Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

Lungren’s bill is one of a number of cybersecurity bills that have been proposed in the 112th Congress. Although news reports of cyber attacks by criminals, hactivists and foreign governments make headlines almost daily, none of the proposals has gotten as far as a floor vote. An administration-backed proposal by Senator Joseph Lieberman, S. 413, was the subject of a Senate committee hearing last May, but the bill hasn’t seen further action. S. 413 takes a regulatory approach that would entail the creation of a new federal cybersecurity entity empowered to adopt regulations covering certain private entities, and provide for civil penalties for noncompliance with cybersecurity requirements.

Lungren’s bill follows on the release of a report by the House Republican Cybersecurity Task Force in October that favors targeted and limited regulation, improved information sharing, and legal protections for sharing information.

A Voluntary Approach

The Lungren bill would create a National Cybersecurity Authority tasked with serving as a “focal point” for federal government cybersecurity efforts, including, among many other duties, the facilitation of cybersecurity information sharing among and between Federal and State agencies and local governments, the private sector, academia and international partners. From the government side, the Secretary of Homeland Security would be directed to share certain information concerning cybersecurity threats and mitigation efforts with Federal agencies, State and local government representatives and “appropriate critical infrastructure information systems owners and operators” (a defined category). The Authority would also be tasked with studying cybersecurity threats and risks, and compiling information about risk assessments and responses, among other things. But the bill confers no new regulatory authority.

National Information Sharing Organization Nonprofit

The Lundgren bill would also direct the creation of a cybersecurity nonprofit organization, a “National Information Sharing Organization,” that would facilitate the sharing of cybersecurity information provided by the private sector. One purpose of the proposed nonprofit would be to serve as a national clearinghouse for the exchange of cyber threat information between and among public and private entities. Designated Federal agencies would be required to participate in the nonprofit, but participation by other entities would be voluntary.

Like any nonprofit, a key element would be the composition of the Board of Directors. Significantly, the Board of the proposed NISO would be dominated by private sector representatives, and in particular, by commerce and industry representatives. The Board would include one representative of the Department of Homeland Security; four representatives from at least three different federal agencies with significant responsibility for cybersecurity; and ten representatives from the private sector, of whom  two would be from the “privacy and civil liberties community.” The remainder of the Board would consist of ten representatives of the following “critical infrastructure sectors and subsectors” – banking and finance; communications; defense industrial base; energy and electricity; energy, oil and natural gas; health care and public health; and information technology.

Rulemaking

The Board of Directors would have the power to establish a charter setting out rules for information-sharing, including the treatment and ownership of intellectual property provided by or to the organization; limitations on liability, and “consideration of any necessary measures to mitigate antitrust concerns.” The charter would also cover such topics as privacy and civil liberties protections, public transparency and oversight, and security requirements for the handling of information received from private and governmental sources.

Liability Protection

A key element of the Lundgren bill is its exemptions from existing laws, including a blanket exemption from antitrust laws, and detailed provisions protecting against the disclosure or use of information provided to the proposed NISO.

Information shared with or provided to the proposed NISO, or to a federal agency through the nonprofit, would be exempt from disclosure under the Freedom of Information Act. Further, information shared with the proposed NISO could not be shared with any other federal or state entity, or with any third party in any civil action, without the written consent of the person or entity submitting the information. Similarly, such information could not be shared with any officer or employee of the United States unless to further the investigation or prosecution of a criminal act or to disclose to an appropriate Congressional committee. The exemption also contains parallel provisions pertaining to state and local government.

Pros and Cons

Representative Lundgren held a hearing on the  the draft bill on December 6, 2011. The hearing  included testimony in support of the bill from Symantec Corp., and Prof. Gregory E. Shannon of Carnegie-Mellon’s CERT cybersecurity entity. Testimony from the Congressional Research Service discussed the precedents for, and pros and cons of, the type of quasi-government entity envisioned by the draft bill.

Also speaking in support of the draft bill was the Center for Democracy and Technology, although that organization’s support was tempered by several privacy and data security-related concerns.

The CDT’s prepared testimony provides helpful comparisons between the draft bill, Sen. Lieberman’s S.413, and the Obama Administration proposal from which the Lieberman bill derives. The CDT pointed out that while private entities would share data anonymously through the NISO, any individual personally identifiable information included in the data they shared would not be required to be anonoymized or minimized. The CDT also criticized language in the exemptions provision of the draft bill that would appear to broadly encompass all existing federal privacy laws such as the Electronic Communications Privacy Act.

Prospects for Passage

Although both houses of Congress seem to agree that cybersecurity legislation is needed, their diametrically different approaches would have to be reconciled in order for such legislation to pass both houses. There doesn’t seem to be much chance of such a reconciliation as we move into an election year. Nevertheless, Sen. Harry Reid sent a letter on November to his Republican counterpart seeking bipartistan cooperation in advancing cybersecurity legislation.

A handful of U.S. states currently dictate what content, at a minimum, must be included in notices to individuals regarding a compromise of their personal information. In many instances, such information is included in order to help recipients evaluate what actions to take in response to a breach of personal information. At present, Illinois is not one of these “select” states. It soon will be. As of January 1, 2012, security breach notices to Illinois residents must include contact information for credit reporting agencies and the Federal Trade Commission, along with a “statement that the individual can obtain information from these sources about fraud alerts and security freezes.”

HB3025 also expands the reach of the state’s breach notice law to include service providers who maintain or store, but don’t own or license personal information. It then requires such service providers to cooperate with the data owner or licensor with respect to breaches of personal information in the service provider’s care. Such cooperation must include “(i) informing the owner or licensee of the breach, including giving notice of the date or approximate date of the breach and the nature of the breach, and (ii) informing the owner or licensee of any steps the data collector has taken or plans to take relating to the breach.” But the service provider is not required to disclose its own confidential business information or trade secrets or notify Illinois residents of the breach (that obligation remains with the data owner or licensor). With these amendments, Illinois joins seven other states in mandating cooperation between data owners and service providers.

In addition to amending the state’s breach notice law, HB3025 also establishes standards for disposing of materials containing personal information. Under the new law, a “person must dispose of [any] materials containing personal information in a manner that renders the personal information unreadable, unusable, and undecipherable.” Appropriate methods of disposal include, for example, redacting, burning, pulverizing, or shredding hard copy records and destroying or erasing electronic media so that personal information cannot practicably be read or reconstructed. If you don’t want to, or can’t, do these things yourself, the law allows you to contract with a third party who will do them for you so long as appropriate monitoring policies and procedures are implemented to ensure that the third party will properly carry out its duties and protect the security of personal information. Once again, Illinois is not alone in requiring proper disposal of records containing personal information. In fact, Illinois’ new records disposal provisions closely track those already in existence in several other states.

If you operate nationwide, HB3025 won’t add much to your breach response plan, since other state breach notification laws have already included similar requirements. If not, HB3025 and the wave of recent amendments to state information security breach notice laws only further complicates an already difficult compliance landscape. So exactly when, you ask, will we get some federal relief from the burden of tracking and complying with almost fifty different breach notification laws? Good question.

The Administration’s proposal sets forth two principal “consumer-facing” updates to the current cybersecurity landscape: (1) a federal information security breach notification requirement and (2) enhanced penalties for cyber criminals.

• Data Breach Notification. The proposal calls for the implementation of a federal notification standard to displace the approximately forty-seven such laws at the state level, which generally require notification to individuals (and others) when the security of their personal information is compromised. The data breach notification proposal borrows extensively from the various state-level laws, for example, with respect to the acceptable forms of notice to individuals and the content of such notices, but sets a higher bar for breach notification than many states by introducing a risk of harm threshold for notification. Specifically, the proposal recommends a safe harbor from notification in the event the breached entity’s risk assessment demonstrates that there is no reasonable risk of harm to the affected individuals. The breached entity is required to report the results of any such risk assessment to the Federal Trade Commission (“FTC”) within 45 days. In addition to reporting to individuals, the proposal requires that breached entities report a breach to the Department of Homeland Security (“DHS”), which will in turn report the same to the U.S. Secret Service, the Federal Bureau of Investigation, and the FTC. Perhaps not surprisingly, the proposal identifies the FTC as the primary agency in charge of enforcing compliance with the law’s requirements. The proposal expressly states that the federal breach notification law would supersede any state or local law except to the extent such laws require notifications to include information about victim assistance available from the state.
• Punishments for Cyber Crimes. The proposal also seeks to expand the scope of existing criminal laws pertaining to computer-based offenses and provide more severe penalties for violations of such laws. For example, the proposal creates a mandatory minimum penalty for cyber attacks under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, which currently gives courts considerable latitude to impose substantial penalties (or no penalty at all) for certain attacks on the confidentiality, integrity, or availability of computers. In the Administration’s view, the mandatory minimum penalty eliminates some of that discretion for the sake of deterring attacks that may not actually cause substantial disruption (e.g., because they are thwarted before they are completed), but still pose a serious threat to critical computer systems or networks. For much the same reason, the proposal also makes clear that both conspiracy and attempt to commit a computer hacking offense are subject to the same penalties as completed offenses.

For purposes of protecting the Nation’s critical infrastructure, the proposal identifies three key areas where legislation is needed: (1) laws that facilitate Federal Government assistance to the private-sector as well as state and local governments, (2) laws that pave the way for stakeholders in the private and public sectors to share information about cyber threats, incidents, and preventative measures, and (3) the identification of so-called “critical-infrastructure operators” so that resources (and regulations) can be appropriately directed toward such operators.

• Voluntary Government Assistance. While the Federal Government is often asked to be involved in responses to cyber attacks on others’ computers and networks, there is currently no clear statutory framework for providing such assistance to the private-sector or state and local governments. The Administration’s proposal would change this by authorizing the Secretary of DHS (and his or her designees) to intervene in the event of a cyber attack and offer assistance prior to an identified cyber attack. The proposal specifies the types of assistance that may, or shall, be provided by the Federal Government, including, among other things, the potential establishment of a consolidated intrusion prevention system to protect federal systems from cyber threats, risk assessment tools and testing, and on-site technical support to federal system owners and operators.
• Information Sharing. Protecting America’s digital infrastructure is a shared responsibility among the public and private sectors. The Administration’s proposal acknowledges this, and makes clear that cooperation and information sharing among the various stakeholders, including Federal Government agencies, industry, academia, and our international partners, is an important (and permissible) component of the country’s cybersecurity program. To that end, the proposal encourages sharing by and among stakeholders through, for example, establishing certain immunities for those who agree to provide information to the government. Information obtained for purposes of defending against cyber threats must, however, generally be used and retained for this limited purpose in order to protect individuals’ privacy and civil liberties. In this regard, the Secretary of DHS is required to, among other things, develop and periodically review, with input from the Attorney General and privacy and civil liberties experts, standards relating to the acquisition, interception, retention, use and disclosure of the information obtained in furtherance of this objective.
• Critical Infrastructure Defense. The proposal outlines a system for identifying and protecting the nation’s “critical infrastructure.” The proposal, in many respects, calls upon the operators of identified critical infrastructure to satisfy heightened cybersecurity standards, and authorizes DHS and other federal regulators to review these operators’ cybersecurity plans, monitor compliance with such plans, and take other actions to ensure that critical infrastructure operators are sufficiently addressing identified cybersecurity risks. The proposal also authorizes DHS, through rulemaking, to require annual certifications (in SEC filings or otherwise) of compliance by covered critical infrastructure operators and public disclosure of certain information about the operators’ cybersecurity efforts. The proposal does, however, provide exemptions from public disclosure for certain security and vulnerability information developed or collected in furtherance of the agencies’ covered critical infrastructure reviews.

The Administration’s proposal acknowledges that the Federal Government itself is heavily reliant on computers and computer networks (its own and those of its many civilian contractors) – computers and networks that are continually at risk of cyber attack. For this reason, the proposal highlights three areas for improving the security of Federal Government systems: (1) formalizing DHS’s role as manager of cybersecurity for the Federal Government’s computers and networks, (2) recruitment and retention of cybersecurity professionals to help shrink the government’s learning curve in this critical area, and (3) adopting standards to promote the use of cloud computing vendors where appropriate to meet the government’s needs.

• Cybersecurity Management. The proposal formally establishes DHS as the agency responsible for executive branch information security. Such responsibility includes the authority to implement binding policies and directives relating to information security, review compliance with such policies and directives, and designate an entity to receive reports about cyber threats, incidents, and vulnerabilities.
• Recruitment and Retention of Cybersecurity Professionals. The proposal gives DHS the authority to establish cybersecurity-related positions and set up a scholarship program to ensure that these positions are filled with top-flight talent that is well-schooled in the field of cybersecurity.
• Data Center Locations. Except where expressly authorized by federal law, the proposal bars U.S. states from requiring that private-sector data centers be located in that state as a condition of doing business.

Like the recent spate of privacy and information security related enforcement actions by the FTC and others, the release of the Administration’s legislative proposal underscores the need to be proactive about privacy and information security. There is no question that this is a hot topic for the Administration and the Congress.

National Privacy Law: Major players in the online marketing sphere, such as Microsoft and Google, already have expressed support for a generally-applicable privacy law to preempt a growing number of state laws that impose varying requirements on the collection, use, storage and disclosure of personal information. Whether a federal law emerges governing the collection and use of personal data, including for marketing purposes, is the looming question in the new administration.

Behavioral Advertising: Behavioral advertising -- the practice of tracking of an Internet user’s activities online in order to deliver advertising targeted to an individual consumer’s interests -- which Congress examined extensively over the summer -- should continue to generate interest under an Obama administration. Indeed, the Federal Trade Commission (“FTC”) is expected to announce its final guidance concerning the self-regulation of behavioral advertising even before President-elect Obama takes office in January. We are also likely to see behavioral advertising legislative proposals at the state level, with efforts gaining traction in states like New York, where both Houses are now controlled by the Democrats.

Electronic Health Records: A key component of President-elect Obama’s health care plan is the migration of health care records from paper to more universally accessible forms of electronic media. The incoming president believes strongly that the use of technology will help lower the cost of health care. But as many commentators have suggested, greater accessibility carries greater risk, and the shift toward computerized health records is one area in which President-elect Obama’s aggressive technology and innovation policies may outgrow existing consumer protection safeguards. President-elect Obama’s commitment to providing robust protections against the misuse of this kind of sensitive information likely will require the development of additional, and more broadly-applicable, regulations to shore up existing safeguards provided under the Health Insurance Portability and Accountability Act (“HIPAA”) and other existing legal regimes. 

Data Breach Notification:  Over the past few years, states have been very active passing legislation that requires businesses that retain information about state residents to notify such residents when that information is compromised. Efforts to pass a preemptive national law have stalled largely because of the greater discretion proposed for business regarding the need to notify. That issue will likely continue to impede consensus on a national law, and the state framework is likely to be with us for a while.  

Legislative activity at the state level concerning the protection of personal information, however, is likely to continue as lawmakers try to respond to several high profile information security breaches from previous years. Moreover, as we are seeing in Massachusetts and Connecticut where new data security laws have been passed, we may see a stronger push at the state level toward requiring affirmative steps to protect personal information, rather than just requiring businesses to respond to a breach incident.

More Robust Federal Trade Commission: President-elect Obama plans to enlarge the FTC budget and enforcement power to aid in the implementation of his technology and innovation policies. The FTC’s expanded powers will likely be used to enforce the Commission’s new identity theft Red Flags Rule, which requires financial institutions and creditors to implement comprehensive written identity theft prevention programs by May 1, 2009. The FTC’s decision to extend the original November 1, 2008 compliance deadline for an additional six months portends relatively immediate enforcement activity in Summer 2009 that will help define precisely what is required, and from whom, under the Rule. The push for more enforcement power may also spur the expansion of the FTC’s authority to seek civil penalties and other monetary remedies for violations of the statutes and regulations the Commission enforces.

Location Data & Government Surveillance: President-elect Obama’s desire to develop and better utilize available technologies to create real change in America will likely create some friction in the areas of government surveillance and the collection of location data where the interests of national security and personal privacy diverge. Moreover, the private sector’s collection and use of location data and other “tracking” information to more effectively market to consumers raises concerns on both sides of the aisle since these technologies arguably can be misused to compromise national security or personal privacy. While we expect the Obama administration to back away from the aggressive government surveillance policies and programs implemented by the previous administration in the wake of September 11, 2001, the success of these efforts will require a delicate balance between a strong stance on national security and a shift toward protecting the privacy of Americans at home.

Arizona (ARIZ. REV. STAT. ANN. § 44-7501(h)

Arkansas (ARK. CODE ANN. § 4-110-101 et seq.)

California (CAL. CIV. CODE § 1798.82)

Connecticut (CONN. GEN. STAT. § 36a-701b)

Delaware (DEL. CODE ANN. tit. 6, § 12B-101)

District of Columbia (District of Columbia B16-810, D.C. Code § 28-3851)

Florida (FLA. STAT. § 817.5681)

Hawaii (S.B. 2290, Act 135)

Idaho (IDAHO CODE ANN. § 28-51-104 et seq.)

Illinois (815 ILL. COMP. STAT. ANN. 530/5, /10)

Indiana (IND. CODE § 24-4.9)

Kansas (KAN. STAT. ANN. §§ 50-7a01-02)

Louisiana (LA. REV. STAT. ANN. § 51:3071 et seq.)

Maine (ME. REV. STAT. ANN. tit. 10, §210-B-1346 et seq.)

Massachusetts (H. 4144)

Michigan (S.B. 309)

Minnesota (MINN. STAT. § 325E.61)

Montana (MONT. CODE ANN. § 30-14-1704)

Nebraska (NEB. REV. STAT. § 87-801 et seq.)

Nevada (NEV. REV. STAT. 603A.010 et seq.)

New Hampshire (N.H. REV. STAT. ANN. § 359-C:19 et seq.)

New Jersey (N.J. STAT. ANN. § 56:8-163)

New York (N.Y. GEN. BUS. LAW § 899-aa)

North Carolina (N.C. GEN. STAT.§ 75-60 et seq.)

North Dakota (N.D. CENT. CODE § 51-30-01 et seq.)

Ohio (OHIO REV. CODE ANN. § 1349.19)

Oregon (S.B. 583)

Rhode Island (R.I. GEN. LAWS § 11-49.2-3))

Tennessee (TENN. CODE ANN. § 47-18-21)

Texas (TEX. BUS. & COMM. CODE ANN. § 48.001 et seq.)

Utah (UTAH CODE ANN. § 13-42-101 et seq.)

Vermont (VT. STAT. ANN. tit. 9, § 2430 et seq.)

Washington (WASH. REV. CODE § 19.255.010)

Wisconsin (WIS. STAT. § 895.507)

Proposed Data Destruction Requirements for Retailers

California currently requires all businesses to comply with several statutory provisions related to data security and destruction.  These provisions are contained in California Civil Code §§ 1798.80 – 1798.84 and concern three major topics: (1) destruction of customer records containing personal information; (2) the safeguarding of personal information; and (3) data breach notification.  A.B. 779 incorporates the data privacy laws by reference and expressly applies them to retailers that “collect[] or maintain[] personal information for any purpose.”

Under the bill, retailers would be required to dispose of records that contain personal information within 90 days.  Existing law, California Civil Code § 1798.81, provides general guidelines for records disposal for all businesses.  Under the current statute, a “record” is anything on or through which information is recorded or preserved, including written or spoken words, graphic depiction or electronic transmission.  “Personal information,” for purposes of this section, is:

any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information.  “Records” does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number.

California Civil Code § 1798.80 (emphasis added).

The destruction requirements proposed in A.B. 779 reach far beyond those set forth in § 1798.81.  Existing law requires only that a business

take all reasonable steps to destroy, or arrange for the destruction of a customer’s records within its custody or control containing personal information which is no longer to be retained by the business by (1) shredding, (2) erasing, or (3) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.

Section 1 of A.B. 779, however, would require that “a retailer that sells goods or services to any resident of California . . . not retain personal information for longer than 90 days after the date of the original transaction, or the period of time during which goods may be returned for a refund or exchange, whichever is shorter.” (emphasis added).  Thus, should A.B. 779 be passed into law, it will significantly impact retailers’ records retention and disposal policies and procedures with respect to personal information of customers.

Proposed New Data Breach Notification Requirements for All Businesses.

California Civil Code § 1798.82, the first-in-the-nation security breach notification law, currently requires all businesses that own or license personal information to notify individuals if their data have been, or may have been, acquired by an unauthorized person.  Personal information is defined as the first name or initial and last name of an individual, with one or more of the following: 1) Social Security Number, 2) driver’s license number, 3) credit card or debit card number, or 4) a financial account number with information such as PINs, passwords or authorization codes that could gain access to the account.

A.B. 779 would amend California Civil Code § 1798.82 in three primary respects.  First, it would require that the following information appear in breach notices:

(A) The date of the notice.

(B) The name of the person or business that maintained the computerized data at the time of the breach.

(C) The date on which the breach occurred.

(D) A description of the categories of personal information that were, or are reasonably believed to have been, acquired by an unauthorized person.

(E) A toll-free telephone number or, if the primary method used by the person or business to communicate with the individual is by electronic means, an electronic mail address that the individual may use to contact the person or business or their agent, so that the individual may learn what types of personal information the person or business maintained about that individual.

(F) The toll-free telephone numbers and addresses for the major credit reporting agencies.

Second, according to the text of the bill, owners or licensees of personal data would be entitled to reimbursement from a third party person or business that maintains the data and that is actually responsible for the breach, for the “reasonable and actual costs” of providing required breach notification.  Data owners would remain responsible for providing notice.  Third, companies providing notice must send a copy of the notice provided to consumers to the California Office of Privacy Protection.  This requirement is similar to the laws of other states, including New York and New Jersey, that require notification to other governmental agencies.

1) Pre-emption

All four bills would pre-empt state laws pertaining to similar subject matter. However, the bills do allow states to specify additional information that must be included in data breach notifications. 

2) Regulatory enforcement and rulemaking

S. 239, H.R. 958 and S. 495 all delegate to the FTC the responsibility of establishing guidelines for data security and breach notification. Although the FTC’s mandate until now has not included breach notification, the FTC has a fair amount of experience with enforcing data security standards under its Section 5 (15 U.S.C. § 45) authority. 

The proposed legislation delegates authority to the FTC to promulgate regulations based on criteria similar to those the FTC already follows in its Section 5 cases: establishment of security policies, enforcement of those policies and monitoring of potentially vulnerable systems. See, e.g., H.R. 958, sec. 2.      

3) Breach notification duty belongs to data owner, not licensee or third-party data manager

H.R. 958 and S. 495 explicitly state that a third-party data manager’s only notification obligation after a breach is to alert the data owner, i.e., the entity on behalf of which the data is maintained, to the breach. S. 239 also imposes such an obligation, but notes that the proposed legislation does not prevent a data owner and a third party from allocating through contract the burden of notifying individuals’ whose data were compromised. The other two proposals are silent as to this issue.   

4) No private cause of action