The Legal Side of Data Breach and Third Party Risk - IIA 9th Annual Fraud Summit
Upcoming SlideShare
Loading in...5
×

Like this? Share it with your network

Share

The Legal Side of Data Breach and Third Party Risk - IIA 9th Annual Fraud Summit

  • 604 views
Uploaded on

Shawn Tuma's presentation with Christopher Mitchell (of Crowe Horwath) at The Institute of Internal Auditors 9th Annual Fraud Summit. The title of the presentation is The Legal Side of Data Breach......

Shawn Tuma's presentation with Christopher Mitchell (of Crowe Horwath) at The Institute of Internal Auditors 9th Annual Fraud Summit. The title of the presentation is The Legal Side of Data Breach and Third Party Risk.

The main point of the presentation is that when a company is breached through the fault of one of its third-party business associates, or other third-parties, the company is still responsible for all of the repercussions arising out of the breach and, at best, will then have to go and pursue its rights against the third party. Thus, companies need to ensure that their business associates and other third parties adhere to proper data security practices and they should be audited to ensure compliance.

More in: Law
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
604
On Slideshare
541
From Embeds
63
Number of Embeds
3

Actions

Shares
Downloads
2
Comments
0
Likes
0

Embeds 63

http://shawnetuma.com 59
http://shawnetumadotcom.wordpress.com 2
http://wordpress.com 2

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 1 The Legal Side of Data Breach and Third Party Risk Shawn Tuma, Partner BrittonTuma 469.635.1335 stuma@brittontuma.com @shawnetuma blog: shawnetuma.com web: brittontuma.com Shawn Tuma is a lawyer whose practice is focused on cutting-edge cyber and information law and includes issues like helping businesses defend their data and intellectual property against computer fraud, data breaches, hacking, corporate espionage, and insider theft. Shawn stays very active in the cyber and information law communities:  Chair, Collin County Bar Association Civil Litigation & Appellate Law Section  College of the State Bar of Texas  Privacy and Data Security Committee of the State Bar of Texas  Computer and Technology, Litigation, Intellectual Property Law, and Business Sections of the State Bar of Texas  Information Security Committee of the Section on Science & Technology Committee of the American Bar Association  Social Media Committee of the American Bar Association  North Texas Crime Commission, Cybercrime Committee  International Association of Privacy Professionals The information provided is for educational purposes only, does not constitute legal advice, and no attorney-client relationship is created by this presentation.
  • 2. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 2 “Authority” Governing Data Breach • Laws • Types • Common Law (courts) • Statutory Law (legislatures) • Sources • International • Federal • State • Local • Agency Rules & Regulations • Industry Standards
  • 3. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 3 What do these sources of “Authority” have in common? • Tell you what must be done following a breach. • Can you guess who “you” is? • “You” is the entity breached.
  • 4. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 4 What do you have to do following a data breach? • Execute Breach Response Plan • General Steps • contact attorney (privilege) • assemble your Response Team • contact forensics • contact notification vendor • investigate breach • remediate responsible vulnerabilities • reporting & notification
  • 5. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 5 What does “reporting & notification” mean? • Law Enforcement • State Attorneys General • Federal Agencies • FTC, SEC, HHS, etc. • Industry Groups • PCI, FINRA, FDIC • Credit Bureaus • Professional Vendors & Suppliers • Consumers
  • 6. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 6 Cost of a Data Breach! • In 2012 • $188.00 per lost record • $188.00 x “X” - $$$$$$$$
  • 7. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 7 Story Time • you were CEO of a world-wide company • breach impacting 110 million customers • $61 million in expenses alone • 10% discount to all shoppers • $5 million investment in cybersecurity coalition • offer “free” identity theft and credit monitoring to all affected customers • Net earnings down 34.28% • Earnings per share down 44.60% • Non-cash losses down 487.71% • US sales down 6.60% • Lawsuits, possible enforcement actions, who knows? • and then you learn …
  • 8. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 8 Have you ever heard of …
  • 9. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 9 Have you ever heard of …
  • 10. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 10 Important Questions • Whose 110,000,000+ customers were furious? • Who spent $61 million in expenses? • Who gave a 10% discount to all shoppers? • Who gave $5 million to a cybersecurity coalition? • Who offered “free” identity theft and credit monitoring to all affected customers? • Whose net earnings are down 34.28%? • Whose earnings per share are down 44.60%? • Whose non-cash losses down 487.71%? • Whose US sales are down 6.60%? • Who is defending lawsuits, enforcement actions? • One more question …
  • 11. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 11 Who can tell me the takeaway? hint: • it is related to the topic of this presentation • YOU ARE STILL LIABLE FOR BREACHES CAUSED BY 3RD PARTIES!!!
  • 12. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 12 Allocating risk and mitigating risk by contract • Allocating risk • designate duties & responsibilities A party bears the risk when the agreement allocates the risk to that party. TEX. JUR. 3d Contracts § 123 • indemnify “An undertaking against loss or damage amounts to a guaranty of reimbursement on a payment by the indemnitee. With respect to a promise to indemnify against damages, a right to bring suit does not accrue until the indemnitee has suffered damage or injury by being compelled to pay the judgment or debt.” 14 TEX. JUR. 3d Contribution § 24 • Mitigating risk • require mandatory policies, procedures, and security standards for third parties
  • 13. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 13 But all are just contractual obligations • Look to you for relief, you must then go enforce your contractual remedies • Breach of Contract • Inability to perform • Unwillingness to perform • Efficient breach theory • Insolvency / bankruptcy • Cost of litigation to enforce
  • 14. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 14 The contractual obligations are important and needed • Show diligence and taking data security more serious than most • FTC – looking at 3rd party contracts • SEC – looking at policies and 3rd party contracts • Post-breach = helpful for attorneys general • But more is required
  • 15. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 15 Recent agency advisory statements • January 2014: SEC indicates that the new standard of care for companies may require policies in place for: 1. Prevention, detection, and response to cyber attacks and data breaches, 2. IT training focused on security, and 3. Vendor access to company systems and vendor due diligence. • January 31, 2014: GMR Transcription Svcs – FTC case – is requiring businesses to follow 3 steps when contracting with 3rd party service providers: 1. Investigate by exercising due diligence before hiring data service providers. 2. Obligate their data service providers to adhere to the appropriate level of data security protections through contractual agreements with provider. 3. Verify that the data service providers are adequately protecting data as required by the contractual standards.
  • 16. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 16 Ronald Reagan, in dealing with Soviets, said… “Trust, but verify.” How do you verify? Audit!
  • 17. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 17 Key Takeaways • You are still liable for breaches caused by 3rd parties! • Contractual agreements are not a magic wand to make liability go away – you are still responsible but now have a remedy against the 3rd party • “Trust, but verify” = Audit! • Cyber Insurance
  • 18. Digital Business Risk www.brittontuma.com © 2014 Shawn E. Tuma 18 Sun Tzu – The Art of War “In all fighting the direct method may be used for joining battle, but indirect methods will be needed to secure victory.” “You can be sure of succeeding in your attacks if you attack places which are not defended.” “The spot where we intend to fight must not be made known; for then the enemy will have to prepare against a possible attack at several different points; and his forces being thus distributed in many directions, the numbers we shall have to face at any given point will be proportionately few.”