Top 7 Key Cybersecurity & Privacy Law Developments From 2017

From Equifax to WannaCry, the Steady Stream of Data Breaches & Cyberattacks Throughout 2017 Led To Several Cybersecurity & Privacy Law Developments Worth Noting

The Equifax data breach was arguably the most captivating cybersecurity headline of 2017. In addition to the significant public relations fallout, the data breach spurred class-action lawsuits, government investigations, and renewed efforts to regulate credit reporting companies.

Of course, Equifax was not alone. In 2017, the WannaCry ransomware attack crippled businesses across the globe. Countless others fell victim to less publicized cyberattacks, such as phishing scams and malware.

Not surprisingly, the steady stream of data breaches and other cyberattacks has prompted a wide range of legal responses. Below are some of the key cybersecurity law developments of 2017:

• NY Cybersecurity Regulations: New York’s landmark cybersecurity regulations for financial companies took effect in March 2017. The Department of Financial Services’ data security rules require financial services companies to establish and maintain a cybersecurity program designed to “ensure the confidentiality, integrity and availability” of their information systems. The programs must address five key areas: identification of cyber risks; implementation of policies and procedures to protect unauthorized access/use or other malicious acts; detection of cybersecurity events; responsiveness to identified cybersecurity events to mitigate any negative events; and recovery from cybersecurity events and restoration of normal operations and services.
• Stricter Regulations for Credit Reporting Companies: New York is one of several states considering new cybersecurity regulations for credit reporting companies in the wake of the Equifax breach. A proposed regulation would bring credit reporting companies under the purview of the state’s new cybersecurity rules and require them to register with the state.
• Greater Demand for Cyber Insurance: Given that most businesses will eventually fall victim to a cyberattack, companies are increasingly looking for different ways to hedge against the risk and protect themselves from losses. As demand for cyber insurance grows, insurance companies are also expanding coverage to address specific risks, such as ransomware and state-sponsored attacks. Insurers are also continually assessing the risks and incentivizing companies with comprehensive data security programs through lower premiums. Courts have also shown a willingness to apply more traditional business policies to cyber-related losses.
• Regulators Making Cybersecurity a Top Priority: Agencies such as the Securities and Exchange Commission (SEC) continue to identify cybersecurity as a top priority when conducting examinations of regulated entities. In addition, the Federal Trade Commission (FTC) continues to file enforcement actions against companies for failing to prevent data breaches and otherwise failing to adequately protect the privacy of consumer data. States’ Attorneys General have also ramped up enforcement efforts.
• Liability of Executives and Boards for Data Breaches: Officers and Boards are increasingly being held accountable for data breaches, particularly if they could have been easily prevented or if the response were mismanaged. As evidenced by the resignation of former Yahoo CEO Marissa Mayer, executives left holding the bag may not only lose part of their paychecks, but also their jobs.
• Risks Associated with Internet of Things: The “Internet of Things” (IoT), which refers to everyday objects, from home security systems to smartwatches, that send and receive data via an Internet connection, grew significantly in 2017. As adoption of the technology grows, so do the potential data privacy and cybersecurity risks, including unauthorized access, misuse of personal information, and personal safety concerns. This summer, a bill was introduced in Congress that would establish baseline cybersecurity standards for federal procurement of IoT devices. While the Internet of Things Cybersecurity Improvement Act of 2017 would only apply to IoT devices sold to the federal government, should the measure advance, additional legislation for consumer-facing devices would likely be forthcoming.
• Cybersecurity Evaluated in M&A Transactions: When contemplating a merger or acquisition, companies in all industries are making cybersecurity a more important part of the due diligence process. After all, data breaches can significantly impact a company’s reputation and lead to significant legal liability. Cybersecurity incidents can also lead to public disclosure of valuable trade secrets and other proprietary information. Prior to closing an M&A transaction, buyers should review any past data breaches and other cybersecurity incidents. In addition, when structuring an M&A transaction, the parties should also address how liability for breaches will be apportioned.

As we head into 2018, cybersecurity risks will continue to increase for businesses and consumers alike. While technology is expected to help make threat detection easier and more cost-efficient, traditional cybersecurity measures, such as password protection and data backup, will continue to play a vital role.