May 18, 2011

By: Michael R. Fox and John F. Mullen

This article is an interpretation of current law and is offered for informational purposes only. This material is not legal advice and should not be construed or used as a substitute for the advice of an attorney.

In the wake of several high-profile data breaches, the Obama administration ("administration") proposed cyber security legislation last week designed to offer greater protection to the country's critical infrastructure, federal and state governments, and citizens' personal information.

One aspect of the initiative, which the administration refers to as a "vision for the future of cyberspace," proposes enacting national data breach reporting laws. Currently, 46 states and the District of Columbia have some form of regulation that requires an entity who suffers a data breach to notify individuals whose personal information may have been compromised. When the data loss exceeds specified limits, entities in certain states must also notify the state attorney general. The proposed legislation seeks to both simplify and standardize the existing "patchwork" of the 47 different laws.

The suggested national guidelines require any business that collects personal information for more than 10,000 people during any 12-month period to notify individuals of a data breach that involves the loss of their personal information. The notification must occur "without unreasonable delay" via standard mail, telephone or e-mail. In some cases, notification may even occur through media outlets if the notice is properly calculated to reach the affected individuals.

The standards also include certain exemptions from reporting. For example, no separate notification is required when the targeted entity utilizes or participates in a security program that automatically notifies individuals of potential fraud and blocks unauthorized financial transactions before they are charged to the account of the person whose information was stolen.

From the perspective of insurance carriers who offer cyber breach insurance policies, the enactment of a national data reporting law may be welcome. Currently, the existence of 47 different sets of reporting obligations make compliance confusing and time consuming. A national standard would simplify the reporting process and reduce the costs associated with analyzing and complying with a large number of diverse standards.

While promising, the proposal still faces challenges. This is not the first time a national reporting standard has been proposed. In the past, issues surrounding the pre-emption of state laws have been a significant barrier. These issues will need to be addressed before the proposal can become law.

For additional information related to this or other privacy and data security issues, please contact John F. Mullen at 215.358.5154 or via email at jmullen@nldhlaw.com or Michael R. Fox at 215.358.5163 or mfox@nldhlaw.com.