Data Breach Reporting: Summary of Governing Bodies with Reporting Requirements in the United States

Transcription

1 Data Breach Reporting: Summary of Governing Bodies with Reporting Requirements in the United States Introduction When it comes to Personally Identifiable Information (PII), privacy laws and regulations are constantly changing and complex. In the United States and around the globe, new requirements are making their way through legislative processes to become law. Additionally, evolving court rulings and consent decrees continue to change the regulating landscape. Currently, there are nine United States federal privacy laws with fourteen federal regulations spanning a variety of governmental agencies such as the Federal Trade Commission (FTC), Securities Exchange Commission (SEC), Federal Communications Commission (FCC), Internal Revenue Service (IRS), Food and Drug Administration (FDA), Federal Financial Institutions Examination Council (FFIEC), Department of Homeland Security (DHS) and Office of Federal Housing Enterprise Oversight (OFHEO). Federal regulations governing data disposal, authentication requirements and data breach reporting, have been created by the IRS, FCC, SEC, Electronic Commerce Research Applications (ECRA), Gramm- Leach-Bliley Act (GLBA), USA Patriot Act, ACH Operating Rules, the United Nations Convention on the use of electronic communications and state credit freeze laws. Additionally, a variety of federal court decisions ranging from TJ Maxx litigation to United States v. ChoicePoint, Inc. and multiple FTC administrative decisions and consent decrees all shape the scope of responsibilities for businesses, entities, employers and non-profits. Companies engaged in business-to-consumer transactions are regulated under consumer protection laws. Forty-six states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information. For example, seven states have their own privacy laws and nineteen have data disposal laws. To add to the complexity, states have their own regulations and consent decrees. Moreover, companies doing business internationally have yet another layer of responsibility to add to their diligence. Federal Privacy Laws Affecting Merchants Here s a look at the current roster of federal privacy legislation affecting employers, businesses, nonprofits and any organization handling personal data: 1. GLBA - Gramm-Leach-Bliley Act, Public L , Sections 501 and 505(b), 15 U.S.C. Sections 6801, GLBA regulates the privacy of personally identifiable, nonpublic financial information disclosed to non-affiliated third parties by financial institutions. The Act requires administrative, technical and physical safeguards to protect the security and privacy of information and authorizes the states to pass consumer privacy protections that are stronger

2 than those contained in the Act. GLBA is aimed at financial intuitions, but the FTC has extended its application to other industries. While a company is not a financial institution, it is likely that the FTC would use GLBA requirements to measure the effectiveness of a company s Information Security Policy. 2. HIPAA: Health Insurance Portability and Accountability Act, 42 U.S.C. 1320d-2 and 1320d Sarbanes-Oxley Act: Pub. L , Sections 302 and 404, 15 U.S.C. Sections 7241 and FCRA/FACTA - Fair Credit Reporting Act. 5. HIPAA: Health Insurance Portability and Accountability Act, 42 U.S.C. 1320d-2 and 1320d Sarbanes-Oxley Act: Pub. L , Sections 302 and 404, 15 U.S.C. Sections 7241 and COPPA - Children s Online Privacy Protection Act of 1998, 15 U.S.C et seq. 8. E-SIGN - Electronic Signatures in Global and National Commerce Act, 15 U.S. 7001(d). 9. FISMA - Federal Information Security Management Act of 2002, 44 U.S.C. Sections Homeland Security Act of 2002: 44 U.S.C. Section 3532(b)(1). 11. Privacy Act of 1974: 5 U.S.C. Section 552a. Breach Reporting Requirements Here s a look at some of the various requirements that must be examined and constantly updated: 1. Notification to State Attorneys General of Data Breach Alaska: Notification Obligation - Any Entity to which the statute applies shall disclose the breach to each Alaska resident whose PII was subject to the breach after discovering or being notified of the breach. Notification is not required if, after an appropriate investigation and after written notification to the state attorney general, the entity determines that there is not a reasonable likelihood that harm to the consumers whose PI has been acquired has resulted or will result from the breach. The determination shall be documented in writing and the documentation shall be maintained for five years. Hawaii: Attorney General/Agency Notification - If more than 1,000 persons are notified at one time under this section, the business shall notify the State of Hawaii s Office of Consumer Protection of the timing, content, and distribution of the notice. Louisiana: Attorney General Notification - When notice to Louisiana citizens is required by the statute, the entity shall provide written notice detailing the breach of the security of the system to the Consumer Protection Section of the Attorney General s Office. Notice shall include the names of all Louisiana citizens affected by the breach. Notice to the state AG shall be timely if received within 10 days of distribution of notice to Louisiana citizens. Each day notice is not received by the state Attorney General shall be deemed a separate violation. Maine: Attorney General/State Agency Notification - When notice of a breach of the security of the system is required, the entity shall notify the appropriate state regulators within the Department of

3 Professional and Financial Regulation. If the entity is not regulated by the Department of Professional and Financial Regulation, the entity shall notify the state Attorney General. Massachusetts: Attorney General/State Agency Notification - Notice must be provided to the state Attorney General and the Director of Consumer Affairs and Business Regulation. Upon receipt of notice, the Director of Consumer Affairs and Business Regulation shall identify any relevant consumer reporting agency or state agency, and forward the names of the identified consumer reporting agencies and state agencies to the notifying entity. The entity shall, as soon as practicable and without unreasonable delay, also provide notice to consumer reporting agencies and state agencies identified by the Director of Consumer Affairs and Business Regulation. Missouri: Attorney General Notification - In the event an entity provides notice to more than 1,000 consumers at one time pursuant to this section, the entity shall notify, without unreasonable delay, the state Attorney General s office of the timing, distribution, and content of the notice. New Hampshire: Attorney General/Regulator Notification - An entity engaged in trade or commerce that is subject to N.H. Rev. Stat. 358-A:3(I) (trade or commerce that is subject to the jurisdiction of the bank commissioner, the director of securities regulation, the insurance commissioner, the public utilities commission, the financial institutions and insurance regulators of other states, or federal banking or securities regulators who possess the authority to regulate unfair or deceptive trade practices) shall also notify the regulator which has primary regulatory authority over such trade or commerce. All other entities shall notify the state Attorney General. The notice shall include the anticipated date of the notice to the individuals and the approximate number of individuals in New Hampshire who will be notified. New Jersey: Attorney General/Police Notification - Any entity required under this section to disclose a breach of security of a customer s personal information shall, prior to disclosure to the customer, report the breach of security and any information pertaining to the breach to the Division of State Police in the Department of Law and Public Safety for investigation or handling, which may include dissemination or referral to other appropriate law enforcement entities. New York: Attorney General/Agency Notification - If any New York residents are to be notified, the entity shall notify the state Attorney General, the consumer protection board, and the state Office of Cyber Security and Critical Infrastructure Coordination as to the timing, content and distribution of the notices and approximate number of affected persons. The state Attorney General s website has a form to be used for notifications. North Carolina: Attorney General Notification - In the event a business provides notice to an affected person pursuant to this section, the business shall notify without unreasonable delay the Consumer Protection Division of the state Attorney General s office of the nature of the breach, the number of consumers affected by the breach, steps taken to investigate the breach, steps taken to prevent a similar breach in the future, and information regarding the timing, distribution, and content of the notice. The Attorney General s website contains a form to be used for notification.

4 Vermont: Notification Obligation - Any entity to which the statute applies shall notify affected individuals residing in Vermont that there has been a security breach following discovery or notification to the entity of the breach. Notice of a security breach is not required if the entity establishes that misuse of personal information is not reasonably possible and the entity provides notice of the determination that the misuse of the personal information is not reasonably possible and a detailed explanation for said determination to the Vermont Attorney General or to the Department of Banking, Insurance, Securities, and Health Care Administration in the event that the entity is a person or entity licensed or registered with the Department. Virginia: Attorney General/Agency Notification - The state Attorney General must be notified whenever any Virginia residents are notified under the criteria above. In the event an entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the state Attorney General of the timing, distribution, and content of the notice. For health information, the entity must also notify the Commissioner of Health. 2. State Laws Requiring Reporting of Data Breaches to State Attorneys General State AK (1) CA (1) CT (2) FL (2) HI (2) IA (2) LA (1) ME (2) MD (2) MA (2) MO (2) NH (1) NJ (2) NY (1) NC (2) PA (1) SC (1) VT (2) VA (2) Attorney General (AG) Reporting Requirement Defined If any notifications are sent one (1) copy of same must be sent to AG prior to notification Require AG notification only if greater than 1000 notifications are being sent. Require AG notification independent of customer notification. Consultation with the AG and other authorities prior to notification of customer (and only if greater than 1000 notifications are being sent). Require AG notification independent of customer notification. Table Notes: 1. States with data breach laws requiring reporting to the state Attorney General ONLY if the breached company is licensed or conducts business in that state are denoted below with (1). 2. States with data breach laws requiring reporting to the state Attorney General REGARDLESS of where the breached company is licensed or does business are noted with (2).

5 3. Special State Reporting Requirements for Breaches Here are more examples of the difficulty in keeping up with the growing number of different state offices and departments that must be informed of data breaches: Maine Vermont New Hampshire New York Hawaii Virginia Massachusetts New Jersey California Connecticut Department of Professional and Financial Regulation Department of Banking, Insurance, Securities & Health Care Administration (BISHCA) CIO Department of Administration Consumer Protection Board Office of Consumer Protection Virginia Department of Health Office of Consumer Affairs and Business Regulation Division of State Police in the Department of Law and Public Safety State Department of Public Health State Insurance Commissioner 4. Notice to the Secretary of Health & Human Services (HHS) This form from the US Department of Health and Human Services is just one more example of breach reporting that must be done, and in this case, immediately. Again filing as required is meant to mitigate further penalties.

6 5. Breach Reporting to the US Secret Service Any of 24 different regional offices of the US Secret Service Electronic Crimes Task Force regional offices must be notified in the event of suspected or confirmed loss of personally identifiable data: Atlanta Dallas Miami Philadelphia Birmingham Houston Minnesota Pittsburgh Boston Kentucky New York San Francisco Charlotte Las Vegas Upstate New York Seattle Chicago Los Angeles Oklahoma South Carolina Cleveland Maryland Orlando Washington Metro 6. Card Brand Reporting Last, but certainly not least. In the event of loss or suspected loss of credit card information, all the affected payment card companies must be informed in timely fashion to mitigate further penalties. Visa Inc. MasterCard Worldwide American Express Company Discover Card

7 Conclusion Data breach reporting regulations are constantly changing and complex. The CSR Breach Reporting ToolKit solution relieves merchants of the time-consuming burden to ascertain which authorities at which governing bodies need to be informed. Time is of the essence to mitigate further penalties. CSR s team of Certified Information Privacy Professional (CIPP) experts keeps up with the latest changes to provide merchants with the most up-to-date services and greatest peace of mind.