Three More States Add Laws on Data Breaches
Computerworld - Companies struggling to keep up with a patchwork of state laws related to data privacy and information security have three more to contend with, as a result of new security-breach notification laws that went into effect in Illinois, Louisiana and New Jersey on Jan. 1.
Like existing statutes in more than 20 other states, the new laws prescribe various actions that companies are required to take in the event of a security breach involving the compromise of personal data about their customers.
For instance, New Jersey's Identity Theft Prevention Act requires businesses to destroy all customer data that's no longer needed and to notify consumers when sensitive data about them has been accessed by an unauthorized person. The law also limits the use of Social Security numbers on all items that are sent via postal mail.
Louisiana's Database Security Breach Notification Law requires entities that collect information on the state's residents to notify affected individuals of security breaches involving their confidential data. Government officials also need to be notified, according to the law. Illinois' Personal Information Protection Act is similar, although it doesn't require companies to inform the state government when breaches occur.
For companies that do business nationally or in various states, the smorgasbord of state laws poses a growing problem, because the measures often specify different triggers for notifications and set varying requirements on what needs to be disclosed, to whom and when, said Kirk Herath, chief privacy officer at Nationwide Mutual Insurance Co. in Columbus, Ohio.
In addition, some states require companies to provide credit-monitoring services to affected customers, whereas others don't, Herath said. And not all of the states offer safe-harbor provisions that exempt companies that encrypt data from their laws, he said.
"What I would prefer to see is something that would be uniform and preemptive [of state laws]," Herath said. "Otherwise, you have a very inconsistent application of the law, with some states requiring you to do nothing [and] some hammering you to the point of being unfair."
"We're hoping a federal law will help clarify the situation," said the director of information security at a specialty retail chain based in California.
Until that comes to pass, the retailer plans to continue to use the SB 1386 breach-disclosure law that went into effect in California more than two years ago as a "baseline" for developing its security incident response and notification strategy, said the director, who asked not to be identified.
The retail chain also plans to develop an information grid that will help it quickly go through a checklist of requirements
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts