Why safe harbor is the best way forward for data protection

Data breach notification regulations are now common in all 50 states, as well as the District of Columbia, Guam, Puerto Rico, and the Virgin Islands. States, on the other hand, continue to tweak these policies once they are in place. 22 states, for example, have submitted or are considering proposals to alter existing laws this year. 

Many of the changes focus on reducing the amount of time it takes to notify a breach, broadening who must report a breach, redefining what constitutes personal information, and requiring breaches to be reported to the state's attorney general or another agency. Some states are considering giving businesses incentives to improve their security by giving them an affirmative defense in civil lawsuits if acceptable security techniques were in place at the time of the data leak. It might be tough to persuade companies to take data privacy seriously. As a result, there is an incentive. Here's why using so-called safe harbor laws to incentivize data protection is the greatest way to improve cybersecurity. 

Safe harbor for meeting standards

Unlike states such as California and Colorado, which have taken a punitive approach, states that use the incentive method strive to encourage improved levels of cybersecurity by establishing a "safe harbor" from data breach litigation by imposing industry or government security standards.

Georgia, New Jersey, Illinois, and Connecticut are among the states contemplating affirmative defense legislation this year. Nevada voted down a bill that would have shielded businesses from liability for damages if they implemented specific security controls or standards. Meanwhile, in Utah, a bill establishing an affirmative defense was passed.

If the person had actual notice of a threat or hazard to the security, confidentiality, or integrity of personal information; if the person did not act in a reasonable amount of time to take known remedial efforts to protect the personal information against the threat or hazard; or if the threat or hazard resulted in a breach of system security, the act does not provide any affirmative defense. These omissions serve as a reminder that a cybersecurity program is not something that can be written and then forgotten about. They alerted businesses to the fact that cybersecurity initiatives are a risk management tool for a company.

The Cybersecurity Affirmative Defense Act (HB80) amends Utah's data breach notification statute by defining multiple affirmative defenses for persons facing a cause of action stemming from a breach of system security, as well as the standards for raising such a defense.

The act's principal goal is to encourage people, associations, corporations, and other entities to keep adequate precautions in place to protect personal information by offering an affirmative defense in data breach action. A individual who designs, maintains, and complies with a written cybersecurity program that was in place at the time of the intrusion will be rewarded.

Utah isn't the only state that has established an affirmative defense to data breach lawsuits. The Ohio Data Protection Act (SB 220) was enacted in 2018, giving a similar safe harbor for organizations who build and maintain "reasonable" cybersecurity protections.

To qualify for the defense, a business must implement written cybersecurity measures designed to protect the security and confidentiality of personal information, protect against any anticipated threats or hazards to the security or integrity of the personal information, and protect against any anticipated threats or hazards to the security or integrity of the personal information, according to a "client alert" published at the time the Ohio law was enacted.

Protections are good but limited

Even firms with effective cybersecurity programs are exposed to statutory violations, such as data breach reporting requirements, or claims based on contract, such as a business-vendor dispute, because the law's protections are significantly restricted in breadth.

The laws in New York are comparable to those in Utah and Ohio, except they are narrower. New York's Stop Hacks and Improve Electronic Data Security Act, which goes into effect in 2020, mandates that organizations that collect data maintain reasonable security, in accordance with applicable regulatory schemes like the Health Insurance Portability and Accountability Act and the Gramm-Leach-Bliley Act, which requires financial institutions to explain their information-sharing practices to their customers.

All in on what works for data privacy protection

I'm all for using an affirmative defense approach if it drives corporations to act and adopt data privacy safeguards. Developing, maintaining, and adhering to a thorough data protection program is a vital risk management and legal compliance step they should take, and one that could help them avoid litigation in the event of a data breach.