Data Security and Breach Notification Legislative Update: What You Need to Know (SESSION CODE CRM001)

Size: px

Start display at page:

Download "Data Security and Breach Notification Legislative Update: What You Need to Know (SESSION CODE CRM001)"

Cecilia West
5 years ago
Views:

1 Data Security and Breach Notification Legislative Update: What You Need to Know (SESSION CODE CRM001) Speakers: James T. McIntyre Partner McIntyre & Lemon, PLLC Janice Ochenkowski International Director JLL

2 Learning Objectives At the end of this session, you will: Be familiar with the Cybersecurity Information Sharing Act (CISA) Know what cybersecurity information may be shared with the federal government and non-federal entities Understand the distinction between sharable cybersecurity information and protected personal and identifying information Know when CISA provides liability protection for sharing cybersecurity information Distinguish between CISA and other cybersecurity bills

3 Summary of CISA Enacted on Dec. 18, 2015 Federal agencies and non-federal entities may: Monitor their networks Operate defensive measures Share cyber threat indicators and defensive measures ( information ) Provides liability protection Some privacy requirements

4 Summary of CISA Federal government sharing Non-federal entity sharing Procedures for sharing with the federal government Protection from liability Issues with earlier versions Comparison with other bills

Unclassified information Information to prevent a

5 Sharing by the Federal Government Develop procedures for sharing of: Classified and declassified information Unclassified information Information to prevent a cybersecurity threat Real time sharing Personal or identifying information removed

6 Sharing by Non-Federal Entities Authority to: Monitor and operate defensive measures Share and receive cyber threat indicators and defensive measures

7 Sharing by Non-Federal Entities Must remove personal or identifying information No violation of anti-trust law Must implement security controls

8 Sharing by Non-Federal Entities Shared information with the government cannot be used to regulate an entity s lawful activities Shared information may be used to develop regulations relating to information systems

9 Sharing by Non-Federal Entities Sharing with the federal government: Does not waive privilege Does not waive trade secret protection Sharing with the federal, state, or local government: Exempt from FOIA disclosure

10 Sharing by Non-Federal Entities Use or disclosure of information by federal government allowed for: Protecting an information system Identifying a cybersecurity threat Responding to or preventing a serious threat or fraud

11 Sharing by Non-Federal Entities Use of information by state and local governments allowed for: Protecting an information system Identifying a cybersecurity threat Responding to or preventing a serious threat or fraud Prior consent not required to use information

12 Sharing by Non-Federal Entities Sharing of cyber threat indicators and defensive measures is authorized No duty to share information No duty to warn or act based on receipt of information

13 Sharing with the Federal Government Develop procedures for sharing of information with the federal government Real time sharing Audit capability and sanctions for unauthorized activities by federal officers

14 Sharing with the Federal Government DHS, DOJ to develop guidance that identifies: Cyber threat indicators Information protected under privacy laws Develop guidelines governing the receipt and use of information by federal agencies

15 Sharing with the Federal Government DHS will develop a portal to accept shared information President may designate another agency to accept shared information

16 Liability Protection A non-federal entity has liability protection when: Sharing or receiving information with non-federal entities Receiving information from the federal government Sharing information with the federal government using the DHS portal

17 Liability Protection No CISA liability protection for use of defensive measures CISA silent about liability protection if sharing information with the federal government using a non-dhs portal

18 Issues with Earlier Versions of CISA Section 407 of S. 754 Strategy to Protect Critical Infrastructure at Greatest Risk Required DHS to develop standards and strategies For entities that held critical infrastructure To avoid catastrophic effects in the event of a cyber attack Controversial; deleted from final CISA

19 Preemption Supersedes state or local law regarding the sharing of information authorized by CISA Does not supersede laws concerning law enforcement Does not supersede laws requiring disclosure of information for criminal prosecution

20 Other Bills H.R Data Security and Breach Notification Act Sponsored by Marsha Blackburn (R-TN) Covers entities that collect or use unencrypted nonpublic personal information Following a security breach: Requires entities to restore security Notify affected individuals, the FTC, the Secret Service, the FBI, and consumer reporting agencies

21 Other Bills H.R Data Security and Breach Notification Act (cont.) FTC and states have enforcement authority Preempts state information security and notification laws Does not provide liability protection under common law

22 Other Bills H.R Data Security Act Sponsored by Randy Neugebauer (R-TX) Covers entities that collect or use unencrypted nonpublic personal information Entities must implement an information security program Entities must require their 3 rd party service providers to implement a security program

23 Other Bills H.R Data Security Act (cont.) Following a security breach: Requires entities to restore security Notify affected individuals, federal law enforcement, appropriate administrative agencies, payment card networks, and consumer reporting agencies

24 Other Bills H.R Data Security Act (cont.) Allows alternative compliance procedures for entities governed by the: Gramm-Leach-Bliley Act Health Insurance Portability and Accountability Act

25 Other Bills H.R Data Security Act (cont.) Enforced by the FTC, federal financial institution regulators, SEC, CFTC, and state insurance regulators Prohibits state laws from being imposed for information security and breach notification purposes

26 QUESTIONS Speakers: James T. McIntyre Partner McIntyre & Lemon, PLLC Janice Ochenkowski International Director JLL

-Eight types of cyber data, (Sec. 708(7))

-Eight types of cyber data, (Sec. 708(7)) WHAT INFORMATION MAY BE SHARED H.R. 624, the Cyber Intelligence sharing and Protection Act of 2013 (CISPA) (Rogers- -Notwithstanding any provision of law, S. 3414, the Cybersecurity Act of 2012 (Lieberman-Collins-