Transfer of Data Out of the EU, Including the United States

The GDPR also updates the 1995 Data Protection Directive’s limitations on the transfer of personal data to countries outside of the European Union, further defining what determines that a country provides “adequate protection” of the data to avoid ancillary agreements.⁷ The United States has negotiated an exception to this rule in the “E.U.–U.S. Privacy Shield,” which went into effect in August 2016.⁸ The Privacy Shield provides companies that transfer data across the Atlantic with a clear set of legal standards and protections surrounding consumer data that must be followed to participate in commerce with the European Union. U.S. corporations will be subject to compliance review with the U.S. Department of Commerce, as well as redress mechanisms set up to ensure that access to the data by government agencies will be as limited as possible.⁹

An auxiliary bill working its way through the EU government is the Network and Information Security Directive (NISD). It has similarities to the GDPR by way of its broad footing but mainly concerns nations and critical infrastructure (CI).¹⁰ Under NISD, countries are to designate cyber response contact points in their governments and specific companies as “operators of essential services,” while the selected companies have expanded cybersecurity expectations and an incident notification requirements.¹¹

Post-Brexit United Kingdom

In regards to the United Kingdom’s planned withdrawal from the European Union, in all likelihood the United Kingdom will continue to abide by EU privacy laws until the exact moment the union is broken, but there is little beyond conjecture to determine what would happen post-“Brexit.”¹² Assuming that there is no “adequacy decision” immediately available from the European Commission when the United Kingdom exits—determining that the United Kingdom’s cyber laws are strong enough to be compliant with the EU policies—companies would have to implement “standard contractual clauses” or “binding corporate rules” to transfer data from the European Union to the United Kingdom immediately after the exit.¹³ These clauses are approved by the EU government as sufficient to provide adequate safeguards to the privacy and data rights of EU citizens.¹⁴

International Organization for Standardization (ISO)

The ISO is an international nongovernmental organization dedicated to setting international standards for organization activity. ISO 27001 and 27002 encompass the ISO’s take on managing information security risks, providing a method to identify risks, plan to address them, and implement controls. ISO 27001 is organized in a “plan-do-check-act” manner similar to other ISO programs, making interaction with other ISO programs, such as ISO 22301 for business continuity management systems, possible if not encouraged. While compliance with ISO standards are not outright required by regulations, the close relationship between cybersecurity methods, risk management, and organization planning makes ISO’s organizational offerings across multiple perspectives potentially advantageous.

Cybersecurity Negligence Remains Undefined

One method to avoid traditional negligence liability in a U.S. court is by proving that the standard of care, set by the legislature or judicial precedent, has been met. But as yet there has been no clear, defined standard of care set in the question of cybersecurity negligence.¹⁵ Instead, a patchwork of state, federal, and international laws and regulations have combined to form a rough guideline: steps to secure data must be “reasonable” or “appropriate”—taking the relevant circumstances into account—in order to avoid liability.¹⁶ To satisfy this requirement of reasonableness, a company should use a risk assessment process and craft a cybersecurity plan based off the findings.¹⁷

Until recently, there was little guidance beyond industry report recommendations on what sort of process or measures were enough to be “reasonable” for companies in industries without specific cyber regulations.¹⁸ Currently, the U.S. private sector has been gravitating toward the U.S. National Institute of Standards and Technology’s (NIST) published cyber framework. NIST was originally given the responsibility to create the framework by Executive Order 13636, but the responsibility was then codified by the Cybersecurity Enhancement Act of 2014. Adapting to the NIST framework is currently voluntary for non–critical infrastructure (CI) companies, but company partnerships between non-NIST-compliant companies and CI are restricted, driving further adoption of the NIST standards throughout the economy. A similar scheme is rapidly being implemented within the federal contracting industry, requiring contractors to adopt specific data security standards to remain competitive for government contracts. As a result, more public-private business transactions are voluntarily becoming dependent on both parties having a NIST satisfactory level of cybersecurity. (Chapter 6 surveys standards and frameworks and contains a detailed section on NIST).

Specific U.S. Industry/Sector Regulations

While general laws on cybersecurity are sparse in the United States, some specific industries are highly regulated. As mentioned previously, critical infrastructure (CI) organizations must abide by the NIST framework as well as cooperate with the Department of Homeland Security, the Cyber Threat Intelligence Integration Center, and law enforcement with regard to cyber incident reporting and response.

The telecommunications sector is voluntarily covered by the NIST framework and is encouraged to hold regular meetings between the FCC and individual companies to discuss cyber programs for risk management.

Energy producers have similarly been put on the NIST framework from the Department of Energy’s Cybersecurity Framework Implementation Guidance and our regulated by specific regulatory bodies, such as the Federal Energy Regulatory Commission.

For government contractors, there has been a similar strengthening of cyber rules. In August 2015, the Department of Defense (DOD) released for the Defense Industrial Base (DIB) a revised version of the “Safeguarding Rule,” which requires companies contracting with DOD to implement a more expansive set of security controls.

Many other federal agencies are considering similar rules, with the Office of Management and Budget considering a comparable rule to apply to all contractors.

Financial services have had significant past regulation in regards to cyber, requiring compliance with rules set down by the Federal Financial Institution Examination Council on behalf of a slew of federal regulatory agencies. Companies that deal in securities and futures have been similarly regulated to necessitate the adoption of an information system security program (ISSP). The ISSP must meet certain generally accepted standards or risk censure by regulating organizations, pushing more industries into adopting the NIST framework. The Securities and Exchange Commission (SEC) has signaled an increased emphasis on advisors having adequate cyber policy, rather than on responses to a breach and the harm suffered by the client. The Financial Industry Regulatory Authority (FINRA) has also created a report on cybersecurity best practices, pertaining to cybersecurity planning for broker-dealers.

The health care industry must abide by a series of regulations under the Health Insurance Portability and Accountability Act (HIPAA), which were split into a “Privacy Rule” and “Security Rule.” The Privacy Rule establishes standards for the protection of certain personal health information.¹⁹ The Security Rule acts on the protections laid out by the Privacy Rule by addressing “technical and nontechnical safeguards that organizations called ‘covered entities’ must put in place to secure individuals’ ‘electronic protected health information’ (e-PHI).”²⁰ The Security Rule seeks to ensure the protection of personal health information while allowing new technologies to improve patient care.²¹

The previous examples are just a selection of some industries with specific regulatory schemes already being developed. Tom would be well served by asking his legal counsel to compile a more comprehensive list of regulations that pertain to his specific industry, simply to ensure that if regulations or guidelines exist, they are either being met or are being addressed in upcoming plans.

General Fiduciary Duty in the United States

The FTC has brought several regulatory actions against companies for failing to prevent unauthorized access to consumer information as “unfair or deceptive acts.”²² The settlements from these cases can involve increased information security requirements or long running independent audit schemes.²³ There are also state and federal laws that support private actions against companies for unfair and deceptive trade practices, data breach notification, and failure to timely notify—in addition to negligence or breach of contract claims.²⁴ There is no single federal notification rule, so depending on which state the corporation has interests, differing state regimes apply.

Corporate boards have a general duty to protect corporate assets, reputation, and goodwill.²⁵ This typically includes overseeing systems to manage risk to the organization’s operations—including cyber risks.²⁶ While the technical nature of cyber-based threats may be foreign to the typical corporate board, the same common-sense, due-diligence approach that the board applies to other duties should be applied to cyber as well. The directors should have an understanding of the cyber risks that face the company and create an appropriate advisory team to determine what the “best practices” are to mitigate those risks. Boards should also engage in oversight of the programs in place, procedures, trainings, and any disclosures.²⁷

The general trend of U.S. cyber regulations seems to point toward increased adoption of a “best practices” regime. While noncritical industries may not be directly regulated into following the NIST framework, the costs of not adopting such practices may outweigh the benefits, considering the potential legal penalties, regulatory fees, and loss of organization opportunities with more regulated industry.

Forecasting the Future U.S. Cyber Regulatory Environment

The general trend of U.S. cyber regulations seems to point toward increased adoption of a NIST-driven “best practices” regime. While noncritical industries may not be directly regulated into following the NIST framework, the costs of not adopting some clear cybersecurity practices may outweigh the benefits—considering the continuing growth in cyber attacks against organizations in conjunction with potential legal penalties, regulatory fees, and loss of organization opportunities for those who lack “adequate” or “reasonable” protection schemes.

However, it should be noted that NIST is not the end-all-be-all of cyber resources. Standards from the SANS Institute, Open Web Application Security Project, and the Control Objectives for Information and Related Technology have also been referenced in recent regulatory expansions, offering readily available ancillary standards by which a company could use to design a legally “reasonable” cyber program.

Left of Boom

According to A Playbook for Cyber Events, “The most important period of time in a company’s response to a cyber incident likely occurs before the incident occurs.”³⁰ Cyber breaches can happen quickly, not be detected for months, and then erupt into a volcano of trouble when discovered. Because of this volatility, the best way for a CEO to prepare the company for the legal requirements and ramifications of a breach is in substantial planning left of boom.

Without a specifically articulated regulatory standards for liability in a cyber incident scenario, the CEO and board should take steps to combat allegations of negligence or a violation of their fiduciary duty by showing that a reasonable degree of security has been put in place to guard against a cyber incident. While the definition of what qualifies as a reasonable degree of security is still up for debate, a process-oriented form of reasonableness is now widely adopted.³¹ To satisfy a process-oriented standard, the CEO should develop a process to identify risks, delineate plans to deal with those risks, then implement the plans with requisite oversight.³² Actions taken toward fulfilling a process may have to be proven to regulators, shareholders, and judges in the event of a data incident, which makes the recordation of all C-suite and boardroom planning, discussion, and actions imminently important.

The basic process could be designed and executed by a board level advisory committee, comprised of multidisciplinary professionals with some cyber familiarity. This cyber committee would be responsible for identifying cyber risk points and sensitive data, leading the creation and practicing of incident response plans, and ensuring that new security measures are constantly being incorporated into company’s cyber security apparatus—such as widespread data encryption practices depending on the data system.³³ A system for reporting cyber intrusions internally, with external partners in government or industry, and with regulatory or contractually required contacts should be developed and tested.

A board-level audit process should also be created to regularly review the advisory committee’s actions, plans, and recommendations. As previously mentioned, the audit’s methodology and findings should be written and preserved, as well as boardroom discussion over the audit’s results. In addition to audits, cyber incident simulations can help identify holes in a potential cyber response plan, as well as demonstrate dedication to a reasonable degree of “process” protection.

Legal should be deeply involved in the left of boom timeframe beyond articulating any applicable state or industry data regulations and directing documentation of the process. Past contracts should be revisited to ensure that included standards for the protection of proprietary information are being met, while future contracts should be written and examined with cybersecurity risks in mind.

Legal can help determine whether information sharing partnerships with government or with similar companies might be beneficial to a company’s cybersecurity prospects.

There should also be a discussion over the purchase of specific cyber insurance for organizations, which manage considerable cyber risks.

Boom and Right of Boom

After a boom occurs and the organization is notified of the breach, a quick reaction holds the key to mitigating damage from the breach—thus mitigating the potential expansion of liability from the breach.

The first response to a boom should come from the implementation of the prepared plan. Any response teams should be set in action with constant documentation of steps taken, with reports sent to the C-suite. A conversation with legal counsel—either with in-house or outside counsel depending on the potential need to preserve privilege—should be established immediately and sustained throughout the response to the crisis.

From the input of legal counsel, compliance with notification and data protection regulations pertaining to the subject industry should be adhered to. Beyond notification requirements, disclosure of the breach to partners in the private and public sector may create opportunities to gain further resources and information to mitigate damage. There may be some worry that disclosure to the government or public could harm the reputation of the company, this risk should be discussed and a strategy set. Owners of contractually transferred data should be notified as to the status of the breach and the confidentiality of their data. Notifying the public, and specifically those who might have had information disclosed by the breach, also warrants discussion with legal and other relevant parts of the company.

As the response plan is implemented, an internal investigation should be created to record events and actions. If possible, observing the movements and tactics of the attackers within information systems can help inform how to scrub their access to the system, as well as providing known failure points to strengthen in future defensive measures.

While an active defense, actively hacking back the hacking party, might seem attractive as a means to harry the offenders or to find out what data has been stolen, from a legal perspective it may do more harm than good. Using active defense beyond one’s own networks can expose private organizations to expanded liability, including liability for attacking another network.³⁴ If an active defense is necessary, receiving authorization from the foreign network owner before operations are commenced could help limit liability for actions taken.