 EMERGING TRENDS TOWARDS MANDATORY REPORTING OF DATA BREACHES
The implications of data protection law have been recently propelled into the public domain with the steady increase in the volume of reported high profile data breaches and security incidents. While these breaches have been well publicised, timely notification to customers whose data has been compromised lacks clarity as it is tied up in a wide range of rules and regulations which are further complicated by the multi-national diversity of affected customer groups. This paper looks at breach reporting law in different regions of the world and identifies an emerging directive towards a new mandatory reporting regime.
The current movement by regulators towards mandatory reporting legislation will obligate data controllers to notify data subjects when their personal data has been leaked. In particular, the EU and US appear to be pushing this agenda as a priority data protection initiative. The US has had some mandate for reporting in place with new standardised legislation in discussion. However until mandatory reporting legislation is in place, the extent of data breaches will not be fully realised and lack of enforcement and penalties will only to serve to accelerate breach incidents and insufficient security measures. Given the general reluctance by businesses to adequately secure and protect client personal and sensitive data, the introduction of mandatory reporting and legal sanctions are believed to be the necessary catalyst to enforce best practice security procedures.
EU TRENDS
A growing number of EU and European Economic Area (EEA) countries are developing rules on data breach notification, however there is currently no general breach notification requirement in Directive 95/46/EC on data protection (Data Protection Directive). Some countries have adopted statutory laws that oblige organisations to report data breaches and in other states voluntary guidance issued by the data protection authorities exists.
In its ongoing review of the European data protection framework, the European Commission published a communication outlining among other things, its intention to introduce a general data breach notification obligation (A comprehensive approach on personal data protection in the European Union COM(2010) 609 final, 4 November 2010). It didn’t however specify the scope of this obligation, in particular who should be notified and the criteria that would trigger the notification obligation.
In the absence of explicit legislation, approaches to data breach notification vary within member states. Countries including Austria, Norway, Germany & Spain have implemented mandatory breach notification, where organisations are obliged to report and notify data breaches across public and private sectors. Voluntary reporting currently operates within Denmark, Ireland and UK where an assortment of different criteria, guidance and reporting procedures exist. Since April 2010, the UK’s Information Commissioner's Office (ICO) within the UK Data Protection Act, has had the authority to impose monetary penalties of up to GB£500,000 and since April 2010, the ICO has imposed fines on four occasions to the value of £240,000.
Generally, all EU institutions support mandatory breach notification applying to all sectors. The Commission is expected to present its proposal to the European Parliament and the Council of the EU in 2011 which will agree on the final text in the co-legislation procedure (Article 16, Treaty on the Functioning of the European Union [2008] OJ C 115/47). Once the legislation is published the directive will be proposed and implemented accordingly.
The EU has recently implemented new amendments to Directive 2002/58/EC on the protection of privacy in the electronic communications sector (Privacy and Electronic Communications Directive), which introduced breach notification rules for internet service and Telecoms providers. The rules require that operators secure personal data properly and inform their customers and data protection authorities promptly when personal data is lost or breached. Data breach disclosure and mandatory reporting procedures have yet to be interpreted by individual member states who must transpose the directive into internal law.
The directive is leaning towards a mandatory reporting regime for all data loss breach incidents with the EU currently seeking to widen scope of data protection laws. Speaking recently, the EU’s Justice Commissioner Viviane Reding stated that recent data protection changes would ensure that all businesses take data protection seriously with an intention to introduce a mandatory requirement to notify data security breaches across all sectors including banking and financial services. This latest move serves to incentivise businesses to conduct serous risk assessments to protect personal data and to implement appropriate security measures protecting the confidentiality, integrity and availability of personal data. Reding explained that the Commission’s proposals to change data protection legislation would be revealed in the coming months and that she would meet with individual ministers to discuss the plans. ‘We have consulted widely on this major reform and we’ve taken into account many suggestions and concerns of experts and stakeholders’ she added.
US TRENDS
In the US, more than 45 states have enacted laws imposing notification obligations on data security breach. In general, state security breach notification laws are understood to be modelled on the California Security Breach Notification Act which came into force in July 2007 and made it compulsory to provide notification of security breaches to consumers affected by the breach. Affected individuals must be notified as soon as possible, but the law does not require notification to any administrative authority. Most other US states require organizations to notify individuals of a breach. Several states also impose notification obligations in case of a risk of harm to an individual, such as identity theft. Only a few states require notification to the relevant authorities resulting in a mishmash of data breach laws across the country.
One piece of legislation being introduced The Data Security and Breach Notification Act 2011 by Senator Patrick Leahy and co-sponsored by Senator Charles Schumer and Ben Cardin would mandate organizations that possess personal information to put in place "reasonable" security procedures to keep that data secure. Should the organization endure a breach, those affected would have to be notified. The move towards mandatory reporting within the US is also gaining momentum with a recent announcement of new draft legislation by Congress. Senator Mary Bono Mack, Chairman of the House Subcommittee on Commerce Manufacturing and Trade has released a discussion document of the Secure and Fortify Data Act (SAFE Data Act) which will also see companies provide a basic level of protection for consumers' personal information and government notification when data is stolen.
This new legislation comes in the backdrop of enormous, high profile data breaches in multinational companies like Sony and Epsilon in recent months. Under the new bill companies will have to dispose of old or unnecessary data as well as notify the government within 48 hours of discovering a breach, unless the breach is an accident. . The legislation will also grant the Federal Trade Commissioner limited authority over data protection in non profitable organizations ie. universities and charities.
OTHER GLOBAL PRACTICE
In Australia, the introduction of mandatory breach notification is being considered, however the government has not yet proposed the relevant amendments. In place of any legislation, voluntary guidance issued by the Office of the Privacy Commissioner of Australia applies however there is no clarity on what specific data elements are covered. These guidelines largely resemble those of new voluntary breach notification guidelines issued by the New Zealand Privacy Commissioner in February 2008 which apply to private sector organisations and recommend that individuals should be notified, as soon as reasonably possible, when there is a foreseeable risk of harm.
In Japan, two models exist, depending on the authority to which the breach must be notified. Under the revised Financial Services Agency's guidelines, applicable to financial services providers only, breach notification is mandatory while in contrast, under the Ministry of Economy, Trade and Industry's guidelines notification is recommended however not mandatory. Notification is not expected when the rights and interests of the individuals have not been or are not likely to be infringed by the breach, for example, when data was recovered immediately or when advanced encryption was used.
FRAGMENTED POLICIES
Within this challenging ‘mixed bag’ framework of varied legislative rules and regulations, the consequences for organizations operating in the marketplace are fragmented and this lack of cohesion can result in insufficient procedures with significant cost implications for organizations. In particular, global multinationals face the task of operating in multiple jurisdictions and must ensure necessary compliance within numerous regulatory markets. In a situation where an organisation might facing legal redress yet not a regulatory fine, while facing the latter elsewhere, the rules can be confusing and counterproductive. Regardless of geographical constraints and rules, organizations must take appropriate security measures to protect their customers’ personal data.
Businesses often struggle to implement proper policies and controls that are required to prepare for and mitigate the legal, regulatory and financial risks associated with a security failure – both before and after a data breach occurs. In addition, many organizations ignore the more long-term intangible costs that data breach creates including damage to corporate reputation, brand integrity, customer loyalty and decline in share value.
UNIFIED SOLUTIONS
In order to be prepared for mandatory reporting it is essential to have a full and comprehensive understanding of where all critical and company sensitive information resides on the corporate network. Data discovery is a fundamental factor in risk mitigation and a control in assessing governance and compliance capabilities. By implementing data auditing software, unsecured and sensitive information can be regularly and efficiently analysed to classify, discover and report on where critical information resides, enabling users to identify and proactively react to vulnerabilities.
PixAlert’s Critical Data Auditor is an enterprise ready, scalable solution which helps empower management through clear visibility of important data combined with meaningful and actionable results, helping protect against data loss while improving compliance and safeguarding corporate reputation.
CONCLUSION
In today’s evolving regulatory global environment, it is vital for organizations to have effective data protection measures in place. If a company is seen as being unable to protect client data, the immediate and long term consequences can be harmful and difficult to dispel. The imminent introduction of new mandatory reporting laws will require businesses to put further data security controls in place in order to ensure they are aware of where critical, company sensitive data is stored. Mandatory reporting will help bring about more clarity to the amount of data being lost and improve efforts to prevent breaches. With its eventuality clearly on the horizon, businesses need to address data protection seriously and proactively prepare and ensure that sufficient security structures and controls exist.
The rising risk and cost of data breach can be effectively managed - through implementing data security software and policies, organizations can significantly mitigate risk, gain content visibility of critical and exposed data and ultimately take full control of their corporate data and IT assets.
ABOUT PIXALERT
PixAlert deploy world-class scalable information audit solutions which enable organizations to discover where sensitive data and inappropriate images reside across networks. PixAlert’s enterprise content audit solutions and managed services help to safeguard brand integrity and reputation through its market leading data discovery and illicit image detection and security software products.
PixAlert is an Irish technology company who have been protecting corporate reputation and brand integrity of financial, healthcare, pharma and public sector organizations since 1999 through its innovative and advanced portfolio of critical data and image protection solutions. The company currently has a client base of over 200 companies covering EMEA, AsiaPAC and the US territories. PixAlert is based in Dublin, Ireland and has sales offices in the UK, US, Australia and New Zealand.
DISCLAIMER NOTICE
Statements and opinions expressed within PixAlert articles, blogs and other materials herein are those of the authors, editors and publishers. While every care has been taken in the compilation of this information and every attempt made to present accurate information, we cannot guarantee that inaccuracies will not occur. PixAlert will not be held responsible for any claim, loss, damage or inconvenience caused as a result of any information within these pages or any information accessed through our website.
The content of any organisations websites which you link to from articles are entirely out of the control of PixAlert and you proceed at your own risk. These links are provided purely for your convenience. They do not imply PixAlert’s endorsement or association with any products, services, content, information or materials offered by or accessible to you at the organisations site. All copyright and trade marks accessible via the links from PixAlert are owned by the respective website owners, or their licensors.
|
Become A Fan On Facebook
Join Our Network On LinkedIn
Follow Us On Twitter
Watch Our Videos On YouTube
