FTC Hosts Fourth Start with Security Event in Chicago
The Federal Trade Commission hosted its fourth Start with Security event in Chicago, IL on June 15, 2016. This event was the latest installment of the Start with Security business education initiative launched last summer to engage in proactive outreach with the business community on information security standards and FTC expectations at a time when the FTC’s authority to reactively regulate data security was being challenged in federal court. In addition to the Start with Security events, the FTC also responded by synthesizing their 50+ data security settlements into “10 practical lessons” to guide companies looking to proactively comply with FTC data security expectations.
SEC Interest in Cybersecurity Continues; Chair Views Cybersecurity as Biggest Risk to the Financial System
Securities and Exchange Commission Chair Mary Jo White emphasized the agency’s focus on cybersecurity preparedness and response at a conference in Washington, D.C. in mid May, stating “we can’t do enough in this sector.” Reuters reports that Chair White views cybersecurity as the biggest risk facing the financial system, quoting her as saying that “what we [have] found…is a lot of preparedness, a lot of awareness but also….policies and procedures [that] are not tailored to [entities’] particular risks.”
White House Announces Initiative Focused on Artificial Intelligence, Builds on Big Data Initiatives
This month, the White House announced a series of workshops and a working group to address the “benefits and risks” of artificial intelligence. The workshops, which are to be held in Seattle, Washington, Pittsburgh, and New York City, will take place between May 24 and July 7, and are expected to result in a public report issued by the end of the year. The workshops and report are expected to address familiar themes – “privacy, security, regulation, law, and research and development to be taken into account when effectively integrating this technology into both government and private-sector activities.” Participation by all stakeholders – academia, industry, the research community, civil society, and others – will be key to shaping a report that is likely provide an initial roadmap for regulatory and policy initiatives in the next administration.
Defend Trade Secrets Act Offers a New Response to Cyber Intrusions
Companies may soon have a new way to respond to hacking. On Wednesday, April 27, the House passed the Defend Trade Secrets Act (“DTSA”) by a vote of 410-2. The bill has already been approved by the Senate and has the Obama administration’s support, which means little stands in the way of DTSA becoming law within the next week.
Leaked Extracts on Working Party Opinion Indicate Approval of Privacy Shield May Not Be Imminent
Today, alleged extracts from the impending Article 29 Working Party Opinion on the adequacy of the Privacy Shield were leaked. These extracts indicate that a number of clarifications on the Privacy Shield documents will be required before the Working Party can confirm that the Privacy Shield, in its view, ensures a level of protection that is essentially equivalent to that in the EU. The full opinion is due to be published on Wednesday 13 April, and will form part of the package for consideration by the European Commission.
California Data Breach Report Gets Specific on “Reasonable” Information Security
This February, the California Attorney General released the “California Data Breach Report,” summarizing developments from 2012-2015. Drawing from 657 reports filed with the California AG impacting 49 million records, the report is notable for its “recommendations.” These recommendations are ostensibly non-binding guidance that may nonetheless serve as the basis for the AG’s understanding of what constitutes “reasonable” data security in future investigations and enforcement actions.
Cybersecurity Act of 2015 Signed Into Law
On December 18, President Obama signed into law an omnibus spending package for 2016 that included the Cybersecurity Act of 2015 (known in former versions as the Cybersecurity Information Sharing Act). After years of debate, the Cybersecurity Act establishes a framework to facilitate and encourage confidential two-way private sector sharing of cyberthreat information with the federal government and provides liability shields for cyberthreat information sharing, as well as for specific actions undertaken to defend or monitor corporate networks. The Cybersecurity Act also designates the Department of Homeland Security (DHS) to coordinate cyberthreat information sharing.
The Cybersecurity Act has important implications for cooperation among industry participants and with regulatory agencies in development of effective cybersecurity programs. Public-private cyberthreat information sharing is an important step to improve companies’ defenses and responses to the changing cyberthreat landscape. Though the Act is effective immediately, the attorney general and DHS secretary must release guidelines within 90 days.
FTC & FCC Memorandum of Understanding on Consumer Protection
The Federal Trade Commission (FTC) and Federal Communications Commission (FCC) have been active in recent years in bringing consumer protection enforcement actions, with a particular focus on privacy and data security issues. Recent regulatory action from the FCC associated with “net neutrality,” however, has blurred the line as to where each agency’s jurisdiction begins and ends, particularly for companies offering broadband Internet access service. Recognizing this uncertainty, on November 16, 2015, the FTC and FCC announced that the agencies had signed a “Memorandum of Understanding on Consumer Protection.” The MoU set out that the agencies will work together to “coordinate on agency initiatives where one agency’s action will have a significant effect on the other agency’s authority or programs.”
Trans-Pacific Partnership Agreement Touches Global Electronic Commerce
Last week, the New Zealand Ministry of Foreign Affairs & Trade has made public the text of the Trans-Pacific Partnership (TPP) Agreement. While the text of the TPP has been negotiated over the past seven years, several provisions relating to electronic commerce are remarkably timely and address key considerations for companies doing business abroad. Highlighted below are key initial takeaways from Article 14 of the TPP, on “Electronic Commerce:”
PLI Issues Cybersecurity Treatise
The Practising Legal Institute has published “Cybersecurity: A Practical Guide to the Law of Cyber Risk,” a treatise edited by Ed McNicholas and Vivek Mohan of Sidley Austin LLP. This “Sidley on Cybersecurity” treatise sets out in a clear and readable manner the complex legal framework for cybersecurity in the United States. We hope that it will be a practical legal guide for in-house attorneys, IT leaders, senior executives, and corporate directors concerned about cybersecurity risk.