Here is one of the questions we get asked most often: “Ok, so we’ve had a real data breach and you say we have clear notification obligations, what can happen if we just ignore it and pretend it never happened — that is, we just don’t notify?” Unfortunately, this question is oftentimes coupled with this … Continue reading What Can Happen if You Do Not Notify Following a Data Breach?
Uber's Chief Information Security Officer (CISO), John Flynn, made a case for a uniform national data breach notification law in his testimony to members of Congress (see penultimate paragraph of full written testimony): I would like to conclude by stating that we strongly support a unified, national approach to data security and breach standards. We are … Continue reading Uber’s CISO Makes Case for Uniform National Data Breach Notification Law
The push for a single uniform national data breach notification law gained strength in the wake of the Equifax breach. Now proposed legislation in North Carolina would amend its law in a way that would add momentum to this push. And, now South Dakota is tired of being one of only two states without a … Continue reading State data breach notification law mishmash would get worse with proposed NC and SD legislation — is instant notification by clairvoyant next?
In the wake of the Equifax and Securities and Exchange Commission's data breach disclosures, there has been a lot of public outcry over the assertion that it took too long to disclose these data breaches to the public. "Too long" is a relative term, to start with, as I have little doubt that some people will … Continue reading Why do data breach disclosures often take too long? Let’s ask the SEC Chairman.
Delaware recently amended its data breach notification law to include the following requirements:Expanded definition of "personal information" to include biometric data, medical information, passport numbers, routing numbers for accounts, individual taxpayer identification numbers and usernames in addition to the traditional forms of PII such as birth date and social security numbers.Notice to affected individuals within … Continue reading Key Points of Delaware’s New Data Breach Notification Law