over individual issues, a predicate to class certification.

Read the rest of this entry »

Risk Based Security’s 2013 Data Breach QuickView Report

The following was provided by my friend Jake Kouns of Risk Based Security, a leading-edge security and threat intelligence company. that provides comprehensive vulnerability and data breach intelligence services.   Thanks Jake.

Rick

Risk Based SecurityWe  are pleased to release our Data Breach Quick view report that shows 2013 broke the previous all-time record for the number of exposed records caused by reported data breach incidents.  The 2,164 incidents reported during 2013 exposed over 822 million records, nearly doubling the previous highest year on record (2011).

Although overshadowed by the number of exposed records, 2013 is also ranked #2 in total reported  data breach incidents, just behind 2012. “When you analyze the data breach activity in 2013 it’s hard to  find any bright-side, said Barry Kouns, CEO of Risk Based Security. “Four of the “Top 10” data breaches all time, were reported in 2013, including the top spot. “

Read the rest of this entry »

The Target Breach: Show Me The Insurance

The following article was first published by the Advisen Cyber Risk Network. If you haven’t checked it out, you should. Its extremely informative. And I’ll be a regular contributor.

Cheers.

Rick

By now, almost everyone has read or heard about – or even been directly impacted by – the theft of financial data relating to over 40 million credit and debit cards used at Target stores in November and December last year.

However, the insurance coverage aspects of the breach have generally flown under the radar.

To a company like Target (or whoever is affected by the next breach), the availability of insurance coverage is an important component of crisis management and remediation, litigation and regulatory investigation strategies, and reputational/brand/lost income protection.

So assuming Target has purchased potentially applicable insurance products, what coverages might apply?  And how might they respond?

At a minimum, it can be expected that Target will investigate the availability of coverage under four separate lines of insurance: Cyber, privacy and technology (CPT); general liability; crime/fidelity and; directors and officers liability policies.

Read the rest of this entry »

Cyber Security and Data Breaches: Why Directors and Officers Should Be Concerned

Following is an excerpt from the leading chapter in Willis London’s Executive Risks: A Boardroom Guide 2012/2013. If you would like to read the entire chapter, please contact me at [email protected] A complete copy will be emailed upon request. Cheers. Rick

sec1

Cyber insurance has become a necessity. Every company that maintains, houses or moves sensitive information is at risk of a data breach, primarily due to the growth and increased sophistication of hackers, malicious software and, most recently, ‘hacktavists’. Even mere employee negligence can lead to a data breach. High-profile companies such as Sony can attest that cyber-intrusions can lead to hundreds of millions, if not billions, of dollars in legal exposure.

Equally troublesome, our expanding online society has introduced new financial risks and exposures that may not be covered under general and professional liability insurance products, including standard directors’ and officers’ (D&O) policies. As such, corporate directors and officers, and their risk-management professionals, must ensure that they buy appropriately tailored policies that provide protection against the rapidly expanding risks to which they could be vulnerable, both personally and professionally.

The risks and costs of a data breach

It has become known as the Year of the Breach: in 2011, companies of all sizes experienced malicious intrusions or employee negligence that affected their operations and/or businesses. For example, in April 2011, computer hacktavists unlawfully accessed the Sony PlayStation Network (PSN) and obtained the personal and financial information of roughly 77 million PSN users. Since then, Sony and its insurers likely have spent tens, if not hundreds, of millions of dollars to remedy and mitigate the resulting security and commercial crises — an amount that grows by the day as lawyers prosecute class action lawsuits on behalf of allegedly affected users whose personal and financial information was improperly accessed.

Equally problematic for Sony, it has been sued by its commercial general liability (CGL) insurer, which sought to avoid coverage by arguing that its general liability policies do not and never were intended to cover data breaches.

The TJX Companies also fell victim to a cyber intrusion that security experts predict will have long-term costs of between US$4 billion and US$8 billion in fines, legal fees, notification expenses and brand impairment. In the TJX case, the retail group reported that 45.6 million credit and debit card numbers were stolen from one of its systems during the period July 2005 to January 2007. Of critical import, the January 2007 intrusion occurred after TJX already had knowledge of the initial breaches.

Of course, big corporations are not the only entities that are vulnerable to hackers and hacktavisits; indeed, half of all companies that have experienced data breaches have fewer than 1,000 employees.

 

PDF24 Creator    Send article as PDF   

Cyber, Privacy and Technology Best Practices and Reputational Harm: Why Legal Professionals Need a Lawyer’s Advice, Counsel and Privileges

BabyB_LPlate_improvedIntroduction

Lawyers, like other professionals, often have access to their clients’ personal and financial details. At the same time, they may possess comparable information about their clients’ clients (such as when a lawyer represents a healthcare company). As a result, lawyers are at risk for being sued if and when something happens to that information – such as when a laptop or cell phone is misplaced or stolen or a hacker breaches a law firm or client’s systems and accesses the client’s personally identifiable, health care, and/or confidential information.
The most prudent way to avoid such lawsuits and minimize their impact is to create and implement cyber, privacy and technology (“CPT”) best practices before something goes wrong. In most cases, this would include best practices training and education as well as the purchase of dedicated CPT-specific insurance. This article discusses why lawyers are at risk, how to create and implement best practices, and the advantages of CBT insurance coverage rather than (mistakenly) relying on professional errors and omissions and/or general liability coverage in the event of a CPT incident.

Executive Summary

An attorney’s reputation is his and her lifeblood. Indeed, reputation translates to the bottom line. For better or worse.
And, of course, reputation is, in large part, predicated on the quality, timeliness and cost-effectiveness of the services being provided. So too, it is incumbent that an attorney avoid negative commentary (or embarrassing revelations) through the pervasive and ubiquitous medium of social media. As a corollary, attorneys, like others, must be sensitive to the loss of customer goodwill, whether measured by turnover, client retention or other intangible assets.

Regardless of whether your clients are the Fortune 500, middle-market companies or small entrepreneurs, an attorneys’ clients – and by extension, the attorney himself and herself (to the extent the attorney holds personal, health or commercial information) – are at risk of losing personally identifiable information (“PII”), personal health information (“PHI”) and/or confidential commercial information (“CCI”). It doesn’t matter whether the harm is attributable to malicious activity or simple employee or third-party negligence. It’s the effect that is the focus, not necessarily the cause (although that too factors into the analysis).

In many cases, the effect of a cyber incident could be devastating, if not fatal, to an attorney’s reputation. And, by extension, his or her practice’s economic viability.
It is almost axiomatic to say that “best practices” are among the most important strategies employed by attorneys and other professionals. Just as we counsel clients to use best practices with respect to their operations, so too, we, as professionals, should be well-trained on the scope and extent of best practices in the subject matter presented, including, in particular, CPT risks and exposures, which, to no surprise, are palpable and potentially devastating.

In the CPT context, among others, best practices counseling should be provided by an attorney. Unlike non-lawyers, attorneys bring with them the attorney-client privilege and work product protection. Although vendors and IT specialists can promote themselves as having the appropriate knowledge and training to teach and implement best practices, they do possess the critical protections afforded by the attorney-client relationship. In a relatively new space like CPT, where the law is uncertain and developing, the privileges become even more important, as many attorneys are just at the start of the learning curve.

To continue reading, please contact me at [email protected] A complete copy will be emailed upon request. Cheers. Rick

PDF24 Creator    Send article as PDF   

Canada Update: The Tort of “Intrusion upon Seclusion”

The following was written by my friend Patrick Cruikshank, Underwriting Manager, Specialty Risk – Professional Liability at Northbridge Insurance in Toronto. Thanks to Patrick for his contribution. Relevant articles are always welcome for publication.

Rick

canada-flag-stereotypesIn the 2012 case of Jones v. Tsige, the Ontario Court of Appeal established the new tort of invasion of privacy.  For some, this privacy tort has opened a Pandora’s Box.  For others, it’s considered legal progress in the modern technological world.

Sandra Jones and Winnie Tsige were employees of the Bank of Montreal (BMO).  They worked at different branches and did not know each other.  Tsige was in an intimate relationship with Jones’ ex-husband.

Over a period of 4 years, Tsige used her workplace computer to gain access to Jones’ personally identifiable information and personal financial information 174 times.  Tsige did not disseminate this information.

When Jones discovered this unauthorized access, she made a formal complaint to her employer, who upon investigation determined that Tsige had accessed Jones’ information and had no legitimate reason to do so.  Jones subsequently sued Tsige for invasion of privacy and breach of fiduciary duty.  She sought $70,000 in general damages plus $20,000 in punitive damages.

Jones’ claim was dismissed by the Ontario Superior Court because there was no law in Ontario that recognized an invasion of privacy tort.

The Court of Appeal overturned the decision and granted summary judgment in favor of Jones.

Read the rest of this entry »

Asia-Pacific Cyber Law Risks and Developments

We first published the following White Paper extract in October 2011. While the White Paper might be somewhat dated (and therefore will be refreshed shortly), it remains relevant for our friends interested in learning the basics of Asia Pacific cyber/privacy law. Please let me know if you’d like to see the entire paper. Rick

I. Introduction

The Internet facilitates the widespread and instantaneous flow of information across international borders. While the advent of this method of transnational communication has truly created a “global economy,” at the same time, it has engendered problems for companies and their insurers which seek to assess risk and implement information safeguards, particularly in the face of divergent data privacy laws which vary from region to region or may not even exist in certain jurisdictions. The Asia-Pacific region typifies such a lack of uniformity.

At the same time, the emerging economies in this rapidly growing part of the world have generated promising targets for computer hackers. 75% of Asia-Pacific enterprises have experienced cyber attacks in the past 12 months. Perhaps not surprisingly, a 2010 study by Symantec reported that almost half of all Asia-Pacific-based businesses (and 67% in Singapore) ranked cyber risk and information security as their top concern—more so than natural disasters, terrorism, and traditional crime combined. Cyber attacks and data breaches are on the radar of CEOs and risk managers for good reason: the average cost for a large company to remediate a data breach in Australia increased to nearly $2 million in 2010, which is slightly up from 2009. See Ponemon Institute/Symantec 2010 Annual Study: Australian Cost of a Data Breach (May 2011).

Notwithstanding the prevalence of such attacks, it is far more likely that a cyber security program is managed as a part of a company’s traditional business risks, with traditional coverages being contorted to cover various components of cyber risk (i.e. property loss, liability to third-parties, business interruption, etc.), rather than by way of a dedicated cyber-specific insurance program. Still, in light of recent developments, it is virtually certain that companies soon will begin looking to transfer such risk via more efficient and targeted technology insurance forms and policies

Read the rest of this entry »

Protecting Our Children from Internet Predators, Marketers and Information Aggregators: The Need for Aggressive Government Intervention

As everyone knows, the Internet has dramatically altered (read: simplified) the way we communicate, do business and satisfy our intellectual and social curiosities. Indeed, Internet-based sales topped the trillion dollar mark for the first time in 2012 and are projected to increase 18.3% to 1.298 trillion in 2013. I’d take that rate of growth any day, particularly in the current world economy.

Read the rest of this entry »

Canadians More Exposed Than One Would Think

canada-flag-stereotypesOkay. Let’s start with the obvious. No, this has nothing to do with Canadian citizens and immigrants behaving badly, although that may be a topic for a future post.

What we’re talking about is the prevalence of cyber-related incidents and the resulting fallout among Canadian-based companies. And the numbers may surprise you.

Read the rest of this entry »

The Insurance Industry: In Regulators’ Sights

If you’re an insurance company, it may be time to open your cyber-related checkbooks if you haven’t done so already. New York Governor Andrew Cuomo’s Department of Financial Services (“NYSDF”) soon may be watching you. They’re already asking questions as if certain insurers were “persons of interest,” just as it did earlier this year with certain of the larger banks.

On May 28, the NYSDF sent what are referred to as “308 letters” to 31 regulated health, life and general liability insurance companies (seemingly those with the highest premium revenue). The NYSDF’s letters request information on (1) the insurers’ existing IT-related management policies and procedures with respect to the prevention of cyber attacks, (2) actual cyber attacks occurring within the past three years, (3) the quantum of funds and resources dedicated to cybersecurity, and (4) how they safeguard customers’ and business entities’ health and personally identifiable information (the letters specifically identify financial information as a subject category).

Read the rest of this entry »

The Posts have Come Back… To Cyberinquirer


Since last we visited, your humble Publisher has moved on to the Law Offices of Richard J. Bortnick, where I am Managing Director (very European, if I do say so myself). A number of dedicated readers and friends (you know who you are) have asked what had become of me and why my old email address was no longer effective.

The answer my friend (apologies to Peter, Paul and Mary) is the Law Offices of Richard J. Bortnick. At the risk of having this viewed as attorney advertising, I will stop there other than to say I also will be signing as a free agent with a Consulting Firm to be named later (but not much later).

So, please feel free to contact me if you want to catch up, engage in intellectual banter (with the exception of Philadelphia sports, where the banter will all be negative) or have some worthwhile humor you’d like to pass along (although it can’t be as good as the material I get from my good friend Jeff). My new email address is [email protected] (at least for the short term… stay tuned on that too).

Its good to be back. And thanks for all of your kind wishes.

Rick

PDF24 Creator    Send article as PDF   

Cyber Liability Insurance: Ensuring Adequate Coverage in the Age of E-Commerce

I. Introduction: Insurance Products for Cyber Risks

Increasing reports of cyber intrusions, data theft and computer system malfunctions have led a rapidly-growing number of companies to purchase insurance coverage to protect themselves from technology and cyber privacy risks. Indeed, as our technology-driven economy continues to evolve and businesses become more reliant on electronic communication and data storage, they are developing a heightened awareness that an unauthorized intrusion could endanger their tangible and intangible assets (including their intellectual property) and, in many cases, their reputations and abilities to conduct business. As such, prospective policyholders are becoming more cognizant of the necessity for insurance covering such growing exposures.

Read the rest of this entry »

Power to the People: Social Media Technologies Mediating Corporate Social Governance

The measure of effectiveness of a CEO and its executive board has always been the degree to which the business is achieving its purpose. Whether in Canada, the U.S., Europe or Asia, an executive board’s purpose should be to increase shareholder value, a purpose that is best accomplished by serving the needs of various stakeholders. Somewhere in the pyramid of stakeholders is the consumer or client, whose likes, favorites, and preferences must be met with quality personalized products and services that deliver high competitive value. In an interconnected global knowledge economy, this has meant listening to what consumers are saying online through social media platforms like Facebook and Twitter, and engaging in two-way conversations to respond in real-time to consumer demands.

Read the rest of this entry »

Who Owns Patient Data in Electronic Health Records?

Following is a guest post by Doug Pollack, CIPP/US, chief strategy officer at ID Experts, a leading provider of healthcare privacy and data breach solutions. The article explores the thorny issue of “ownership” as it applies to patient data stored in and shared by electronic health record systems.

Cheers.

Rick

I recently began exploring the question of who, or what entity, owns the data that is incorporated in our patient electronic health records (EHRs). I originally began thinking about this because I was imagining that the “owner” would be responsible under circumstances where there was an unauthorized disclosure of such protected health information (PHI), in other words a data breach. It seemed like such a simple question, I had assumed I would find the answer to be just as straightforward. As it turns out, many have pondered this question and suggest that the question of “ownership” of medical data may be a misplaced one, an unanswerable question, and that the more relevant question is what control the patient, and other members of the health ecosystem, have relative to accessing, modifying, appending and transmission of this data. In other words, how is patient privacy provided for within the new EHR universe?

Read the rest of this entry »

The Queen v. Cole: Privacy Protection for Employer-Issued Equipment in Canada

The recent decision The Queen v. Cole by the Supreme Court of Canada touches upon interesting issues regarding information privacy in the digital age.

The facts are simple. An information technologist working at the same high school as Mr. Cole, a teacher, remotely accessed Cole’s history of internet access and one of his drives and found a hidden file which contained nude photographs of a student. The photographs and internet file were copied onto a disc and given to the police, which determined that a search warrant was unnecessary. Cole was subsequently charged with possession of child pornography and fraudulently obtaining data from another computer hard drive. The trial judge excluded the computer material under Sections 8 and 24(2) of the Charter. In overturning the decision, the summary conviction appeal court found no breach of Section 8. This decision was set aside by the Ontario Court of Appeal, which concluded that the evidence of the disc containing the temporary internet files and the laptop computer and its mirror image was excluded. A 6-1 majority ruling by the Supreme Court concluded that the police infringed upon Cole’s rights but upheld the Court of Appeals’ finding that the evidence should not have been excluded from trial.

Read the rest of this entry »

It’s Time for Professionals to Practice What They Preach

The following column appeared in the September 2012 issue of the Advisen Cyber Journal. I hope it resonates with our legal eagle subscribers. If not, then your brokers (and I) have more work to do.

Cheers.

Rick

Lawyers typically fancy themselves as the smartest people in the room. Many certainly have the largest egos in the room. But when it comes to keeping their own houses in order? Well, not so much. Its akin the shoemaker whose children go barefoot.

The same flaw appears to apply with equal force and effect with respect to accountants. And consultants. And, perhaps most incredibly, insurance brokers.

Perhaps you’ve figured out where I’m going with this. But in case you haven’t, here’s what I’m getting at. Counter-intuitive as it may seem, anecdotal reporting from a number of underwriters I’ve spoken with suggest that intelligent, thoughtful, (sometimes) rational people who bill others hundreds of dollars an hour or make sizable commissions for dispensing professional advice do not abide by their own wisdom and don’t buy cyber/technology/privacy (“CTP”) insurance.

Read the rest of this entry »

State Privacy Laws Evolve While Congress Campaigns

New legislation governing data breaches and privacy issues is popping up in states across the country. Most recently, Connecticut, Vermont, and Illinois have enacted new laws in these areas.

Connecticut

At long last, the proposed legislation requiring a data breach to be reported has become law in Connecticut. Section 369-701b was unable to move its way through the 2012 General Session of the Connecticut Legislature, but it was recently passed as part of the Connecticut General Assembly’s Special Session as an attachment of the Budget Bill.

Read the rest of this entry »

Human Error: The Greatest Risk and Root Cause of Data Security

Whether discussing data encryption, network security, or internal data privacy management practices and policies, the most sophisticated IT security protocols, the most learned team of specialists, and the most compliant of data management practices and policies cannot escape, prevent, or remedy what many businesses and organizations have rightly labeled as the root cause of data security failures: human error. While they tend to possess greater network security than smaller organizations, the risk of human error should be of particular a concern to medium and large size organizations whose internal controls over data and employees are inevitably diluted by their size and numbers.

Read the rest of this entry »

Data Privacy and Unauthorized Non-Hackers: the Rise and Risk of Accountability and Breach Notifications in Canada

Recent unauthorized access to British Columbia Institute of Technology’s computer network, which contained personal medical information of approximately 12,680 individuals, is yet another reminder of risks of exposure to data breaches. That none of the data on BCIT’s computer network was compromised or misused is reflective of a low-profile non-hacker intrusion, and of the ease with which computer networks can be infiltrated. Indeed, a sophisticated hacker would know better than to leave massive amounts of data, rightly labeled by some as the “oil” of the 21st century, uncompromised. More curious than uncompromised data, however, is BCIT’s notification in the absence of an actual data breach, and mandatory breach notification provisions under B.C. privacy law.

Read the rest of this entry »