Hospitals, medical clinics, and other health related groups have a much higher risk from identity theft and record theft than do financial businesses. Why? Simply for openers a medical record contains so much information that it can easily be converted to a fake identity. Medical records are a hot commodity among data thieves. Most definitely they can be used to recieve medical care. They can also be used to file false insurance claims. Stolen medical records can enable someone with a terminal or social disease to obtain employment. Medical records can be be sold on the market many times over to identity marketeers, potentially at $100s per sale. All of these and other types of misuse of medical records can wreak havoc on a persons' good name for years.
End users can run the gamut from drug addicts, insurance fraud thieves, illegal aliens, and persons who for any number of reasons cannot get health insurance. HIPAA compliance is only a starting point when it comes to records safety. A holistic approach of training and the adoption of a more comprehensive data protection policy must be adopted by all medical and health related organizations. It is not enough for staff to know what to do step by rote step in securing medical records. If they can see how it might affect their lives to be a victim, it is easier to relate to protecting others' information. Now is the time to train people as to why they need to be careful, cautious and vigilent. Another thing to remember, medical facilities also have employee HR records, financial records, and all of the same types of data as do all businesses. HIPAA does not address the safekeeping of that data, only that of patient records.
The following is from the current AMA AMedNews;
Hospitals underrate malicious intent in data breaches
Experts say there are also lessons about data security for physician practices in the HIMSS study findings.
By Pamela Lewis Dolan, AMNews staff. May, 2008.
Hospitals generally are well aware of what they have to do under the Health Insurance Portability and Accountability Act to ensure the security of patient data. They are also aware that their own employees might be the ones who breach that security.
However, hospitals generally underestimate the malicious intent and the financial damage involved in data breaches and are unaware they're being targeted by perpetrators wishing to commit identity theft or medical fraud.
That is the conclusion of a recent report by the Health Information and Management Systems Society. The report was based on responses to a January telephone survey from 263 hospital executives responsible for patient data.
"I think ... hospitals, they may stick their heads in the sand, and they don't want to acknowledge that people want to access people's data for personal gain," said Brian Lapidus, chief operating officer of Kroll Fraud Solutions. Kroll, which sells data protection and identity theft response solutions, commissioned the study by HIMSS.
The report did not look into breaches at physician practices. But some experts say physicians also underestimate their chances of being targeted.Mike Spinney, spokesman for Ponemon Institute, a Traverse City, Mich.-based think tank that researches privacy and data security issues, said while breaches are commonly discovered at hospitals and large medical groups, too often physician practices adopt a mentality that they are too small to be targeted.
Monday, May 19, 2008
Thursday, May 15, 2008
Data Breaches Mean More Than Bad Publicity
I discovered this informative article recently. As to the civil actions taken in data breach cases it is worth noting that in November 2007 Federal courts have allowed class action suits to go forward in the case of the missing laptop from a Veterans’ Administration employee. The argument similar to those below state that the VA “failed to adequately protect the information entrusted to them”, breach of trust being the central argument.
It should be obvious to the business owner that by addressing simple compliance steps an organization can greatly reduce risk of suit. Pro-active steps taken by a company to prevent identity theft and to formulate and adopt a breach response plan can dramatically reduce that risk saving legal fees and controlling the runaway costs of litigation and damages to public confidence.
John Taylor May 15, 2008
Data Breaches Mean More Than Bad Publicity
Jim Walden, Alexander H. Southwell and Aaron GoodmanNew York Law JournalMay 15, 2008
Over the last several years, corporate data breaches have been regularly splashed across the front pages of the nation's newspapers, causing nightmares for corporate executives. Ever-increasing digitization in areas such as business, banking and accounting has led multinationals to collect and retain inestimable quantities of personal information about employees, customers and counterparties.[FOOTNOTE 1]
The negligent (or even innocent) loss of electronic data to cyber-criminals inflicts billions of dollars of damage on our economy, as personal information has become a sought-after treasure trove for cyber-criminals.[FOOTNOTE 2] In fact, recent reports note that the number of attacks on credit and debit card processing systems has more than doubled from 2006 to 2007, and that trend appears to be continuing into 2008.[FOOTNOTE 3]
These costs are likely to escalate as, in an increasing trend, corporations are also being pummeled with civil litigation related to data breaches. The recently announced data breach at grocer Hannaford Brothers Co. illustrates the trend. On March 17, 2008, Hannaford announced that cyber----bandits had breached its system, obtaining access to personal-financial information of nearly 4.2 million customers.[FOOTNOTE 4] Just three days after the announcement, plaintiffs' lawyers filed four class actions against Hannaford. Since then, lawyers have filed an additional 12 complaints, requiring Hannaford to defend litigation from Florida to Maine.[FOOTNOTE 5]
Hannaford is not alone: TJX, a retailer that operates T.J. Maxx and Marshall's stores, faced a federal investigation and an onslaught of follow-on civil litigation[FOOTNOTE 6] after announcing a breach widely reported as the largest data-security breach in U.S. history where computer "hackers" stole at least 45.7 million credit and debit records.[FOOTNOTE 7]
Although data breaches can occur in a wide variety of ways -- from lost or stolen employee laptops to hacked computer networks -- most companies face a similar array of implications following discovery of a breach. As an initial and immediate matter, a thorough forensic investigation is critical to ascertain the scope and nature of the data breach. Only a complete assessment of the digital evidence will help to determine how the breach occurred, how recurrences can be prevented, and precisely what data -- and in what form -- was compromised, all of which will contribute to ascertaining the best course of action.
STATE LAWS
Forensic investigations are also critical to guide a corporation through the maze of state data breach notification laws. Such laws will require varying levels of compliance, depending on the nature of the breach and of the entity's operations. California's data breach law, which has served as a model for many other states, demands that upon discovering a breach of personal information, a business "shall disclose any breach of the security of the system" to any affected persons "in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement."[FOOTNOTE 8]
While not required in California, some states also require notifying consumer reporting agencies.[FOOTNOTE 9] Thus, compliance with state law often forces a company to go public by announcing the security breach, thereby beginning the public relations nightmare. After the breach at TJX, for example, the company sent letters to the estimated 455,000 customers whose information had been compromised and offered them credit monitoring, helping make the data breach a front-page story.[FOOTNOTE 10] Beyond the bad publicity, only mere months after the breach, TJX had already incurred $5 million for the investigation and for new computer security.[FOOTNOTE 11]
REGULATORY SCRUTINY
In addition to the media scrutiny focused on corporate data breaches, companies suffering data breaches have increasingly been subjected to regulatory scrutiny, typically spearheaded by the Federal Trade Commission and state Attorneys General. Indeed, in 2006, the FTC established its Division of Privacy and Identity Protection, specifically tasked to investigate data breaches. As of March 2008, the FTC has brought 20 cases against businesses for failing to maintain reasonable security in protecting "sensitive consumer information" and investigated many others.[FOOTNOTE 12]
FTC actions are routinely resolved through settlements, which may include hefty fines and often require the implementation of comprehensive information security plans with regular independent audits. In January 2006, the FTC announced a record settlement with ChoicePoint Inc., which had disclosed the year before that the personal-financial information of 163,000 consumers had been compromised. The settlement required Choice-Point to pay $10 million in civil penalties (the largest civil penalty in FTC history), to provide $5 million for consumer redress and to establish and maintain a comprehensive information security program including administrative, technical and physical safeguards, as well as audits by an independent third-party security professional every other year for 20 years.[FOOTNOTE 13] The FTC's June 2005 settlement with BJ's Wholesale Club, which had been charged with failing to take appropriate security measures to protect the sensitive information of thousands of its customers, also required implementing a new information security program and biennial audits for 20 years,[FOOTNOTE 14] as did the FTC's September 2007 settlement with TJX.[FOOTNOTE 15]
LITIGATION
As stated, corporations suffering data breaches are also routinely contending with follow-on civil suits -- private, often class, actions seeking damages for the potential economic losses and emotional distress allegedly caused by the potential misuse of the disclosed personal information. Increasingly, these suits are filed soon after the data breach is publicly announced -- much like "stock drop" securities class actions -- thereby adding negative publicity and causing further distractions. Indeed, the first four lawsuits against Hannaford were filed just three days after the company announced that there had been a security breach.
Data-breach litigation typically alleges causes of action grounded in tort and contract: negligence, breaches of fiduciary duty, breaches of real and implied contracts, invasion of privacy and emotional distress. Some causes of action are grounded in state law, such as consumer protection acts, unfair trade practices acts and state data breach notification laws. Plaintiffs in these lawsuits seek damages arising from the fear of potential identity theft, including fraudulent charges to their accounts, credit monitoring costs, identity theft insurance costs, credit report costs, emotional distress from fear of fraud, damage to credit history and loss of privacy. Courts have been hesitant to permit suits for such speculative damages, thus dismissing suits where plaintiffs had not yet been victims of any identity fraud.
In the recent case of Randolph v. ING Life Insurance & Annuity Co., plaintiffs brought a consumer class action in District of Columbia federal court for invasion of privacy, gross negligence and negligence against ING following an announcement of the theft of an employee laptop from that employee's home containing the personal information of 13,000 government workers and retirees.[FOOTNOTE 16] Plaintiffs argued, inter alia, that the theft exposed them to "substantial risk of identity theft," and that as a "direct and proximate result," they "have been exposed to a risk of substantial harm and inconvenience, and have incurred or will incur actual damages in purchasing comprehensive credit reports and monitoring of their identity and credit for the definite future."[FOOTNOTE 17] However, none of the plaintiffs asserted that they had actually been the victim of any identity theft.[FOOTNOTE 18]
As stated briefly above, litigation of this type does not generally progress beyond the pleadings stage due to an absence of actual damages. As an illustration, in Randolph, ING succeeded on a motion to dismiss, arguing that plaintiffs lacked standing to sue because they proved no actual damages and, thus, no "recognized injury."[FOOTNOTE 19] The court agreed, citing a long line of "lost data" cases in which courts held that "an allegation of increased risk of identity theft due to lost or stolen personal data, without more, is insufficient to demonstrate a cognizable injury."[FOOTNOTE 20] Thus, plaintiffs failed to demonstrate the "injury in fact" necessary for the constitutional requirement of Article III standing.[FOOTNOTE 21] Moreover, the court also recognized that credit monitoring services, even if the plaintiffs were to have actually alleged payment for such services, cannot constitute actual injury.[FOOTNOTE 22]
Guin v. Brazos Higher Education Service Corporation Inc. had a similar result.[FOOTNOTE 23] There, plaintiff brought a negligence suit against Brazos after it announced the theft of a laptop containing personal information for 550,000 customers. Granting summary judgment in favor of Brazos, the court held that Brazos had no duty of protection (under the Gramm-Leach-Bliley Act),[FOOTNOTE 24] that Brazos acted with reasonable care in handling the information and that Brazos's inability to foresee and deter the specific theft was not a breach of a duty of reasonable care.[FOOTNOTE 25] Because neither of plaintiff's identity nor personal information was used in any fraud, the court also ruled that the absence of damages was likewise fatal to plaintiff's claim.[FOOTNOTE 26] Consequently, the court dismissed the case with prejudice.
Using similar reasoning, the U.S. Court of Appeals for the Seventh Circuit recently dispatched another action for damages arising from a data breach.[FOOTNOTE 27] In Pisciotta v.Bancorp, the court held that speculative damages for fraud and for credit monitoring fees were not supported by state law -- "[w]ithout more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy."[FOOTNOTE 28] Importantly, the court also held that Indiana's state-data-breach- notification law would not serve to permit such allegations of damage as that statute only creates a duty to disclose and places enforcement in the hands of the Attorney General; it creates no private right of action.[FOOTNOTE 29]
Plaintiffs have not been sheepish in the face of these dismissals. For example, in the Hannaford cases, plaintiffs raised claims of common law negligence, breach of contract (real and implied) and breach of fiduciary duty.[FOOTNOTE 30] The cases seek damages including out-of-pocket losses due to fraud, the costs of credit monitoring, the cost of identity theft insurance, the cost of credit reports, emotional distress damages arising from fear and apprehension of fraud and identity theft, loss of privacy, anxiety and loss of control of personal information.[FOOTNOTE 31] Several of the cases sought damages under Maine's Unfair Trade Practices Act.[FOOTNOTE 32]
While it is too soon to accurately predict the litigation landscape, the trend seems to be grounding more lawsuits in state law statutes, and for common law allegations, alleging more specific and provable damages. The better plaintiffs get on the damages front, the farther along the cases will be able to move. This could mean the potential for more costly discovery before a suit is resolved or settled. While the hurdles for plaintiffs remain high, these lawsuits have become a fact of life in today's litigious society. Corporations suffering data breaches thus must now routinely face an onslaught of civil litigation in addition to the negative publicity and regulatory scrutiny coming from data breaches and their announcements. Given the increasing digitization of the economy and society, companies should brace for these lawsuits when the almost inevitable data breach occurs.
Jim Walden, the former chief of the computer crimes and intellectual property section of the Brooklyn U.S. Attorney's Office, is a partner at Gibson, Dunn & Crutcher and the co-chair of its white-collar defense and investigations group. Alexander H. Southwell is of counsel at the firm, an adjunct professor of law at Fordham University School of Law and a former federal prosecutor in the Southern District of New York. Aaron Goodman is an associate at the firm.
FOOTNOTESFN
1 "Personal Information" is a term of art used in state data breach notification laws, generally defined as an individual's first name or first initial and last name, in combination with that individual's Social Security number, driver's license number or credit, debit or account number (in combination with a required access code). See, e.g., N.Y. GEN. BUS. LAW §899aa(b) (2007). Two states also include medical information. See, e.g., ARK. COD E ANN . §4-110-103(7) (2007); CAL. CIVIL COD E §1798.82(e) (2007).
FN2 Andrew K. Burger, "The Costs of ID Theft, Part 2: Fixing the System," E-Commerce Times, Feb. 6, 2008, available at www.ecommercetimes.com/story/61542.html.
FN3 "Data Breaches: Attacks Seeking Credit Card Data Double, PCT DSS Efforts Crucial, Visa Official Says," 7 Privacy & Security Law 13 (March 31, 2008).
FN4 "Data Breaches; Hannaford Faces a Dozen More Class Actions Over Breach of Customer Payment Card Data," 7 Privacy and Security Law 14 (April 7, 2008).
FN5 Id.
FN6 "First TJX Class Actions Brought in U.S., Canada," 10 Consumer Financial Services Law Report, Data Security 16 (Feb. 21, 2007).
FN7 Jenn Abelson, "Breach of data at TJX is called the biggest ever," Boston Globe, March 29, 2007.
FN8 Cal. Civil Code §1798.82 (a). Most states adopt this language, with only minor variations. See, e.g., MD. Code Ann . §14-3504(b)(3) (2007) ("as soon as reasonably practicable"); Ohio Rev. Code Ann . 1349.19(B)(2) (2007) ("in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach").
FN9 See, e.g., Col. Rev. Stat. §6-1-716(2)(d) (2007); Fla. Stat. §817.5681(12) (2007); GA. Code Ann . §10-1-912(d) (2007); Indiana Code §4-1-11 (2007).
FN10 Abelson, supra note 7.
FN11 Id.
FN12 "Data Breach: FTC Settlements Require Data Brokers, Retailer to Secure Customer Information," 7 Privacy & Security Law 13 (March 31, 2008).
FN13 Press Release, Federal Trade Commission, "ChoicePoint Settles Data Security Breach Charges; to Pay $10 Million in Civil Penalties, $5 Million for Consumer Redress" (Jan. 26, 2006).
FN14 Press Release, Federal Trade Commission, "BJ's Wholesale Club Settles FTC Charges" (June 16, 2005), available at http://www.ftc.gov/opa/2005/06/bjswholesale.shtm.
FN15 Press Release, Federal Trade Commission, "Agency Announces Settlement of Separate Actions Against Retailer TJX" (March 27, 2008), available at http://www.ftc.gov/opa/2008/03/datasec.shtm. TJX separately settled lawsuits brought by card-issuing banks for around $66 million, and a consumer class action for a variety of vouchers, cash benefits and reimbursements, credit monitoring and identity theft insurance, and up to $6.5 million for attorney fees. Other litigation and governmental investigations related to TJX are ongoing.
FN16 486 F.Supp.2d 1 (D.D.C. 2007).
FN17 Id. at 4.
FN18 Id.
FN19 Id. at 6.
FN20 Id.
FN21 Id. at 6-7; Bell v. Acxiom Corp., No. 4:06CV00485, 2006 U.S. Dist. LEXIS 72477 (E.D. Ark. Oct. 3, 2006) (dismissing action as a matter of law for lack of standing where "Plaintiff has not alleged that she has suffered anything greater than an increased risk of identity theft"); Giordano v. Wachovia Sec., LLC, No. 06-476, 2006 U.S. Dist. LEXIS 52266 at *12 (D. N.J. July 31, 2006) ("Plaintiff's claims, at best, are speculative and hypothetical future injuries. A complaint alleging the mere potential for an injury does not satisfy Plaintiff's burden to prove standing."); Hendricks v. DSW Shoe Warehouse Inc., 444 F.Supp.2d 775 (W.D. Mich. 2006), (dismissing breach of contract claim arising from data theft as a matter of law for failure to allege any actual damages).
FN22 Randolph, 484 F.Supp.2d at 19-20 ("expenditure of time and money was not the result of any present injury, but rather the anticipation of future injury that has not materialized").
FN23 Guin v. Brazos Higher Ed. Serv. Comp. Inc., No. 05-668, 2006 U.S. Dist. LEXIS 4846 (D. Miss. Feb. 7, 2006).
FN24 Id., at *8-*9; see 15 USC §6801 (act created to protect against unauthorized access to or use of records which could result in substantial harm or inconvenience to any customer of a financial institution).
FN25 Id. at *12.
FN26 Id. at *16.
FN27 Pisciotta v. Old National Bancorp, 499 F.3d 629 (7th Cir. 2007).
FN28 Id.
FN29 Id.
FN30 See, e.g., Nenni v. Hannaford Bros., Co., No. 1:08-cv-106-JL (D. N.H. March 20, 2008); Doherty v. Hannaford Bros., Co., No. 2:08-cv-00089-DH (D. Ma. March 19, 2008); Wheeler v. Hannaford Bros., Co., No. 2:08-cv-00091-DBH (D. Ma. March 20, 2008); Ryan v. Delhaize America Inc., No. 1:08-cv-00086-JAW (D. Ma. March 18, 2008); Bradbury v. Delhaize America Inc., No. 2:08-cv-00093-DBH (D. Ma. March 20, 2008).
FN31 Id. FN32 See Ryan, No. 1:08-cv-00086-JAW; Bradbury, No.2:08-cv-00093-DBH.
It should be obvious to the business owner that by addressing simple compliance steps an organization can greatly reduce risk of suit. Pro-active steps taken by a company to prevent identity theft and to formulate and adopt a breach response plan can dramatically reduce that risk saving legal fees and controlling the runaway costs of litigation and damages to public confidence.
John Taylor May 15, 2008
Data Breaches Mean More Than Bad Publicity
Jim Walden, Alexander H. Southwell and Aaron GoodmanNew York Law JournalMay 15, 2008
Over the last several years, corporate data breaches have been regularly splashed across the front pages of the nation's newspapers, causing nightmares for corporate executives. Ever-increasing digitization in areas such as business, banking and accounting has led multinationals to collect and retain inestimable quantities of personal information about employees, customers and counterparties.[FOOTNOTE 1]
The negligent (or even innocent) loss of electronic data to cyber-criminals inflicts billions of dollars of damage on our economy, as personal information has become a sought-after treasure trove for cyber-criminals.[FOOTNOTE 2] In fact, recent reports note that the number of attacks on credit and debit card processing systems has more than doubled from 2006 to 2007, and that trend appears to be continuing into 2008.[FOOTNOTE 3]
These costs are likely to escalate as, in an increasing trend, corporations are also being pummeled with civil litigation related to data breaches. The recently announced data breach at grocer Hannaford Brothers Co. illustrates the trend. On March 17, 2008, Hannaford announced that cyber----bandits had breached its system, obtaining access to personal-financial information of nearly 4.2 million customers.[FOOTNOTE 4] Just three days after the announcement, plaintiffs' lawyers filed four class actions against Hannaford. Since then, lawyers have filed an additional 12 complaints, requiring Hannaford to defend litigation from Florida to Maine.[FOOTNOTE 5]
Hannaford is not alone: TJX, a retailer that operates T.J. Maxx and Marshall's stores, faced a federal investigation and an onslaught of follow-on civil litigation[FOOTNOTE 6] after announcing a breach widely reported as the largest data-security breach in U.S. history where computer "hackers" stole at least 45.7 million credit and debit records.[FOOTNOTE 7]
Although data breaches can occur in a wide variety of ways -- from lost or stolen employee laptops to hacked computer networks -- most companies face a similar array of implications following discovery of a breach. As an initial and immediate matter, a thorough forensic investigation is critical to ascertain the scope and nature of the data breach. Only a complete assessment of the digital evidence will help to determine how the breach occurred, how recurrences can be prevented, and precisely what data -- and in what form -- was compromised, all of which will contribute to ascertaining the best course of action.
STATE LAWS
Forensic investigations are also critical to guide a corporation through the maze of state data breach notification laws. Such laws will require varying levels of compliance, depending on the nature of the breach and of the entity's operations. California's data breach law, which has served as a model for many other states, demands that upon discovering a breach of personal information, a business "shall disclose any breach of the security of the system" to any affected persons "in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement."[FOOTNOTE 8]
While not required in California, some states also require notifying consumer reporting agencies.[FOOTNOTE 9] Thus, compliance with state law often forces a company to go public by announcing the security breach, thereby beginning the public relations nightmare. After the breach at TJX, for example, the company sent letters to the estimated 455,000 customers whose information had been compromised and offered them credit monitoring, helping make the data breach a front-page story.[FOOTNOTE 10] Beyond the bad publicity, only mere months after the breach, TJX had already incurred $5 million for the investigation and for new computer security.[FOOTNOTE 11]
REGULATORY SCRUTINY
In addition to the media scrutiny focused on corporate data breaches, companies suffering data breaches have increasingly been subjected to regulatory scrutiny, typically spearheaded by the Federal Trade Commission and state Attorneys General. Indeed, in 2006, the FTC established its Division of Privacy and Identity Protection, specifically tasked to investigate data breaches. As of March 2008, the FTC has brought 20 cases against businesses for failing to maintain reasonable security in protecting "sensitive consumer information" and investigated many others.[FOOTNOTE 12]
FTC actions are routinely resolved through settlements, which may include hefty fines and often require the implementation of comprehensive information security plans with regular independent audits. In January 2006, the FTC announced a record settlement with ChoicePoint Inc., which had disclosed the year before that the personal-financial information of 163,000 consumers had been compromised. The settlement required Choice-Point to pay $10 million in civil penalties (the largest civil penalty in FTC history), to provide $5 million for consumer redress and to establish and maintain a comprehensive information security program including administrative, technical and physical safeguards, as well as audits by an independent third-party security professional every other year for 20 years.[FOOTNOTE 13] The FTC's June 2005 settlement with BJ's Wholesale Club, which had been charged with failing to take appropriate security measures to protect the sensitive information of thousands of its customers, also required implementing a new information security program and biennial audits for 20 years,[FOOTNOTE 14] as did the FTC's September 2007 settlement with TJX.[FOOTNOTE 15]
LITIGATION
As stated, corporations suffering data breaches are also routinely contending with follow-on civil suits -- private, often class, actions seeking damages for the potential economic losses and emotional distress allegedly caused by the potential misuse of the disclosed personal information. Increasingly, these suits are filed soon after the data breach is publicly announced -- much like "stock drop" securities class actions -- thereby adding negative publicity and causing further distractions. Indeed, the first four lawsuits against Hannaford were filed just three days after the company announced that there had been a security breach.
Data-breach litigation typically alleges causes of action grounded in tort and contract: negligence, breaches of fiduciary duty, breaches of real and implied contracts, invasion of privacy and emotional distress. Some causes of action are grounded in state law, such as consumer protection acts, unfair trade practices acts and state data breach notification laws. Plaintiffs in these lawsuits seek damages arising from the fear of potential identity theft, including fraudulent charges to their accounts, credit monitoring costs, identity theft insurance costs, credit report costs, emotional distress from fear of fraud, damage to credit history and loss of privacy. Courts have been hesitant to permit suits for such speculative damages, thus dismissing suits where plaintiffs had not yet been victims of any identity fraud.
In the recent case of Randolph v. ING Life Insurance & Annuity Co., plaintiffs brought a consumer class action in District of Columbia federal court for invasion of privacy, gross negligence and negligence against ING following an announcement of the theft of an employee laptop from that employee's home containing the personal information of 13,000 government workers and retirees.[FOOTNOTE 16] Plaintiffs argued, inter alia, that the theft exposed them to "substantial risk of identity theft," and that as a "direct and proximate result," they "have been exposed to a risk of substantial harm and inconvenience, and have incurred or will incur actual damages in purchasing comprehensive credit reports and monitoring of their identity and credit for the definite future."[FOOTNOTE 17] However, none of the plaintiffs asserted that they had actually been the victim of any identity theft.[FOOTNOTE 18]
As stated briefly above, litigation of this type does not generally progress beyond the pleadings stage due to an absence of actual damages. As an illustration, in Randolph, ING succeeded on a motion to dismiss, arguing that plaintiffs lacked standing to sue because they proved no actual damages and, thus, no "recognized injury."[FOOTNOTE 19] The court agreed, citing a long line of "lost data" cases in which courts held that "an allegation of increased risk of identity theft due to lost or stolen personal data, without more, is insufficient to demonstrate a cognizable injury."[FOOTNOTE 20] Thus, plaintiffs failed to demonstrate the "injury in fact" necessary for the constitutional requirement of Article III standing.[FOOTNOTE 21] Moreover, the court also recognized that credit monitoring services, even if the plaintiffs were to have actually alleged payment for such services, cannot constitute actual injury.[FOOTNOTE 22]
Guin v. Brazos Higher Education Service Corporation Inc. had a similar result.[FOOTNOTE 23] There, plaintiff brought a negligence suit against Brazos after it announced the theft of a laptop containing personal information for 550,000 customers. Granting summary judgment in favor of Brazos, the court held that Brazos had no duty of protection (under the Gramm-Leach-Bliley Act),[FOOTNOTE 24] that Brazos acted with reasonable care in handling the information and that Brazos's inability to foresee and deter the specific theft was not a breach of a duty of reasonable care.[FOOTNOTE 25] Because neither of plaintiff's identity nor personal information was used in any fraud, the court also ruled that the absence of damages was likewise fatal to plaintiff's claim.[FOOTNOTE 26] Consequently, the court dismissed the case with prejudice.
Using similar reasoning, the U.S. Court of Appeals for the Seventh Circuit recently dispatched another action for damages arising from a data breach.[FOOTNOTE 27] In Pisciotta v.Bancorp, the court held that speculative damages for fraud and for credit monitoring fees were not supported by state law -- "[w]ithout more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy."[FOOTNOTE 28] Importantly, the court also held that Indiana's state-data-breach- notification law would not serve to permit such allegations of damage as that statute only creates a duty to disclose and places enforcement in the hands of the Attorney General; it creates no private right of action.[FOOTNOTE 29]
Plaintiffs have not been sheepish in the face of these dismissals. For example, in the Hannaford cases, plaintiffs raised claims of common law negligence, breach of contract (real and implied) and breach of fiduciary duty.[FOOTNOTE 30] The cases seek damages including out-of-pocket losses due to fraud, the costs of credit monitoring, the cost of identity theft insurance, the cost of credit reports, emotional distress damages arising from fear and apprehension of fraud and identity theft, loss of privacy, anxiety and loss of control of personal information.[FOOTNOTE 31] Several of the cases sought damages under Maine's Unfair Trade Practices Act.[FOOTNOTE 32]
While it is too soon to accurately predict the litigation landscape, the trend seems to be grounding more lawsuits in state law statutes, and for common law allegations, alleging more specific and provable damages. The better plaintiffs get on the damages front, the farther along the cases will be able to move. This could mean the potential for more costly discovery before a suit is resolved or settled. While the hurdles for plaintiffs remain high, these lawsuits have become a fact of life in today's litigious society. Corporations suffering data breaches thus must now routinely face an onslaught of civil litigation in addition to the negative publicity and regulatory scrutiny coming from data breaches and their announcements. Given the increasing digitization of the economy and society, companies should brace for these lawsuits when the almost inevitable data breach occurs.
Jim Walden, the former chief of the computer crimes and intellectual property section of the Brooklyn U.S. Attorney's Office, is a partner at Gibson, Dunn & Crutcher and the co-chair of its white-collar defense and investigations group. Alexander H. Southwell is of counsel at the firm, an adjunct professor of law at Fordham University School of Law and a former federal prosecutor in the Southern District of New York. Aaron Goodman is an associate at the firm.
FOOTNOTESFN
1 "Personal Information" is a term of art used in state data breach notification laws, generally defined as an individual's first name or first initial and last name, in combination with that individual's Social Security number, driver's license number or credit, debit or account number (in combination with a required access code). See, e.g., N.Y. GEN. BUS. LAW §899aa(b) (2007). Two states also include medical information. See, e.g., ARK. COD E ANN . §4-110-103(7) (2007); CAL. CIVIL COD E §1798.82(e) (2007).
FN2 Andrew K. Burger, "The Costs of ID Theft, Part 2: Fixing the System," E-Commerce Times, Feb. 6, 2008, available at www.ecommercetimes.com/story/61542.html.
FN3 "Data Breaches: Attacks Seeking Credit Card Data Double, PCT DSS Efforts Crucial, Visa Official Says," 7 Privacy & Security Law 13 (March 31, 2008).
FN4 "Data Breaches; Hannaford Faces a Dozen More Class Actions Over Breach of Customer Payment Card Data," 7 Privacy and Security Law 14 (April 7, 2008).
FN5 Id.
FN6 "First TJX Class Actions Brought in U.S., Canada," 10 Consumer Financial Services Law Report, Data Security 16 (Feb. 21, 2007).
FN7 Jenn Abelson, "Breach of data at TJX is called the biggest ever," Boston Globe, March 29, 2007.
FN8 Cal. Civil Code §1798.82 (a). Most states adopt this language, with only minor variations. See, e.g., MD. Code Ann . §14-3504(b)(3) (2007) ("as soon as reasonably practicable"); Ohio Rev. Code Ann . 1349.19(B)(2) (2007) ("in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach").
FN9 See, e.g., Col. Rev. Stat. §6-1-716(2)(d) (2007); Fla. Stat. §817.5681(12) (2007); GA. Code Ann . §10-1-912(d) (2007); Indiana Code §4-1-11 (2007).
FN10 Abelson, supra note 7.
FN11 Id.
FN12 "Data Breach: FTC Settlements Require Data Brokers, Retailer to Secure Customer Information," 7 Privacy & Security Law 13 (March 31, 2008).
FN13 Press Release, Federal Trade Commission, "ChoicePoint Settles Data Security Breach Charges; to Pay $10 Million in Civil Penalties, $5 Million for Consumer Redress" (Jan. 26, 2006).
FN14 Press Release, Federal Trade Commission, "BJ's Wholesale Club Settles FTC Charges" (June 16, 2005), available at http://www.ftc.gov/opa/2005/06/bjswholesale.shtm.
FN15 Press Release, Federal Trade Commission, "Agency Announces Settlement of Separate Actions Against Retailer TJX" (March 27, 2008), available at http://www.ftc.gov/opa/2008/03/datasec.shtm. TJX separately settled lawsuits brought by card-issuing banks for around $66 million, and a consumer class action for a variety of vouchers, cash benefits and reimbursements, credit monitoring and identity theft insurance, and up to $6.5 million for attorney fees. Other litigation and governmental investigations related to TJX are ongoing.
FN16 486 F.Supp.2d 1 (D.D.C. 2007).
FN17 Id. at 4.
FN18 Id.
FN19 Id. at 6.
FN20 Id.
FN21 Id. at 6-7; Bell v. Acxiom Corp., No. 4:06CV00485, 2006 U.S. Dist. LEXIS 72477 (E.D. Ark. Oct. 3, 2006) (dismissing action as a matter of law for lack of standing where "Plaintiff has not alleged that she has suffered anything greater than an increased risk of identity theft"); Giordano v. Wachovia Sec., LLC, No. 06-476, 2006 U.S. Dist. LEXIS 52266 at *12 (D. N.J. July 31, 2006) ("Plaintiff's claims, at best, are speculative and hypothetical future injuries. A complaint alleging the mere potential for an injury does not satisfy Plaintiff's burden to prove standing."); Hendricks v. DSW Shoe Warehouse Inc., 444 F.Supp.2d 775 (W.D. Mich. 2006), (dismissing breach of contract claim arising from data theft as a matter of law for failure to allege any actual damages).
FN22 Randolph, 484 F.Supp.2d at 19-20 ("expenditure of time and money was not the result of any present injury, but rather the anticipation of future injury that has not materialized").
FN23 Guin v. Brazos Higher Ed. Serv. Comp. Inc., No. 05-668, 2006 U.S. Dist. LEXIS 4846 (D. Miss. Feb. 7, 2006).
FN24 Id., at *8-*9; see 15 USC §6801 (act created to protect against unauthorized access to or use of records which could result in substantial harm or inconvenience to any customer of a financial institution).
FN25 Id. at *12.
FN26 Id. at *16.
FN27 Pisciotta v. Old National Bancorp, 499 F.3d 629 (7th Cir. 2007).
FN28 Id.
FN29 Id.
FN30 See, e.g., Nenni v. Hannaford Bros., Co., No. 1:08-cv-106-JL (D. N.H. March 20, 2008); Doherty v. Hannaford Bros., Co., No. 2:08-cv-00089-DH (D. Ma. March 19, 2008); Wheeler v. Hannaford Bros., Co., No. 2:08-cv-00091-DBH (D. Ma. March 20, 2008); Ryan v. Delhaize America Inc., No. 1:08-cv-00086-JAW (D. Ma. March 18, 2008); Bradbury v. Delhaize America Inc., No. 2:08-cv-00093-DBH (D. Ma. March 20, 2008).
FN31 Id. FN32 See Ryan, No. 1:08-cv-00086-JAW; Bradbury, No.2:08-cv-00093-DBH.
Monday, May 5, 2008
A case for lawyers
A case for lawyers (although it’s not what you think), aka the small businessman grows up.
“Beware of the coming Military-Industrial Complex” Only history can judge the infamy of this quote by President Dwight Eisenhower. Certainly to some degree he was in effect signaling the changes in our society from a largely agrarian and small business economy into a post WWII economy of large business and huge government contracting that would form the cornerstone of the new age and world trade.
Fueled by the war effort, great industrial giants emerged to shoulder the load of wartime production. At war’s end these new manufacturing machines were not about to fold up and shrink back into the background noise of society. Industry had hit its’ stride in a new era of commerce. We went in just a few short years from the remnants of the 19th Century way of doing things into what would be the preparation stages for the 21st Century way of doing things. Sixty years ago our family doctor would come to our home to treat the kids, pass out a little wisdom on preventive health care and maybe even stay for a chicken dinner. The relationship was both personal and long lasting.
There were half as many of us then as there are now. Other than the sweeping social legislation of the Great Depression our laws and the way we used them had not changed substantially for ordinary citizens in half a century. A small businessperson could concentrate on running a business. Providing goods and services to the customer was the order of the day with some late-night hours devoted to keeping the books and accounting for expenses. The small business owner did not share the problems of big industry. Growing a business was the work of entrepreneurs. A good idea had a decent chance for success if the bank on the corner would see the vision and fund the venture. Our individual rights to pursue our future and to protect our privacy at the same time seemed more clearly defined. There was no perceived trade off between the two things.
As our society becomes more global, and with the population on what seems to be a never-ending upward spiral a lot of these things we have counted on to remain the same have been put to the test. As the exchange of information becomes more virtual our right to privacy is under a constant siege between the public need to know and our individual protections. With convenience and accuracy being the engine of change huge ubiquitous databases amass, collect and disseminate everything from our date of birth, our spending habits and our credit worthiness, to our employability. The definition of individual rights to employment and anti-discrimination laws have made for massive changes in the way business operates. A business owner can no longer measure a prospective employee by his demeanor in an interview and a nod from a former employer. There are now dozens of laws that business owners must comply with alone just to legally hire or terminate someone.
Business contracts are more complex than ever. Every thing from hold harmless agreements, terms of payment and performance, and a lot more even including terms of litigation if the deal goes astray have to be taken into account for almost any business contract today. The laws that govern business practices both on the federal and state levels fill rooms with volume after leather-bound volume.
Big business has had the advantage of consistent legal advice or even entire legal departments in some cases to carefully review every business decision and scenario before time, effort, and funds are committed. Corporate business decisions are rarely made without the consideration of legal opinion and liability weighed in the balance alongside that of the potential benefit to the business and the investors.
Just about every aspect of starting and operating a business has changed over the past 15 years or so to the point that simply running the business is often relegated to only a percentage of the business day.
“Marketing”, “brand recognition”, “market demographics”, are just a few of the new terms we hear in an ever more complex maze of specialties that have emerged just to keep a business competitive in the marketplace. The term “advertising” has nearly been relegated to the dustbin as an outmoded way to think.
The small business owner by contrast is in a sort of limbo. Quite often the small business owner is still using the frame of reference from the post war days that all he needs to know is how to sell his skills and goods. Very often he is both unaware of the new laws and how they can affect his business. He is equally in the dark as to how to increase the health of his company and to grow its’ customer base. A growing number of small business owners on the other hand are very much aware of the fact that in order to grow and protect their business they need access to the same tools their counterparts in big business have enjoyed all along. We see this in the trend of “third party” providers of services to the small and mid-sized businesses. Companies specializing in everything from finding and recruiting personnel to handling payroll and accounting functions, employee benefits, human resources, marketing, website design, the list goes on.
All of this is designed to level the playing field for the smaller business. And of course to create a new industry, that of third party support for existing businesses. This can be a benefit or a nightmare for the small business owner. These specialties have become so focused that it can take a string of several consultants to perform a single function.
Enter the one stop shop. Now the new generation of whole “solutions” consultancies has emerged. Built around an end to end model, these companies offer an array of services if only the client signs up for the complete package and thereby outsourcing a large portion of the functions of the company. With these kinds of arrangements another layer of complexity is created. Haul out the contracts on this kind of agreement and you will see the darker side of the new business paradigm in terms of shared liability, protection of intellectual property, employee relations, and not the least important safeguarding non-public information held on clients and staff alike from identity thieves. With information whizzing around at light speed the opportunity for errors or theft is tremendous.
The forward thinking business owner knows that the business needs an advocate. A law firm standing by to interpret those convoluted contracts, set up and audit employee hiring and termination practices, consult on compliance matters, and to help as counsel on any phase of business should be integral to every business, not just an afterthought. The risks of lawsuits and damages can be nearly the same for the small business operator now as it is to their larger counterparts. Unfortunately there are still a number of business owners who still believe that good product knowledge or skills are enough to operate a business in today’s world. They are not aware of the responsibilities and liabilities they face in the modern business world. Generally these business owners are the most vocal and quick to complain when something goes wrong after they failed to secure their rights or consulted an expert before getting involved in a situation they did not fully understand.
What does the business owner do to seek legal advice? At the current rates and with billing often in 6-minute increments a business owner often will think twice before getting on the phone with an attorney. Retainers are out of the question for most businesses operating on narrow margins of profit. Although nearly always “expensed” legal fees are usually seen as a cost and not as an investment in the business.
As I said earlier our family doctor used to visit the house and take a great deal of personal time with each patient. Doctors can no longer do this for a number of reasons. Besides having the tools and resources of the medical office a physician can see a lot more patients in the course of a day when the patient goes to see the doctor rather than the reverse. The medical profession has come to terms with the fact that in order to run an efficient medical practice they had to make certain changes to the way they do business. Considering the reality that they can no longer spend extended time with each patient the doctor has had to spend the time they have more efficiently. Another huge shift in the medical business is the concept of insurance. With the skyrocketing costs of medical care an industry emerged to fill in that gap between what physicians need to charge and what the public can afford to pay. Now medical insurance is a ubiquitous industry that serves to offset that cost from the public. The shift has largely worked, and the medical profession has continued to expand and become more and more efficient.
Returning to the legal profession we can see very much the same sort of thing happening.In an increasingly complex world of laws and regulations attorneys have had to focus more and more on very narrow areas of specialty in order to be current and effective. Also the cost of running a legal business has increased dramatically. Still, however, the profession finds itself trying to operate like the family doctor, one patient at a time. And with the spiraling costs of running a legal office the public and the small business community is faced with the very same problem. In this world of increasing complexity, and with the speed with which society is changing to adapt to this new complexity, the legal profession finds itself somewhat behind in providing the public access to the law. For the small business owner this can be a very real problem with far reaching consequences
“Beware of the coming Military-Industrial Complex” Only history can judge the infamy of this quote by President Dwight Eisenhower. Certainly to some degree he was in effect signaling the changes in our society from a largely agrarian and small business economy into a post WWII economy of large business and huge government contracting that would form the cornerstone of the new age and world trade.
Fueled by the war effort, great industrial giants emerged to shoulder the load of wartime production. At war’s end these new manufacturing machines were not about to fold up and shrink back into the background noise of society. Industry had hit its’ stride in a new era of commerce. We went in just a few short years from the remnants of the 19th Century way of doing things into what would be the preparation stages for the 21st Century way of doing things. Sixty years ago our family doctor would come to our home to treat the kids, pass out a little wisdom on preventive health care and maybe even stay for a chicken dinner. The relationship was both personal and long lasting.
There were half as many of us then as there are now. Other than the sweeping social legislation of the Great Depression our laws and the way we used them had not changed substantially for ordinary citizens in half a century. A small businessperson could concentrate on running a business. Providing goods and services to the customer was the order of the day with some late-night hours devoted to keeping the books and accounting for expenses. The small business owner did not share the problems of big industry. Growing a business was the work of entrepreneurs. A good idea had a decent chance for success if the bank on the corner would see the vision and fund the venture. Our individual rights to pursue our future and to protect our privacy at the same time seemed more clearly defined. There was no perceived trade off between the two things.
As our society becomes more global, and with the population on what seems to be a never-ending upward spiral a lot of these things we have counted on to remain the same have been put to the test. As the exchange of information becomes more virtual our right to privacy is under a constant siege between the public need to know and our individual protections. With convenience and accuracy being the engine of change huge ubiquitous databases amass, collect and disseminate everything from our date of birth, our spending habits and our credit worthiness, to our employability. The definition of individual rights to employment and anti-discrimination laws have made for massive changes in the way business operates. A business owner can no longer measure a prospective employee by his demeanor in an interview and a nod from a former employer. There are now dozens of laws that business owners must comply with alone just to legally hire or terminate someone.
Business contracts are more complex than ever. Every thing from hold harmless agreements, terms of payment and performance, and a lot more even including terms of litigation if the deal goes astray have to be taken into account for almost any business contract today. The laws that govern business practices both on the federal and state levels fill rooms with volume after leather-bound volume.
Big business has had the advantage of consistent legal advice or even entire legal departments in some cases to carefully review every business decision and scenario before time, effort, and funds are committed. Corporate business decisions are rarely made without the consideration of legal opinion and liability weighed in the balance alongside that of the potential benefit to the business and the investors.
Just about every aspect of starting and operating a business has changed over the past 15 years or so to the point that simply running the business is often relegated to only a percentage of the business day.
“Marketing”, “brand recognition”, “market demographics”, are just a few of the new terms we hear in an ever more complex maze of specialties that have emerged just to keep a business competitive in the marketplace. The term “advertising” has nearly been relegated to the dustbin as an outmoded way to think.
The small business owner by contrast is in a sort of limbo. Quite often the small business owner is still using the frame of reference from the post war days that all he needs to know is how to sell his skills and goods. Very often he is both unaware of the new laws and how they can affect his business. He is equally in the dark as to how to increase the health of his company and to grow its’ customer base. A growing number of small business owners on the other hand are very much aware of the fact that in order to grow and protect their business they need access to the same tools their counterparts in big business have enjoyed all along. We see this in the trend of “third party” providers of services to the small and mid-sized businesses. Companies specializing in everything from finding and recruiting personnel to handling payroll and accounting functions, employee benefits, human resources, marketing, website design, the list goes on.
All of this is designed to level the playing field for the smaller business. And of course to create a new industry, that of third party support for existing businesses. This can be a benefit or a nightmare for the small business owner. These specialties have become so focused that it can take a string of several consultants to perform a single function.
Enter the one stop shop. Now the new generation of whole “solutions” consultancies has emerged. Built around an end to end model, these companies offer an array of services if only the client signs up for the complete package and thereby outsourcing a large portion of the functions of the company. With these kinds of arrangements another layer of complexity is created. Haul out the contracts on this kind of agreement and you will see the darker side of the new business paradigm in terms of shared liability, protection of intellectual property, employee relations, and not the least important safeguarding non-public information held on clients and staff alike from identity thieves. With information whizzing around at light speed the opportunity for errors or theft is tremendous.
The forward thinking business owner knows that the business needs an advocate. A law firm standing by to interpret those convoluted contracts, set up and audit employee hiring and termination practices, consult on compliance matters, and to help as counsel on any phase of business should be integral to every business, not just an afterthought. The risks of lawsuits and damages can be nearly the same for the small business operator now as it is to their larger counterparts. Unfortunately there are still a number of business owners who still believe that good product knowledge or skills are enough to operate a business in today’s world. They are not aware of the responsibilities and liabilities they face in the modern business world. Generally these business owners are the most vocal and quick to complain when something goes wrong after they failed to secure their rights or consulted an expert before getting involved in a situation they did not fully understand.
What does the business owner do to seek legal advice? At the current rates and with billing often in 6-minute increments a business owner often will think twice before getting on the phone with an attorney. Retainers are out of the question for most businesses operating on narrow margins of profit. Although nearly always “expensed” legal fees are usually seen as a cost and not as an investment in the business.
As I said earlier our family doctor used to visit the house and take a great deal of personal time with each patient. Doctors can no longer do this for a number of reasons. Besides having the tools and resources of the medical office a physician can see a lot more patients in the course of a day when the patient goes to see the doctor rather than the reverse. The medical profession has come to terms with the fact that in order to run an efficient medical practice they had to make certain changes to the way they do business. Considering the reality that they can no longer spend extended time with each patient the doctor has had to spend the time they have more efficiently. Another huge shift in the medical business is the concept of insurance. With the skyrocketing costs of medical care an industry emerged to fill in that gap between what physicians need to charge and what the public can afford to pay. Now medical insurance is a ubiquitous industry that serves to offset that cost from the public. The shift has largely worked, and the medical profession has continued to expand and become more and more efficient.
Returning to the legal profession we can see very much the same sort of thing happening.In an increasingly complex world of laws and regulations attorneys have had to focus more and more on very narrow areas of specialty in order to be current and effective. Also the cost of running a legal business has increased dramatically. Still, however, the profession finds itself trying to operate like the family doctor, one patient at a time. And with the spiraling costs of running a legal office the public and the small business community is faced with the very same problem. In this world of increasing complexity, and with the speed with which society is changing to adapt to this new complexity, the legal profession finds itself somewhat behind in providing the public access to the law. For the small business owner this can be a very real problem with far reaching consequences
Friday, May 2, 2008
Compliance with Identity Theft Laws is no longer an option for Business
John Taylor CITRMS
April 2008
We haven’t come close to over-informing the public on the subject of identity theft if that were even possible. In the training seminars I give on identity theft my biggest emphasis is on the true scope of the set of crimes called identity theft. If we were to believe the ads on TV and the offers of free services by the banks we could easily conclude that this is one crime on the run and will soon be eradicated. After all they say that its’ only a financial crime, right? If that were the case why then is identity theft still the fastest growing crime in the world? Upwards of 300 million records have gone missing or stolen in the past three years in the U.S. alone. And only a fraction of the reported victim cases are related to our finances. Our medical records, drivers license numbers, public records in our county offices, and literally hundreds of databases have sensitive information on us that if aggregated can take on many different forms of identity theft. Thieves and data sellers are finding new and easier ways to data mine, for all forms of our personal information for a wide variety of reasons. Where does the majority of this theft occur? Companies and aggregators of personal non-public information are the source of nearly all identity theft. I read in the April 25th NY Times that the newest trend in debt collection is outsourcing to companies in India. That adds another layer where data theft will most likely occur.
This brings me to the topic of this article. There have been several laws on the books for years now that are designed to protect individuals from having their personal information compromised by an organization entrusted with the information. Federal legislation, HIPAA, FACTA, the FCRA, GLB Safety Act, even S-Ox and other state level whistle-blower laws are in place to provide the language to all organizations as to how data should be safeguarded. There are regular seminars put on by corporate Privacy Chiefs, IT Managers, Risk Managers and software developers across the country that create consortium and industry practices. Our U.S. Secret Service, charged with investigating identity fraud provides mountains of data to the FTC so that patterns and methods might be established in order to catch the thieves in action. In 2006 a Task Force was created by the President to codify and identify identity theft crimes and their impact on government record keeping. The office of OMB issued a memo last year providing stringent requirements for all federal agencies to comply with the findings of the Task Force. The FTC has issued guidelines for business with clear recommendations as to how they can implement an identity theft prevention and response program. Business has largely ignored these recommendations, and generally seems reluctant to admit there is a problem despite the massive press coverage of identity theft. This is evident in the number of breaches that occur on an almost daily basis. Even with 39 individual state breach reporting laws in place incidents of data loss go unreported due to loopholes in those rules. Why is that?
What could possibly stop a company from notifying its clients or employees that their information might have been compromised?
There are several reasons that I can conclude from that phenomenon. First, and I think foremost is that if a breach is made public then the fear of a bad public perception of the company and its’ practices is dominant, and not without some reason in fact. A study commissioned by CIO Magazine shows that when a breach occurs on average 40% of the client base will cease its’ relationship taking their business elsewhere, and 10% will engage counsel in actions against the company. The second reason I believe is that a lot of businesses would rather take the risk rather than to take a pro-active position. In other words, do nothing. Inaction is the leading cause of business failure for any reason.
You can’t leave out that insurance rates and credit worthiness are also at stake but that relates to reason number one above. No business wants to have rising costs. And thirdly, there are still a significant number of business owners that don’t believe that this is a serious issue, believing instead that a lot of hyperbole is given to a subject that has little chance of actually happening. To those I would invite to speak with the roughly 10 million annual U.S. ID theft victims for their opinions. And of course there are the tens of millions of dollars in business fines, mandatory risk assessment audits, actual damage suffered by victims and other related costs. The figure for 2007 in total losses suffered by American business related to identity theft was over $48 billion.
Due to this “lack of enthusiasm” on the part of business in taking the FTC guidelines seriously the government has done what in my opinion should have been done long before. As is the case with HIPAA regulations it is now mandatory for most every organization in the country to be compliant with the laws that protect personal identifying and non-public information. The liability for loss is placed squarely on the shoulders of the organizations that maintain the data. Precedents have already been established issuing fines, criminal prosecution and allowing class actions to go forward. The new regulations also address the sharing of information with 3rd party service providers allowing that the liability follows the data. A business cannot absolve itself of responsibility simply by outsourcing certain functions such as HR or payroll, or even cleaning services that have access to offices during off hours. Compliance cannot be addressed with software alone, or contract language, or simply with firewalls, encryption, or any single-pronged approach. This is not simply an IT problem. Compliance is a multi-faceted procedure that needs to be designed to meet the needs of the particular organization and the data it keeps and uses. In other words there is no single compliance fix. As of January 1st of 2008 the so-called Red flag Rule went into effect that requires compliance prior to November 1st of this year. These new regulations are clear definitions of sections 114 and 315 of the FACT Act amendment enacted in 2005. This single law affects as many as 80% of all organizations in the U.S, regardless of the size or nature of the organization. In short it requires all organizations that maintain “covered accounts” to take steps to detect and flag account discrepancies, and to follow up the discrepancies. What is a covered account? The final rules require each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program (Program) for combating identity theft in connection with new and existing accounts. This is aimed at detecting fraud while protecting the institution from losses and the account holders who may be the victim of fraud. Financial institutions such as banks, credit unions and savings organizations are currently focusing on the data mismatch mechanisms they need to deploy, but the other requirements regarding the adoption of sensitive information policy, the hands on training on that policy, full documentation of the training process, and compliance oversight of contractors and service providers are not generally given the same attention. Still, as I go about my business of speaking with executives about these laws I still see a great deal of resistance and denial. Some business owners either don’t think they are liable or even affected mainly I believe, because they haven’t heard of these laws or, perhaps out of ignorance resist rather than to learn, again mainly in my opinion, because they haven’t heard of the laws.
What do we do? How can we inform the business and public sector employers that not only do these laws exist but also that the penalties of non-compliance can be devastating both from a financial risk and public relations risk standpoint. As with anything education is the key. First educating the business community on the responsibilities they share and the risks involved in not facing them. It’s important for them to understand why it is in their best interest to take pro-active steps. For the business owner this should really boil down to a question of economics, the price to do it as compared to the price of not doing it. With only 6% of all business reporting that they can be reasonably certain that they have not had breach issues the odds are against those who opt for the latter choice. In fact as more surveys and studies go forward it is shown that the incidents of data breach have been greatly underreported in the past several years. Secondly, and returning to my opening statement, education of the public for it is their information that is at risk. Every compliance program whether it is for sexual harassment, safety, or any number of industry specific reasons has at its’ center an education component. There is little point in enacting policy and procedures if the staff charged with implementing them is untrained and unaware of the implications. Identity theft is no different. An inadvertent email attachment containing sensitive information carries the same liability as an intentional breach or criminal theft. Loss or misuse of information is the issue. The liabilities and risks are identical regardless of the nature of the loss. It is worth noting here that I advocate an inclusive approach to this issue. Simple “checklist compliance” is not an adequate substitute for a holistic protection philosophy. The Federal Trade Commission calls this approach a “culture of security”. Well put. The employee is the person handling the information. Empowering the employee with the knowledge of the risk and the importance of following guidelines is essential to any prevention program.
Next is the assistance for the victim. Every company needs to have a plan in place detailing the company response plan to a breach of information. Containment, forensics, notification to potential victims are steps that need to take place immediately. This affirmative response can potentially turn a rather nasty event into a public relations victory if handled properly. Just recently Harvard University found a breach of faculty and student records had occurred. Harvard had a breach response plan in effect. The plan was triggered into effect within 30 minutes resulting in quick containment of the hacked servers and immediate notification of all potentially affected individuals.
The very next thing to consider is providing the victims with a reputable restoration service that will truly work on behalf of the victim in advocating for them and representing them in getting their data integrity restored. It is in the very best interest for any company to have the offering of such a service in place for all staff and employees before a breach occurs. This serves the company in two distinct ways. First, if an employee suffers from ID theft from an external source the service will assist them with the restoration process while they are more on task at work and not dealing with outside personal issues during business hours. The average time a victim spends in restoring their good name is 600 hours or 15 work/weeks! Secondly, for the business that does encounter an internal breach of employee data, the business will be able to show it has offered a mitigating service prior to the breach. We have all seen the news articles about companies that after experiencing a breach offer a “year of credit monitoring”. That can be very expensive and ineffective considering the time lag for identity theft crimes to show up. Making such services available as an employee option before a breach can cost the employer nothing and provide the employee with an ongoing protection. This kind of benefit can also be very effective in attracting key personnel.
I feel that it is imperative to find as many ways to increase the employer and business owner awareness of this in a way that it cannot escape the radar. Again, the liability is there regardless of a business’ decision to be compliant or not. The laws are very clear on that point. And if a business has done an effective job they can greatly reduce the chance of having a breach in the first place. While nothing will eliminate the liability all companies face, compliance will greatly reduce risk from damages and law suits.. I should also mention the competitive edge that can be gained in attracting new business by publicly demonstrating the steps the company has taken to protect the information it uses.
At this writing near the first of May we have almost exactly six months for every business in the country to be in compliance. That is not much time. At this point the legal community is mostly in the dark as well so that when the client seeks counsel about this issue the attorney is not up to speed on the regulations. It is just as important to bring the legal community into this is as is the private and public business sector. What if every employer signed on to the awareness concept regardless of compliance? Could that result in a culture of security within the business community? I’ve often heard it said that knowledge is power. I would rephrase that to say that putting knowledge to action is the power. Here’s to a well informed business community!
The author is a Certified Identity Theft Risk Management Specialist engaged in assisting business to be compliant with the identity theft and consumer protection laws and bringing identity theft training to employee groups.. He is an Independent Associate with Pre-Paid Legal Services Inc. of Ada Oklahoma and has written numerous articles on identity theft and business liabilities and risks associated with data loss.2008 John Taylor jtaylor05@prepaidlegal.com
April 2008
We haven’t come close to over-informing the public on the subject of identity theft if that were even possible. In the training seminars I give on identity theft my biggest emphasis is on the true scope of the set of crimes called identity theft. If we were to believe the ads on TV and the offers of free services by the banks we could easily conclude that this is one crime on the run and will soon be eradicated. After all they say that its’ only a financial crime, right? If that were the case why then is identity theft still the fastest growing crime in the world? Upwards of 300 million records have gone missing or stolen in the past three years in the U.S. alone. And only a fraction of the reported victim cases are related to our finances. Our medical records, drivers license numbers, public records in our county offices, and literally hundreds of databases have sensitive information on us that if aggregated can take on many different forms of identity theft. Thieves and data sellers are finding new and easier ways to data mine, for all forms of our personal information for a wide variety of reasons. Where does the majority of this theft occur? Companies and aggregators of personal non-public information are the source of nearly all identity theft. I read in the April 25th NY Times that the newest trend in debt collection is outsourcing to companies in India. That adds another layer where data theft will most likely occur.
This brings me to the topic of this article. There have been several laws on the books for years now that are designed to protect individuals from having their personal information compromised by an organization entrusted with the information. Federal legislation, HIPAA, FACTA, the FCRA, GLB Safety Act, even S-Ox and other state level whistle-blower laws are in place to provide the language to all organizations as to how data should be safeguarded. There are regular seminars put on by corporate Privacy Chiefs, IT Managers, Risk Managers and software developers across the country that create consortium and industry practices. Our U.S. Secret Service, charged with investigating identity fraud provides mountains of data to the FTC so that patterns and methods might be established in order to catch the thieves in action. In 2006 a Task Force was created by the President to codify and identify identity theft crimes and their impact on government record keeping. The office of OMB issued a memo last year providing stringent requirements for all federal agencies to comply with the findings of the Task Force. The FTC has issued guidelines for business with clear recommendations as to how they can implement an identity theft prevention and response program. Business has largely ignored these recommendations, and generally seems reluctant to admit there is a problem despite the massive press coverage of identity theft. This is evident in the number of breaches that occur on an almost daily basis. Even with 39 individual state breach reporting laws in place incidents of data loss go unreported due to loopholes in those rules. Why is that?
What could possibly stop a company from notifying its clients or employees that their information might have been compromised?
There are several reasons that I can conclude from that phenomenon. First, and I think foremost is that if a breach is made public then the fear of a bad public perception of the company and its’ practices is dominant, and not without some reason in fact. A study commissioned by CIO Magazine shows that when a breach occurs on average 40% of the client base will cease its’ relationship taking their business elsewhere, and 10% will engage counsel in actions against the company. The second reason I believe is that a lot of businesses would rather take the risk rather than to take a pro-active position. In other words, do nothing. Inaction is the leading cause of business failure for any reason.
You can’t leave out that insurance rates and credit worthiness are also at stake but that relates to reason number one above. No business wants to have rising costs. And thirdly, there are still a significant number of business owners that don’t believe that this is a serious issue, believing instead that a lot of hyperbole is given to a subject that has little chance of actually happening. To those I would invite to speak with the roughly 10 million annual U.S. ID theft victims for their opinions. And of course there are the tens of millions of dollars in business fines, mandatory risk assessment audits, actual damage suffered by victims and other related costs. The figure for 2007 in total losses suffered by American business related to identity theft was over $48 billion.
Due to this “lack of enthusiasm” on the part of business in taking the FTC guidelines seriously the government has done what in my opinion should have been done long before. As is the case with HIPAA regulations it is now mandatory for most every organization in the country to be compliant with the laws that protect personal identifying and non-public information. The liability for loss is placed squarely on the shoulders of the organizations that maintain the data. Precedents have already been established issuing fines, criminal prosecution and allowing class actions to go forward. The new regulations also address the sharing of information with 3rd party service providers allowing that the liability follows the data. A business cannot absolve itself of responsibility simply by outsourcing certain functions such as HR or payroll, or even cleaning services that have access to offices during off hours. Compliance cannot be addressed with software alone, or contract language, or simply with firewalls, encryption, or any single-pronged approach. This is not simply an IT problem. Compliance is a multi-faceted procedure that needs to be designed to meet the needs of the particular organization and the data it keeps and uses. In other words there is no single compliance fix. As of January 1st of 2008 the so-called Red flag Rule went into effect that requires compliance prior to November 1st of this year. These new regulations are clear definitions of sections 114 and 315 of the FACT Act amendment enacted in 2005. This single law affects as many as 80% of all organizations in the U.S, regardless of the size or nature of the organization. In short it requires all organizations that maintain “covered accounts” to take steps to detect and flag account discrepancies, and to follow up the discrepancies. What is a covered account? The final rules require each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program (Program) for combating identity theft in connection with new and existing accounts. This is aimed at detecting fraud while protecting the institution from losses and the account holders who may be the victim of fraud. Financial institutions such as banks, credit unions and savings organizations are currently focusing on the data mismatch mechanisms they need to deploy, but the other requirements regarding the adoption of sensitive information policy, the hands on training on that policy, full documentation of the training process, and compliance oversight of contractors and service providers are not generally given the same attention. Still, as I go about my business of speaking with executives about these laws I still see a great deal of resistance and denial. Some business owners either don’t think they are liable or even affected mainly I believe, because they haven’t heard of these laws or, perhaps out of ignorance resist rather than to learn, again mainly in my opinion, because they haven’t heard of the laws.
What do we do? How can we inform the business and public sector employers that not only do these laws exist but also that the penalties of non-compliance can be devastating both from a financial risk and public relations risk standpoint. As with anything education is the key. First educating the business community on the responsibilities they share and the risks involved in not facing them. It’s important for them to understand why it is in their best interest to take pro-active steps. For the business owner this should really boil down to a question of economics, the price to do it as compared to the price of not doing it. With only 6% of all business reporting that they can be reasonably certain that they have not had breach issues the odds are against those who opt for the latter choice. In fact as more surveys and studies go forward it is shown that the incidents of data breach have been greatly underreported in the past several years. Secondly, and returning to my opening statement, education of the public for it is their information that is at risk. Every compliance program whether it is for sexual harassment, safety, or any number of industry specific reasons has at its’ center an education component. There is little point in enacting policy and procedures if the staff charged with implementing them is untrained and unaware of the implications. Identity theft is no different. An inadvertent email attachment containing sensitive information carries the same liability as an intentional breach or criminal theft. Loss or misuse of information is the issue. The liabilities and risks are identical regardless of the nature of the loss. It is worth noting here that I advocate an inclusive approach to this issue. Simple “checklist compliance” is not an adequate substitute for a holistic protection philosophy. The Federal Trade Commission calls this approach a “culture of security”. Well put. The employee is the person handling the information. Empowering the employee with the knowledge of the risk and the importance of following guidelines is essential to any prevention program.
Next is the assistance for the victim. Every company needs to have a plan in place detailing the company response plan to a breach of information. Containment, forensics, notification to potential victims are steps that need to take place immediately. This affirmative response can potentially turn a rather nasty event into a public relations victory if handled properly. Just recently Harvard University found a breach of faculty and student records had occurred. Harvard had a breach response plan in effect. The plan was triggered into effect within 30 minutes resulting in quick containment of the hacked servers and immediate notification of all potentially affected individuals.
The very next thing to consider is providing the victims with a reputable restoration service that will truly work on behalf of the victim in advocating for them and representing them in getting their data integrity restored. It is in the very best interest for any company to have the offering of such a service in place for all staff and employees before a breach occurs. This serves the company in two distinct ways. First, if an employee suffers from ID theft from an external source the service will assist them with the restoration process while they are more on task at work and not dealing with outside personal issues during business hours. The average time a victim spends in restoring their good name is 600 hours or 15 work/weeks! Secondly, for the business that does encounter an internal breach of employee data, the business will be able to show it has offered a mitigating service prior to the breach. We have all seen the news articles about companies that after experiencing a breach offer a “year of credit monitoring”. That can be very expensive and ineffective considering the time lag for identity theft crimes to show up. Making such services available as an employee option before a breach can cost the employer nothing and provide the employee with an ongoing protection. This kind of benefit can also be very effective in attracting key personnel.
I feel that it is imperative to find as many ways to increase the employer and business owner awareness of this in a way that it cannot escape the radar. Again, the liability is there regardless of a business’ decision to be compliant or not. The laws are very clear on that point. And if a business has done an effective job they can greatly reduce the chance of having a breach in the first place. While nothing will eliminate the liability all companies face, compliance will greatly reduce risk from damages and law suits.. I should also mention the competitive edge that can be gained in attracting new business by publicly demonstrating the steps the company has taken to protect the information it uses.
At this writing near the first of May we have almost exactly six months for every business in the country to be in compliance. That is not much time. At this point the legal community is mostly in the dark as well so that when the client seeks counsel about this issue the attorney is not up to speed on the regulations. It is just as important to bring the legal community into this is as is the private and public business sector. What if every employer signed on to the awareness concept regardless of compliance? Could that result in a culture of security within the business community? I’ve often heard it said that knowledge is power. I would rephrase that to say that putting knowledge to action is the power. Here’s to a well informed business community!
The author is a Certified Identity Theft Risk Management Specialist engaged in assisting business to be compliant with the identity theft and consumer protection laws and bringing identity theft training to employee groups.. He is an Independent Associate with Pre-Paid Legal Services Inc. of Ada Oklahoma and has written numerous articles on identity theft and business liabilities and risks associated with data loss.2008 John Taylor jtaylor05@prepaidlegal.com
Subscribe to:
Posts (Atom)
