Feature

Data Breach: Security Measures the Law Requires of IT

A complicated blend of laws and regulations means you need to keep up with the latest security threats, or find your company in the headlines--and your job on the line.

By Thomas J. Smedinghoff

August 18, 2008 — InfoWorld — For most IT organizations, securing corporate data against compromise is priority No. 1. Girding the enterprise against breaches is a constant, thankless task requiring foresight, vigilance, and much in the way of IT expenditures. Keep up with the latest threats, or find your company in the headlines—and your job on the line.

Such is the shift in attitude toward security in IT. In the Wild West, when Jesse James and Butch Cassidy robbed banks, we felt sorry for the banks and hunted down the outlaws. Today, when someone breaks into a company's computer system, our response is totally different: We blame the company for failing to provide adequate security.

Codifying this shift is a complex blend of laws and regulations enacted to protect the confidentiality and integrity of valuable personal data and the individuals who might be harmed by a breach. Not complying with these mandates can result in grave legal consequences should your organization suffer a breach.

Here you will find a framework for understanding these legal initiatives, which, when viewed as a group, impose two key legal obligations on your organization: the duty to implement reasonable security measures to protect data, and the duty to disclose breaches to those affected.

The duty to provide security There is no single statute or regulation that governs all of your company's information security obligations. Instead, an ever-expanding patchwork of legal requirements is continuously evolving to impose a comprehensive duty to provide "reasonable" or "appropriate" security to protect your corporate data.

At the center of this patchwork are numerous state and federal regulations: privacy laws that require companies to protect personal data; e-transaction laws that govern the accessibility and integrity of electronic records; corporate governance legislation that requires appropriate controls to protect public companies and their shareholders, investors, and business partners; and unfair-business-practice laws now interpreted to include failure to provide adequate security as an unfair business practice.

Further complicating your obligations are recent lawsuits, in which a variety of legal theories have been asserted against organizations for failing to provide adequate security for their data. Some decisions have held that companies can be liable for negligence in failing to provide adequate security. Wolfe v. MBNA America Bank, which involved a negligence claim against MBNA America Bank for damages sustained by a victim of identity theft, is an example of this.

In addition to the obligations imposed by statutes, regulations, and court rulings, your company may assume security obligations voluntarily by contract. For example, outsourcing or similar agreements in which one business has access to the confidential data of its trading partner often require appropriate security measures be taken to protect that data. Similarly, businesses are often required to agree to security commitments as a condition of participating in certain activities. Merchants that want to accept credit cards, for example, must agree to comply with the PCI (Payment Card Industry) Data Security Standard.