CSI 2008, Legal Developments In Security and Privacy Law

Developments in Security & Privacy Law Fall 2008

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Universe of Legal Requirements ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

New and Proposed Federal Legislation

New: Former Vice President Protection Act of 2008/Identity Theft Enforcement and Restitution Act of 2008 (H.R. 5938) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

New: Credit and Debit Card Receipt Clarification Act of 2007 ,[object Object],[object Object],[object Object]

Other New Laws ,[object Object],[object Object]

What is Happening with the Federal Notice of Breach Law? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Senate Bills ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

House Bills ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Key Health Information Technology Bill ,[object Object],May 2008: Appeared to be headed to the floor after Senate Judiciary Committee Chairman Patrick Leahy (D-VT) and HELP committee leaders reached agreement on new privacy provisions to be included in the bill June 2007: Approved by the Health , Education, Labor and Pensions (HELP) Committee October 1, 2008 Kennedy Filed a report on the Bill, but the Bill was not put up to vote Passage by the 110 Congress Not Likely

HIT bills before Congress, House The House Energy and Commerce Committee approved the bill July 23 House Ways and Means Committee retained jurisdiction over the bill and as of Oct. 2 had not acted on it ,[object Object],[object Object],[object Object],[object Object],Breach Notification Exempts good faith disclosures or encrypted information Continues HIPAA Security

Proposed FISMA Act of 2008: ,[object Object],[object Object]

Proposed FISMA Act of 2008 ,[object Object],[object Object],[object Object],[object Object]

Proposed FISMA Act of 2008 (cont’d) ,[object Object],[object Object],[object Object]

Proposed FISMA Act of 2008: Contractor Requirements ,[object Object],[object Object],[object Object],[object Object]

Proposed FISMA Act of 2008: Contractor Requirements Increase Oversight of Contractor Systems Improve Inventory of Contractor-Run Systems Contractually Impose Compliance

House Bill to Amend FISMA ,[object Object],[object Object]

Federal Trade Commission Reauthorization Act of 2008" (S. 2831) ,[object Object],[object Object],[object Object],[object Object],[object Object]

Other Pending Legislation ,[object Object],[object Object],[object Object],[object Object]

Proposed or New Federal Agency Rules and Guidelines Security, Privacy, Identity Theft

Proposed Amendments to Regulation S-P ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

FACT Act Red Flags Regulations ,[object Object],[object Object],[object Object],[object Object],[object Object]

FTC Enforcement Delay ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ID Theft Prevention Program ,[object Object],[object Object],[object Object],[object Object],[object Object],*Red flags are sets of condition that could point to ID theft, such as an atypical spending pattern, or receipt of a change of address notice followed immediately by multiple credit and/or debit card requests.

State Legislative Action When Congress Doesn’t Act, States Fill in the Gaps

44 States Have Enacted State Notice of Breach Laws ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Inconsistent State Breach Notice Laws ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Inconsistent State Breach Laws (cont’d) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

2007 “SB 1386” Amendment ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Emerging State Data Security Laws ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Massachusetts Compliance Program Elements ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Massachusetts Safeguards Physical Administrative Technical Note: Massachusetts also has data destruction Requirements. Mass. Gen. Law 93I ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],- Secure user authentication protocols; - Secure access, providing access to only to those require information to perform their job duties; assign unique ID and passwords to each person; - Encrypt records containing PI transmitted over the Internet, transmitted wirelessly, or are stored on laptops or other portable devices; - Monitor systems for unauthorized access or use; and - Keep current firewall protection, operating system security patches for systems connected to the Internet, and malware/virus software. - Implement reasonable restrictions on physical access to records; and - storage of records containing PI and data in locked facilities, storage areas or containers.

Spyware -- State Laws ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],State Statutes specifically targeting spyware and adware:

New 2008 State Spyware Efforts ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

State Social Security Laws ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agency Enforcement Actions and Private Litigation

HIPAA Security Enforcement ,[object Object],[object Object],[object Object]

CMS Security Audits ,[object Object],[object Object],[object Object]

DCM PwC Compliance Reviews ,[object Object],[object Object],[object Object],[object Object]

CMS Guidance ,[object Object],[object Object],[object Object],[object Object]

Providence Health Systems ,[object Object],[object Object],[object Object]

Resolution Agreement ,[object Object],[object Object]

Corrective Action Plan ,[object Object],[object Object],[object Object],[object Object]

HHS Office of Inspector General (OIG) ,[object Object],[object Object],[object Object],[object Object],[object Object]

OIG Audit of CMS’ HIPAA Enforcement ,[object Object],[object Object],[object Object],[object Object],[object Object]

FTC Security Enforcement Based on notice of privacy practices and official statements regarding how an organization safeguards sensitive information. (e.g., In re Guidance Software Inc. Deceptive Trade Practices Unfair Trade Practices Practices that "threaten data security“ are unfair practices. (e.g., In re BJ’s Wholesale Club ) GLBA Safeguards Violations of Safeguards Rule, (e.g., In re Superior Mortgage Corp. )

Enforcement/Consent Orders - FTCA ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Total of 18 Cases

FTC Enforcement - GLBA Safeguards ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Consent Orders and Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Implement administrative, technical, and physical safeguards appropriate to the size, the nature of the company’s activities, and the sensitivity of the personal information collected by each organization. ,[object Object],[object Object]

SEC Enforcement of Regulation S-P ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

U.S. InfoSec Litigation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],“ no court has considered the risk [of ID theft] itself to be damage” This changes with actual damages

TJX Companies Breach ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

New Security Breach Cases ,[object Object],[object Object],[object Object],[object Object]

Thank You! M. Peter Adler Attorney at Law 202.220.1278 Direct Fax: 800.684.2749 [email_address] Hamilton Square 600 Fourteenth Street, N.W. Washington DC 20005-2004 202.220.1200 Fax: 202.220.1665 www.pepperlaw.com

CSI 2008, Legal Developments In Security and Privacy Law

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to CSI 2008, Legal Developments In Security and Privacy Law

Similar to CSI 2008, Legal Developments In Security and Privacy Law (20)

Recently uploaded

Recently uploaded (20)

CSI 2008, Legal Developments In Security and Privacy Law