another law or regulation; and (ii) has
a reasonable likelihood of materially
harming any material part of the normal
operations of the organization, as
promptly as possible but in no event
later than 72 hours from a determination.
There is no specific requirement to
notify affected individuals, but the NYS
data breach law still applies, as well as
federal laws such as the GLBA.
Must Do to Keep Their
Companies Safe
because of space constraints, we do not
address in detail every law that gives
rise to disclosure obligations (e.g.,
various international laws, the FTC
Health Breach Notification Rule, GLBA,
specific SEC rules, such as Regulation
S-P, to name several), which may apply
depending on the types of information
involved. Nonetheless, we can see that
the NYSDFS regulation is different, in
terms of applicable incidents, protected
information and notification time frame.
These differences follow a trend in
state breach laws. States are generally
expanding their PII definitions while
shrinking the notification time periods.
Corporate counsel must understand
all laws, regulations and obligations
(including contractual) that may apply to
their organization.
Trying to ignore these obligations,
before or after a breach, is not a viable
option. Regulators have begun fining
organizations for failing to notify in a
timely manner.
Corporate counsel must also help
their organizations draft their incident
response plans with these varying
laws in mind to ensure such plans are
legally compliant. We often see incident
response plans written by information
technology professionals, which, while
sometimes technologically robust, lack
consideration of the liability risks.
each of these and other
laws, the information
generator (controller) is
ultimately liable for any
breach or unauthorized
access/acquisition, even if
information is processed
by a third party vendor.
This risk can be mitigated
through the proper
contracts and insurance.
clearinghouses and health care
providers who electronically
transmit health information.
enforced by the Federal Trade
Commission (FTC) for vendors of
personal health records under the
HITECH Act.
of an organization's financial
performance. Form 8-K is the
form on which organizations report
the occurrence of significant
current corporate events.
attacker harvested personal
data belonging to "at least" 500
million users. Just three months
later, it admitted that some
employees were aware of it as
early as 2014, but waited years
before making a disclosure. This
issue is threatening to derail the
acquisition of Yahoo by Verizon,
which is reportedly seeking a $1
billion discount (or almost 20%)
of the deal price.
in September 2016, the NYSDFS
updated it on December 28, 2016,
after "carefully consider[ing]
comments submitted." This
updated draft will be subject
to an additional final 30-day
comment period, which means
that the regulation may change
again before this article is
published. For now, the effective
date is March 1, 2017.