The (Revised) Proposal to "Strengthen North Carolina Identity Theft Protection Act"

North Carolina's Attorney General, Josh Stein, and Representative Jason Saine have unveiled a revised proposal for amending the state's existing Identity Theft Protection Act.  Recall that one year ago, Stein and Saine introduced a summary of proposed legislation (sometimes erroneously called a "fact sheet") outlining their plans for bipartisan legislation to tighten privacy and data security protections for North Carolinian.  In this post, I will attempt to describe the 2019 proposal and highlight differences from the 2018 proposal.

 

Concerns with the 2018 proposal

 

In many of my privacy and data security law presentations during 2018, I expressed my view that some elements of the proposal were reasonable and advisable improvements to the statute, and I also described a couple of my concerns with the proposal:

 

1.  First, the 2018 version of the Act to Strengthen Identity Theft Protections would have created the shortest breach reporting timeframe in the entire United States--only 15 days--giving organizations only half the time to respond to a breach as the next shortest timeframe.  Having assisted some of North Carolina's largest and smallest organizations in post-incident response, I thought that was unrealistically aggressive (although I'm sure well-intentioned).  Several states did, in fact, adopt or revise reporting deadlines in 2018, but none were close to the 15 days in the Stein-Saine proposal, for example:

• 30 days: Colorado; 
• 45 days: Alabama, Arizona, Maryland, Oregon; and
• 60 days: Delaware, Louisiana, South Dakota.

2.  Second, the 2018 proposal would have included ransomware in the definition of "breach" even if no personal information was divulged (i.e., "exfiltrated").  Notifying individuals of an incident in which their data has not been exposed, and for which they probably cannot really take any pro-active or remedial actions, seems pointless, would likely generate fear disproportionate to the risk of harm, and creates a significant and unnecessary expense for the entity that has been attacked. In other words, I think there are good reasons why other states do not include ransomware attacks within the scope of a reportable breach.

What's new in the 2019 proposal

 

In the 2019 version of the proposal, one of these concerns has been addressed.  Let's take a look at how the 2019 proposal differs from the 2018 proposal:

 

• In the 2018 proposal, the Attorney General's office would "determine the risk of harm" to consumers. In the 2019 proposal, the organization makes the initial determination, and "if the breached entity determines that no one was harmed, it must document that determination for the Attorney General’s office to review."
• There were no changes to the security obligation. Both proposals impose a duty on a "business that owns or licenses personal information to implement and maintain reasonable security procedures and practices – appropriate to the nature of personal information – to protect the personal information from a security breach. "
• There were no changes to the proposed expansion of "personal information." In both proposals, the scope would be expanded to include medical information and insurance account numbers. (The interaction with HIPAA was not addressed specifically.)
• The 15 day reporting timeframe in the 2018 proposal has been changed to a 30 day timeframe in the 2019 proposal, which is much more consistent with the approach of other states.
• Under both proposals, consumers will be able to place and lift a credit freeze on their credit report at any time, for free, and credit reporting agencies will also be required to cooperate to establish a simple method so that consumers need not repeat the process with each CRA. (If this sounds familiar, it is because this is how credit fraud alerts already work. Credit fraud alerts are creatures of federal law, and credit freezes arise from state law, and therefore vary from state to state.)
• Under the 2018 proposal, consumers affected by a breach would have access to three free credit reports from each national consumer reporting agency, but that provision was dropped from the 2019 version of the proposal.
• Under the 2018 proposal, if a consumer reporting agency is breached, it will be obligated to provide five years of free credit monitoring; under the 2019 version, the CRA would provide monitoring for four years.
• Under the 2019 version, if any organization is breached, it must provide two years of free credit monitoring to each affected consumer. There was no similar provision in the 2018 proposal (except for CRAs).
• Under the 2019 version, a failure to report a breach will be a violation of the NC Unfair and Deceptive Trade Practices Act. (The 2018 version specified that each affected consumer would support a separate violation; the 2019 version omits that statement.) Frankly, I am not sure that this would actually be a change from the current law; it may be a mere attempt to codify the status quo.
• Both proposals say that a company will need a person's permission before obtaining or using a person’s credit report or credit score, and must disclose the reason for the request. (This is already a requirement under federal law, so I do not foresee much impact from this provision.)
• Finally, both proposals would give NC residents the right to obtain from any CRA "the information maintained on him or herself (both credit related and non-credit related information), its source, and a list of any person or entity to which it was disclosed."

 

 The 2018 proposal never made it to a vote in the North Carolina General Assembly, and I cannot predict whether the new proposal will be adopted in the 2019-2020 session, but it is clear that the Attorney General intends to focus on privacy and data security, through legislation and enforcement actions, during the coming year.

 

 

 

 

 

 

Information Security Breaches, Unauthorized Transactions, and Account Takeovers...or "What You Missed"

 

On Friday, I had the honor to join some distinguished speakers for an all-day continuing legal education seminar on computer technology and the law.  My fellow presenters were:

• Clark Walton, former CIA forensic computer analyst, lawyer with Alexander Ricks, and founder of computer forensic firm Reliance Forensics (and formerly Chair of the NCBA Young Lawyers Division and the American Bar Association's Young Lawyer of the Year).
• Ashden Fein, lead prosecutor of Private Bradley Manning in the WikiLeaks trial and now lawyer with Covington & Burling in Washington, D.C.
• Chris Swecker, former Assistant Director of the FBI, lawyer, and security consultant.
• Kim Korando, employment lawyer with Smith Anderson.
• Joyce Brafford, law practice technology guru with the NCBA's Center for Practice Management.

It was a fascinating day, and I enjoyed hearing from these great speakers more than I enjoyed speaking myself. 



In the course of my presentation, we discussed the various legal response requirements following a data security breach, as well as liability for unauthorized transfers in consumer and commercial accounts. 



The program was well-attended in person and by webinar, but if you missed the opportunity to attend, I am providing a link to my slideshow here.  I hope you find it useful.

Why Are the Federal Trade Commission's Privacy and Information Security Expectations Unclear, and Has the FTC Gone Too Far?

One of the most frustrating things about privacy and information security law is the lack of certainty when it comes to acceptable uses and protocols. This piece is intended to explain some of the reasons for the uncertainty, and to highlight a pending case that might shed additional light.

Bills to create nationwide privacy and information security rules seem unable to gain traction in Congress. (Perhaps that will change with the new class of legislators having just been sworn into office.) At present, the United States has no comprehensive privacy statute nor is there a comprehensive set of privacy regulations. Instead, we have a "patchwork" of privacy regulation:
Most privacy laws in the United States are industry-specific and enforced by industry-specific agencies. For example, the federal banking agencies (the FDIC, OCC, FRB, and NCUA) govern financial institutions' handling of financial information, and the Department of Health and Human Services holds healthcare providers responsible for following the health information privacy rules.

At the federal level, the Federal Trade Commission is the agency with the broadest reach to address privacy and information security issues. The FTC has taken the role of filling the gaps left by the patchwork of regulations by pursuing enforcement actions against all sorts of companies for all sorts of privacy-related issues. But from where does the FTC's broad authority over privacy practices come, and how far does it reach? Certain specific federal statutes give the FTC authority over specific issues, like the privacy of children's information on the internet, and credit reports, but what about the FTC's authority over the broad spectrum of privacy-related issues?

The Federal Trade Commission Act prohibits "unfair and deceptive acts and practices in or affecting commerce.” The FTC relies upon this broad language to justify its sometimes aggressive enforcement actions against organizations that do not handle customer information in the way the FTC finds acceptable. For example, the FTC has pursued, and extracted large sums of money from, many website operators and social media platforms that it alleged had failed to carry out the promises those companies had made in their privacy policy statements, on the grounds that such shortcoming were "deceptive acts" (and more recently, also "unfair"). Privacy lawyers have observed that the FTC seems to take a very expansive view of its statutory authority in these contexts, but most companies that have found themselves in the crosshairs of the FTC have settled rather than challenge the FTC's authority (such as Facebook, Twitter and Google, as I've written about here).

Another significant problem with the FTC's broad and ambiguous authority is that the FTC has not been given the explicit authority to write and publish regulations governing privacy and data security generally. As a result, the FTC "regulates by enforcement," meaning the primary way in which we know what will draw the FTC's ire is by looking at the instances in which it has brought enforcement actions in the past and drawing inferences from the court filings and settlement agreements that become public. The obvious problem is that the rules of the game are not given to the players at the outset of the game, and are never made perfectly clear. Only by carefully observing the FTC's public actions and public statements can we begin to infer the kinds of activities that might trigger FTC action. Regulating privacy and information security in this way (after-the-fact punishment based on very broad principles) leaves a lot of room for uncertainty, and many organizations are craving clarity in these areas.

A case pending before the Third Circuit Court of Appeals may result in additional certainty: The FTC brought an enforcement action against Wyndham Hotels following information security lapses by the hotel chain, but Wyndham is fighting back, arguing that the FTC lacks the authority under the FTC Act to bring data security enforcement actions, as well as arguing that the FTC failed to give it fair notice of the security practices the FTC expects. Wyndham further challenges the FTC's claim that its practices were "unfair." (A practice is "unfair" under the FTC Act only if it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”)

Because most FTC enforcement actions in this area result in settlement, this is the first time a federal appeals court will be asked to clarify the FTC's role in data security. You can bet privacy and information security lawyers and other InfoSec professionals will be watching this case closely!

How Financial Institutions Can Manage Social Media Risks

image by Matt Cordell using Creative Commons content BY-SA 3.0

Bankers, does your bank use social media? Do employees use social media on behalf of the bank? Do you know what examiners will be looking for in a social media risk assessment and a social media risk management program?

The Federal Financial Institutions Examination Council (FFIEC) has published guidance recently that will be used by the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the National Credit Union Administration (NCUA), and the Consumer Financial Protection Bureau (CFPB) to evaluate financial institutions' compliance with various privacy and other laws and regulations.

What kinds of social media are covered?

The guidance defines "social media" as any form of interactive online communication in which users can generate and share content through text, images, audio, and/or video. Examples include micro-blogging sites (e.g., Facebook, Google Plus, MySpace, and Twitter), forums, blogs (e.g., BizLawNC.com or PrivacyLawNC.com), customer review web sites and bulletin boards (e.g., Yelp), photo and video sites (e.g., Flickr and YouTube), sites that enable professional networking (e.g., LinkedIn), virtual worlds (e.g., Second Life), and social games (e.g., Farmville). These platforms have a wide spectrum of uses, and their user profiles vary.

Financial institutions most often use social media for marketing directly to customers, but it can also be used to provide incentives, collect feedback from the public, recruit employees, and to otherwise engage with prospects and customers. Each of these efforts carries with it particular goals and varying types and degrees of risk.

The FFIEC Guidance states that every financial institution must conduct a risk assessment that addresses the risks raised by its use of social media and maintain a risk management program that is tailored to the risk profile. Every institution using social media should identify, measure, monitor,and control the risks related to social media.

How detailed should the policy statement be? How comprehensive should the procedures be?

The size and complexity of the program should be commensurate with the degree of the institution's involvement in social media, both in terms of depth and breadth. For example, a financial institution that relies heavily on one medium (e.g. Facebook) should have a more focused program. An institution using several media (e.g., Facebook, LinkedIn, Twitter, Yelp, Google +, and YouTube) should have procedures that are more comprehensive.

Who should be involved?

The FFIEC advises that a social media risk management program should be designed with participation from specialists in compliance, technology, information security, legal, human resources, and marketing. A better suggestion, in my opinion, is the inclusion of individuals whose expertise spans more than one of these categories. (Can you think of anyone who might know about more than one of these areas?)

What are the elements of a social media risk management program?

• A governance structure with clear roles and responsibilities;
• Policies and procedures (either stand-alone or incorporated into other policies and procedures) regarding the use and monitoring of social media and compliance with all applicable consumer protection laws and regulations;
• A process for selecting and managing third-party relationships;
• An employee training program;
• An oversight process;
• Audits to ensure ongoing compliance; and
• Reporting to the board of directors or senior management to enable periodic evaluation of the program.

What are the key areas of risk?

• Deposit and Lending Products
• Truth in Savings Act/Regulation DD
• Fair Lending Laws: Equal Credit Opportunity Act/Regulation B and Fair Housing Act
• Truth in Lending Act/Regulation Z (including specifically advertising requirements)
• Real Estate Settlement Procedures Act
• Fair Debt Collection Practices Act
• Unfair, Deceptive, or Abusive Acts or Practices
• Deposit Insurance (or Share Insurance) disclosure requirements regarding insurance or NDIPs
• Bank Secrecy Act/Anti-Money Laundering Act
• Community Reinvestment Act
• Gramm-Leach-Bliley Act Privacy Regulations and Data Security Guidelines
• CAN-SPAM Act and Telephone Consumer Protection Act
• Children’s Online Privacy Protection Act
• Fair Credit Reporting Act
• Reputational Risk
• Employment Law/HR Risk
• Operational Risk (malware and account takeover)

What if we don't use social media at our bank?

Even financial institutions that do not use social media should perform a risk assessment, say the regulators: "a financial institution that has chosen not to use social media should still consider the potential for negative comments or complaints that may arise within the many social media platforms described above, and,when appropriate, evaluate what, if any, action it will take to monitor for such comments and/or respond to them." I have already written about online reputation management at length, and rather than repeat my advice here, I will refer you my earlier post on the subject.

Furthermore, just because an institution does not have an official social media account does not mean individual employees (especially those with business development responsibilities) are not posting on LinkedIn, Facebook, Twitter, and other platforms about, and apparently on behalf of, the the institution. It is unusual these days to find anyone in a sales role who is not active on social media.

Conclusion

The FFIEC Guidance is intended to help financial institutions understand and successfully manage (not eliminate) the risks associated with use of social media. The regulators expect institutions to manage potential risks to themselves and and their customers by identifying areas of risk proactively and adopting and implementing programs to mitigate those risks effectively...and more importantly, so do an increasing number of customers.