2015 ROBINS KAPLANLLP TOOLS, TIPS, AND TRENDS: DATA PRIVACY AND CYBERSECURITY

Transcription

1 TOOLS, TIPS, AND TRENDS: DATA PRIVACY AND CYBERSECURITY

2 PANEL MEMBERS Stacy Bettison, Founder and President, BETTISON Candice Ciresi, Head of Stratasys US Legal and Legal Counsel to SSYS, Inc and LATAM at Stratasys Lisa Lentini, Vice President Global Compliance, Carlson Wagonlit Lou Stephens, Special Agent in Charge, Secret Service Minneapolis Office Anne Lockner, Moderator, Robins Kaplan LLP

3 KEY CASES TO WATCH FTC v. Wyndham Worldwide (3 rd Cir.) Remijas v. Nieman Marcus Group, LLC (7 th Cir.) Spokeo v. Robins (pending before SCOTUS)

4 FTC V. WYNDHAM

5 FTC V. WYNDHAM Facts Wyndham was breached three separate times in Flawed cybersecurity measures: Payment-card information held in clear readable text Easily-used passwords No firewalls to limit access between systems Allowed connections to network without requiring security updates, and that allowed default user ID and passwords Didn t adequately restrict access of third-party vendors to its network and the servers of its Wyndham-branded hotels Failed to employ reasonable measures to detect and prevent unauthorized access Did not follow proper incident response procedures, including failing to monitor for same malware used in previous attacks

6 FTC V. WYNDHAM The District Court denied Wyndham s motion to dismiss, but certified issue of whether FTC Act reached cybersecurity to the Third Circuit Third Circuit AFFIRMED

7 FTC V. WYNDHAM Questions before the Third Circuit: (1) Whether the FTC has authority to regulate cybersecurity under the unfairness prong of 45(a); and (2) if so, whether Wyndham had fair notice that its specific cybersecurity practices could fall short of that provision. The Court ultimately answered both of these questions in the affirmative.

8 FTC V. WYNDHAM Whether the FTC has authority to regulate cybersecurity under the unfairness prong of 45(a)? The Court held that because the FTC was not interpreting its own rules (where the court would defer to the FTC s interpretation), it was up to the Court to decide what the FTC Act means. And here, the Court held that 45(a) encompasses cybersecurity.

9 FTC V. WYNDHAM Whether Wyndham had fair notice that specific cybersecurity practices could fall short of 45(a)? It was up to the Court to interpret the Act, and not an example of the Court interpreting the FTC s interpretation of its own rules. In sum, the Court held that The relevant question is not whether Wyndham had fair notice of the FTC s interpretation of the statute, but whether Wyndham had fair notice of what the statute itself requires. Wyndham was not entitled to know with ascertainable certainty the FTC s interpretation of what cybersecurity practices are required by 45(a). Instead, the relevant question in this appeal is whether Wyndham had fair notice that its conduct could fall within the meaning of the statute. Wyndham is only entitled to notice of the meaning of the statute and not to the agency s interpretation of the statute.

10 REMIJAS V. NIEMAN MARCUS Facts Neiman Marcus breached between July-October 2013 Learned that fraudulent charges had appeared on customers credit cards in December 2013 Discovered malware on January 1, days later, disclosed data breach 92,000 of 350,000 stolen card numbers were used fraudulently Neiman Marcus offered 1 year of free credit monitoring/theft protection

11 REMIJAS V. NIEMAN MARCUS Complaint allegations Consolidated class-action complaint Theories: negligence, breach of implied contract, unjust enrichment, unfair and deceptive trade practices, invasion of privacy, violations of state data breach laws Alleged injuries: Lost time and money resolving fraud charges Lost time and money protecting against future identity theft Financial loss of buying items at Neiman Marcus that would not have been purchased had they known of careless cybersecurity practices Lost control over value of their personal information District Court granted Neiman Marcus motion to dismiss

12 REMIJAS V. NIEMAN MARCUS Seventh Circuit REVERSED Analyzed case under Amnesty International v. Clapper Allegations of future harm meets Article III standing if harm is certainly impending Allegations of possible future injury are not sufficient Resolving fraudulent charges confers standing Distinguished from Clapper where it was unclear whether the government had captured Amnesty Int l s communications Here, there is no dispute that the plaintiffs data was taken Thus, plaintiffs have shown a substantial risk of harm Protecting against future identify theft (with mitigation expenses such as credit monitoring) confers standing Neiman Marcus offer of 1-year credit monitoring shows that risk is real Court expressed doubt about other injuries, but did not reach them

13 REMIJAS V. NIEMAN MARCUS Thus, injury-in-fact is met But also must show causation and redressability Neiman Marcus raises a Summers v. Tice defense for causation Court holds that has nothing to do with standing Neiman Marcus argues that plaintiffs were reimbursed for fraud charges Court holds it is not true for mitigation expenses or future injuries Zero liability policies of some payment cards is a business practice, not a federal requirement As a result, a favorable decision could redress injuries En banc petition denied on Sept. 17, 2015

14 SPOKEO V. ROBINS Fair Credit Reporting Act case Question before the Supreme Court: Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute. Set to be heard on November 2, 2015

15 SPOKEO V. ROBINS Will have a large impact on class-action cases under statutes that have statutory penalties for actions that often have no injury, including: Telephone Consumer Protection Act Video Privacy Protection Act Truth in Lending Act Fair Debt Collection Practices Act ERISA Lanham Act

16 HAS YOUR COMPANY HAD A DATA BREACH/CYBER INCIDENT IN THE PAST 3 YEARS? A. Yes B. No C. I don t know. 0% 0% 0% Yes No I don t know.

17 DOES YOUR COMPANY HAVE AN INCIDENT RESPONSE PLAN IN PLACE? A. Yes B. No C. I don t know. 0% 0% 0% Yes No I don t know.

18 HAS YOUR COMPANY CONDUCTED AN AUDIT OR TEST OF THAT PLAN? A. Yes B. No C. I don t know. 0% 0% 0% Yes No I don t know.

19 DOES YOUR COMPANY PARTICIPATE IN AN ISAC? A. Yes B. No C. I don t know. D. I don t know what an ISAC is. 0% 0% 0% 0% Yes No I don t know. I don t know what an ISAC...

20 WHAT PERCENTAGE OF THOSE SURVEYED IN THE 2015 US STATE OF CYBERSECURITY SURVEY SAID THEY HAD DETECTED A SECURITY INCIDENT IN THE PAST 12 MONTHS? A. 37% B. 71% C. 79% D. 98% 0% 0% 0% 0% 37% 71% 79% 98%

21 HOW MANY SURVEY RESPONDENTS WERE VICTIMS OF RANSOMWARE IN 2014? A. 9% B. 13% C. 15% D. 16% 0% 0% 0% 0% 9% 13% 15% 16%

22 Q&A

23 2015 ROBINS KAPLAN LLP