1. The Lawyer | 21 September 2015 5
REPUTATION MANAGEMENT
TimeforSWAT
Schillings
41 Bedford Square,
London, WC1B 3HX
Tel:+44 (0)20 7034 9000
Email:magnus.boyd@schillings.co.uk
Web:www.schillings.co.uk
imperative so refrain from downplaying the gravity of
the situation, the sense of invasion or the anxiety
that data loss can cause. Instead, be clear and
transparent about how you are handling the issue.
Communication
Data breaches can have a wide-ranging impact on
the business affected. In the absence of ongoing risk
assessments, businesses will struggle to identify
how a breach will affect their overall risk profile and,
critically, what secondary risks exist as a result. It is
therefore vital to establish clear reporting lines so
that information can be shared quickly within the
business. Consider establishing a response team
comprised of key business stakeholders, including
your cyber security team, general counsel, HR, PR
and customer services. Ensure your internal and
external communications are consistent.
Consistency
In the early stages of data breach management
businesses will be required to notify a variety of
external stakeholders.There are likely to be differing
requirements in different jurisdictions for notifying
regulators and those whose data has been lost.
However, it is important to be consistent in your
treatment of individuals irrespective of jurisdiction.
There is nothing worse than a customer whose data
has been lost finding out about it through the media
before you’ve had a chance to notify them.
Boldness
The consequential damage to reputation following a
data breach will linger long after the security breach
that caused it has been fixed. While insurance can
cover the costs of managing a data breach, there is
no cover for damaged customer relations. But it’s not
all doom and gloom;businesses should not lose
sight of the fact that cyber security measures can
instil faith and cultivate customer goodwill.
In 2012, the then director of the FBI, Robert Mueller
said that there were only two types of company;
“Those that have been hacked, and those that will
be." Business needs to recognise the inevitability of
a data breach and move away from the concept of
simply building ever bigger technical defences.
Resources are sometimes better spent on a
human-focused, risk management approach to
cyber security with preparedness, awareness and
simulation at its core.
Data breaches are now one of the biggest threats to
corporate reputation. As the public wakes up to how
much of its data is in circulation, how long it can be
stored and how much value it has, they are rightly
demanding that it be properly secured.
Compromised data compromises goodwill.There is
now a direct correlation between loss of data and
loss of reputation. As with other crises, however, it is
not necessarily the data breach that causes damage
to reputation but the way in which that breach is
managed. In fact, a trained and well-managed
response to a data breach can actually build trust
and enhance a business’ reputation.
So what to do? From a reputation perspective, an
effective data breach response can be underpinned
by seven key principles:
Preparation
An exhaustive simulation of a data breach is the
most effective preparation for managing such a
crisis in a way that enhances rather than diminishes
a reputation. A simulation provides the opportunity
to rehearse sector-specific scenarios and is the only
way the response team can practice working
together. Coupled with the proposed notification
requirements of the General Data Protection
Regulation (GDPR), in the event of an actual data
breach there will be no time for dithering.
Speed
The moment you sense your data has been
compromised, act quickly to stop continued data
loss.The faster you act the better the chances of
catching the hacker.The steps taken to contain a
breach and mitigate the harm done to those whose
data has been lost will have a significant bearing on
the reputational impact of the breach.Thus, any
delay will be seized on and criticised.
Accountability
The most effective reassurance for stakeholders is
to take responsibility for managing the containment
and recovery process. Accepting responsibility for
managing the data loss is not the same as accepting
liability for the damage arising from it. If concern
about the former delays progress of the latter the
damage to reputation could last longer than any
other form of liability. Information security is a
business problem, not just an IT or PR problem.
Understanding
Acknowledge the impact the breach has had on the
individuals whose data has been lost or stolen. In
some cases the individuals may not immediately
grasp its implications. Maintaining customer trust is
By Magnus Boyd, partner,
Schillings
BRIEFING
CYBER
SECURITY
Seven principles
for an effective
data breach
response