Cro ell & Mori g |
P i a a d C e Th eats –
Natha ial J. WoodK isti J. Madiga
P a ti al St ategies to Li it Lia ilit
Cro ell & Mori g |
• Data I ide t Respo se O e ie• P i a a d C e se u it : – Regulato a d Litigatio T e ds
• Mitigatio St ategies
Age da
Cro ell & Mori g |
O e ie of Data I ide t Respo se
Cro ell & Mori g |
• I side Th eat
• S o de
‒ Neglige t E plo ee
‒ Ve do s & suppl hai
• Ta get
• Natio states
‒ Chi a
‒ Russia
‒ I a
• Ha kti ists
• O ga ized i e
• Dude i his o ’s ase e t
What a e the Th eats?
Cro ell & Mori g |
I itial Dis o e
INCIDENTIDENTIFIED
IT Staff Dete ts
IT Help Desk Call
d Pa t Notifi atio
La E fo e e t Notifi atio
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
Cro ell & Mori g |
I itial I estigatioFo e si I estigatio
Led B Cou selI te al Tea sd Pa t E pe ts
Retai ed Cou sel
Legal Re ie
I ide t Respo se PlaP i a PoliSe u it PoliDo u e t Rete tio
Ma age e t Re ie
O e sight & Ma age e tRoles & Respo si ilitiesCo u i atio St u tu e
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
Cro ell & Mori g |
Re ediatio & E ide e P ese atio
Ve if Data A essed
Ide tif & Fi Te h i al
Causes
P ese e E ide e of I ide t
T a k & Re o e Lost
Data
REGAIN TRUST INNETWORKSECURITY
CONDUCT DATAFORENSICS
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
SECURE THEINFRASTRUCTURE
Cro ell & Mori g |
Legal & Risk A al sis/Notifi atio
NOTIFICATION CONSIDERATIONSFede al & State Co plia e
Who to Notif ?P epa i g Mate ials
Ti i g Legal, Regulato , et .
La E fo e e t/Regulato Coo di atio
Media/Messagi gd Pa t P o ide s
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
MANAGINGNOTIFICATIONS
Go e e t
Co pa ies
Othe sSha eholde s
I di iduals
Do u e tatio of I ide t & A al sis
Qua tifi atio of E posu e
Notifi atio O ligatio s
Cro ell & Mori g |
P epa e fo Rou d P epa e I ediatel Fo
Follo ‐o I ide t Respo se Afte Notifi atio
Highl Pu li ized Ta gets of Atta k T pi all E pe ie e
Fu the Atta ks
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
Cro ell & Mori g |
Litigatio /Regulato E fo e e t
Busi ess Pa t e s/ Custo e s
Busi ess Pa t e s/ Custo e s
B ea h of Co t a tB ea h of Co t a t
I de itI de it
Suspe sioSuspe sio
Pu liPu li
ClassA tio sClass
A tio s
Statutoda agesStatutoda ages
I ju tio sI ju tio s
Regulato sRegulato s
Fi esFi es
Ci ilpe alties
Ci ilpe alties
Co se tDe eesCo se tDe ees
P ose uto sP ose uto s
C i i alPe altiesC i i alPe alties
Whistle‐lo e s
Whistle‐lo e s
False Clai s A t
False Clai s A t
Othe I pa ted Pa ties
Othe I pa ted Pa ties
E .: Ta get edit a d lass
E .: Ta get edit a d lass
I itial Dis o e
I itial I estigatio
Re ediatio & E ide e
P ese atio
Legal & Risk A al sis / Notifi atio
P epa e fo Rou d
Litigatio
Cro ell & Mori g |
Cro ell & Mori g |
Regulato a d Litigatio T e ds
Cro ell & Mori g |
• E fo e e t/Regulato s– P i a
• Data olle tio• Data sha i g
– Se u it• A ou d i fo atio• Affe ti g safet
• Litigatio – B B, i di iduals, lass a tio s– E e gi g issues ofte depe d o t aditio al to t lai s
• B ea h of o t a t, to t• Loss/ isuse of i fo atio• Se u it fla that esults i safet issue• P odu t pe fo a e/ a a t lai s• Da age to a d a d eputatio
Lia ilit Issues: Risk P ofile
Cro ell & Mori g |
• Se u it p odu ts
• High‐e d p odu ts
‐ Auto o iles
‐ Medi al de i es
‐ I te et‐ o e ted de i es that olle t i fo atio
• Vul e a le populatio s e.g., hild e
Busi ess Seg e ts U de Close S uti
Cro ell & Mori g |
• Mo e egulato s i ol ed– FTC a d SEC C e se u it P io ities
– FCC
– CFPB
• Mo e legislatio a d egulatio s– Multiple atio al data ea h otifi atio
p oposals
– P i a ill of ights
• Mo e ea h litigatio a d igge ea hes– A the
– Yahoo!
– E uifa
P i a a d C e se u it T e ds
Cro ell & Mori g |
FTC A t Se tio : UDAP
De epti e p a ti es Mate ial ep ese tatio o
o issio likel to islead o su e s a ti g easo a l u de the
i u sta es U fai p a ti es
su sta tial i ju ot easo a l a oida le ot out eighed e efits
Cro ell & Mori g |
• I ju ti e a d Othe E uita le Relief– Co du t– Repo ti g a d o ito i g e ui e e ts
• Re o e of fu ds ge e ated o du t a.k.a. ill‐gotte gai s– Co su e Red ess FTC‐ u efu d p og a he possi le– Re ai i g fu ds etu ed to U.S. T easu
Re edies U de the FTC A t
Cro ell & Mori g |
• P i a : O e spa a d sp a e ases a d o e tha ge e al p i a la suits. Issues i lude spa , so ial et o ki g, eha io al ad e tisi g, p ete ti g, sp a e, pee ‐to‐pee file sha i g, a d o ile e.g., is ep ese ti g p i a a d data se u it olle tio , use, o dis losu e p a ti es
• Data Se u it : Si e , al ost ases agai st o pa ies that e gaged i u fai o de epti e p a ti es that put o su e s’ pe so al data at u easo a le isk e.g., failu e to use easo a le se u it easu es
FTC A ti it : P i a & Data Se u it
Cro ell & Mori g |
• W dha : Thi d Ci uit affi ed FTC Se tio autho it o e p i a a d data se u it , a d that the o pa had fai oti e of la iolatio s
• La MD: Use of P P soft a e o et o k o tai i g edi al i fo atio ; Co issio fi al de isio u e tl o appeal to the Ele e th Ci uit
Re e t FTC A ti it /T e ds: P i a
Cro ell & Mori g |
• Regulatio of IoT still i ea l stages– Multiple U.S. fede al age ies ha e autho it of o e so e aspe ts of IoT
• Fede al T ade Co issio FTC , Food a d D ug Ad i ist atio FDA , Natio al High a T affi Safet Ad i ist atio NHTSA , Fede al Co u i atio s Co issio FCC
– Co fe e es a d epo ts p o ide i sight i to age age das a d usi ess guida e• Best P a ti es, su h as desig i g IoT p odu ts ith p i a i i d• Likel a eas fo go e e t i ui ies / i estigatio s e.g., S a t TVs, Vizio, Le o o ases
– E isti g la s a d egulatio s a e likel to e supple e ted a d e pa ded – Pe so al data p ote tio a d p i a o s i Eu ope GDPR a d othe egio s
• Default to highest sta da d
Regulato T e ds ‐ IoT
Cro ell & Mori g |
This is a optio al all‐out o . The fo t is Cali i Regula , pt.
C e se u it eets p odu t lia ilit
• Re e t FTC I te et of Thi gs e fo e e t a tio
• D‐Li k– C iti al se u it fla s i oute s that put
ho e et o ks at isk– Failu e to ade uatel se u e oute s a d IP
a e as as de epti e a d u fai t ade p a ti e
– D‐Li k as oth a ufa tu e of e efi ial p odu t a d olle to of se siti e data
– Si ila to p io e fo e e t a tio a d settle e t ith ASUSTek Co pute ASUS a d its oute s
Cro ell & Mori g |
Litigatio T e ds
Cro ell & Mori g |
• Massi e ea hes• Massi e litigatio• Plai tiffs a e e o i g o e sophisti ated ut still st uggle ith da ages• Settle e t fo ula sta ti g to e o e sta da dized, ut aluatio s still a
d a ati all
Ge e al Litigatio T e ds
Cro ell & Mori g |
B ea hes a e getti g la ge
Cro ell & Mori g |
• B ea h i pa ti g illio people• O e lass a tio la suits• Settle e t e e tl p eli i a il app o ed
– $ illio settle e t fu d– Plus usi ess p a ti e ha ges– Plai tiffs’ la e s ould get ea l $ illio
A the
Cro ell & Mori g |
• Multiple ea hes i pa ti g illio a ou ts• Majo it of lai s su i ed otio to dis iss
– Cou t eje ted sta di g halle ge– Cou t a epted loss of alue of PII as a ha– Reje ted effo t to poi t to othe data ea hes to defeat sta di g
Yahoo!
Cro ell & Mori g |
• I fo atio o illio people pote tiall e posed— a es, add esses, SSNs, DOB, DLN
• C edit a d u e s fo , i di iduals• O e ea f ee edit o ito i g offe ed• Class a tio la suits filed ithi hou s• Co t a t a dated a it atio a d p ohi ited lass a tio s• Ma ot e pe itted u de Califo ia la • CRA e ui es app op iate ide tit theft p e e tio a d itigatio se i es . . . at o
ost . . . fo ot less tha o ths Cal. Ci il Code . d G• E uifa has la ified this ill ot appl
E uifa
Cro ell & Mori g |
• A ti le III sta di g e ai s a ke defe se, ut plai tiffs a e getti g o e sophisti ated
• Defe da ts ofte o fo usi g o ele e tal sta di g
Sta di g
Cro ell & Mori g |
• FISA allo s su eilla e of o ‐U.S. i di iduals.
• Plai tiffs U.S. itize s, so e of ho e e atto e s a gued that the ould i e ita l e i etapped i iolatio of the Co stitutio
• d Ci uit uled that plai tiffs had sta di g as the e as a o je ti el easo a le likelhood that the go e e t ould i te ept thei o u i atio s
• The Sup e e Cou t e e ses:
o The i ju ust e suffi ie tl o ete a d i i e t
o Th eate ed i ju ust e e tai l i pe di g
o Ca ’t el o a spe ulati e hai of possi ilities, a d a ot a ufa tu e sta di g i fli ti g ha o the sel es
Clappe . A est I te atio al USA, I ., S. Ct. 8
Cro ell & Mori g |
• Plai tiff alleged that Spokeo iolated the FCRA p o idi g i a u ate i fo atio a out hi .• B ought lass a tio asse ti g statuto iolatio s a d seeki g statuto da ages.• S. Ct. e e ses th Ci uit dete i i g that Ro i s la ked A ti le III sta di g.• Satisfied pa ti ula ized i ju• Failed to satisf o ete i ju ; ust e eal a d ot a st a t .• Ni th Ci uit e e tl e‐affi ed its o igi al holdi g u de the Sup e e Cou t’s test
Spokeo, In . v. Ro ins, S. Ct.
Cro ell & Mori g |
• Video P i a P ote tio A t VPPA– I e Ni kelodeo Co su e P i a y Litig., F. d d Ci . petitio fo e t. do keted
/ / allegatio that defe da ts u la full olle ted pe so al i fo atio f o hild e u de i iolatio of VPPA as suffi ie t to esta lish sta di g .
– Ye sho . Ga et Satellite I fo. Net o k, I ., No. CV ‐ ‐FDS, WL , at * D. Mass. Sept. , allegatio that defe da t u la full olle ted ideo‐ ie i g ha its i iolatio of VPPAas suffi ie t to esta lish sta di g .
• Fede al a d Califo ia Wi etap La s– Mate a . Google I ., No. ‐CV‐ ‐LHK, WL , at * N.D. Cal. Sept. ,
allegatio that defe da t s a ed a d ead e ails i iolatio of i etap la s as suffi ie t to esta lish sta di g .
Allegatio of B ea h is Suffi ie t
Cro ell & Mori g |
• D i e ’s P i a P ote tio A t– K ekel e g . A oka Cty., No. ‐ DWF/TNL , WL , at * D. Mi . Aug. ,
allegatio that defe da t u la full a essed plai tiffs DMV e o ds a d aused e otio al ha as suffi ie t to esta lish sta di g .
• Video Re tal P i a A t– Boelte . Hea st Co ' s, I ., No. CIV. AT , WL S.D.N.Y. Ju e ,
allegatio that pu lishe dis losed plai tiffs’ su s iptio i fo atio as suffi ie t to esta lish sta di g .
• Fai De t Colle tio P a ti es A t– Chu h . A eti e Health, No. ‐ , WL th Ci . Jul , holdi g that FDCPA
eated a i ju he e a de to did ot e ei e e tai dis losu es, eati g sta di g .
Allegatio of B ea h is Suffi ie t
Cro ell & Mori g |
• Ca le Co u i atio s Poli A t CCPA– B ait e g . Cha te Co ' s, I ., No. ‐ , WL th Ci . Sept. , Allegatio
that defe da t etai ed plai tiffs’ PII i iolatio of CCPA as ot suffi ie t to esta lish sta di g .• D.C. Co su e P ote tio P o edu es A t DCPPA
– Attias . Ca eFi st, I ., No. ‐CV‐ CRC , WL D.D.C. Aug. , Appeal filed –Sept. , holdi g that ithout a o ete ot just pa ti ula ized i ju u de the DCPPA, plai tiffs did ot ha e sta di g .
• Fai a d A u ate C edit T a sa tio s A t FACTA– Ka al . J. C e G oup I ., : ‐ ‐ , WL D.N.J., O t , holdi g that lea i g
edit a d i fo atio o e eipts ithout p oof of esulti g edit a d f aud as ot suffi ie t to esta lish sta di g .
• Va ious State Co su e P ote tio Statutes– Du u . S ott ade, I ., No. : ‐CV‐ ‐SPM, WL E.D. Mo. Jul , holdi g that
the isk of futu e ha as too spe ulati e a d h potheti al to o fe sta di g .
Allegatio of B ea h is NOT e ough
Cro ell & Mori g |
• To dete i e hethe a e e allegatio of ea h of a statute is suffi ie t fo sta di g, ou ts e a i e:– The legislati e histo of the statute– Whethe the statute eates a p o edu al o su sta ti e ight
• Su sta ti e ight – usuall sta di g u de Spokeo– E a ple: U de the Wi etap A t, the p ohi ited eha io is the ha i.e. liste i g to
so eo e’s alls is ha ful. • P o edu al ight – o sta di g u de Spokeo
– E a ple: U de the Fai C edit Repo ti g A t, Co g ess i posed a se ies of p o edu es to p e e t a pe so f o suffe i g fi a ial ha . A iolatio of those p o edu es does ot auto ati all ause the ha Co g ess i te ded to p ote t agai st – fi a ial da age e.g.losi g o e o pa i g o e o e as a esult of a o gfull epo ted edit s o e.
– Whethe the ha p ote ted u de the statute is si ila to the ha i a o o la to ts. • E a ple: The Video P ote tio P i a A t p ote ts agai st a ha si ila to the ha p ote ted
the i asio of p i a a d i t usio upo se lusio to t.
O e all T e ds i Spokeo Sta di g A al sis
Cro ell & Mori g |
• Still ot a lass e tifi atio de isio s• So e aspe ts of lass e tifi atio a e getti g easie fo plai tiffs• Settle e ts a e ei g s uti ized
Class Ce tifi atio
Cro ell & Mori g |
• I di idualized Causatio s. I di idualized Da ages– Whe e the ou t ust ake i di idualized ausatio dete i atio s, i di idual uestio s
p edo i ate a d lass e tifi atio is u a aila le. – If the putati e lass a tio o l e ui es i di idualized da ages dete i atio s, the lass
a e e tified.• I di idualized da ages uts agai st lass e tifi atio ut alo e is i suffi ie t to
p e e t it. • Ni th Ci uit has effe ti el fo e losed as e tai a ilit as a defe se
Class Ce tifi atio —Easie i So e Wa s
Cro ell & Mori g |
• Ta get– $ illio settle e t– O je tio ased o alleged o fli t et ee lass e e s ho a olle t a d those ho
a ot– Re a ded Eighth Ci uit fo additio al a al sis
• P ofessio al O je to s
Class Ce tifi atio —Getti g S uti ized
Cro ell & Mori g |
• Plai tiffs o ti ue to get eati e ith da ages theo ies
• Cog iza le i ju o ha
– A tual ide tit theft
– Fea of futu e ha
– Be efit of a gai
– Di i ished alue of PII
– De i i is ha – e.g., lost ti e
• Causatio
– Co e ti g ha to the data i ide t
Da ages
Cro ell & Mori g |
Data B ea h Class Settle e t
COMMON ELEMENTS OF A SETTLEMENT
Da ages settle e t fu d• U ifo dist i utio• Relia e da ages
Rei u se e t lai s p o ess• Suppo ti g do u e tatio• Appeals p o ess
Su stitute o pe satio• F ee p odu ts o se i es
Co e ti e a tio• Re edial easu es• Thi d‐pa t o e sight
C edit o ito i g Atto e s’ fees
Ide tit theft a d e pe se ei u se e t I e ti e a a ds fo a ed plai tiffs
Cro ell & Mori g |
• A the : $ . /pe so illio lass e e s• So : $ ‐$ /pe so , lass e e s• Ho e Depot: $. /pe so illio lass e e s• Li kedI : $ /pe so , lass e e s• Wellpoi t: up to $ ‐$ /pe so , lass e e s
Pe Pe so Value Va ies D a ati all
Cro ell & Mori g |
Mitigatio St ategies
Cro ell & Mori g |
Life le C e a d P i a Risk Ma age e t. Ide tif A d
Classif Se siti e Data A d Regulated S ste s
•What A e The C o Je els ?
•Who Has Respo si ilit ?
. I ple e t Co t ols To P ote t Data A d S ste s
•Asset Ma age e t•People / Tale t Ma age e t•Co plia e / Regulato Mg t.
. Esta lish Clea Go e a e
•Roles & Respo si ilities•Audit/Repo ti g P o esses
•Co u i atio St u tu e
Cro ell & Mori g |
Life le C e a d P i a Risk Ma age e t. Re ie A dUpdate Poli ies & P o edu es
•Regula I te als•U de sta d Risk D i e s
• I dust Best P a ti es
. P epa e Fo A I ide t
• I ide t Respo se Pla• I ide t Respo se Tea•Retai Outside E pe ts•Co du t T ai i g
. Thi k A out E te al Risks
•Ve do / Suppl Chai•O ga ized C i e•Natio States•Ha kti ists
Cro ell & Mori g |
Life le C e a d P i a Risk Ma age e t
. Thi k A out I te al Risks
•Neglige t / Disg u tled E plo ees
• I side Th eats•Net o k Vul e a ilit
. Pa ti ipate I I dust A d Go e e t Pa t e ships
•CISA / ISACs• E ol i g Regulato La ds ape
. E po t Risks
•M&A• I su a e• SAFETY A t•Ma aged Se i es
Cro ell & Mori g |
• Majo sou e of se u it ea hes
• Po e o I stitute su e fou d % of ea hes e e aused e do s U.S. Cost of Data B ea h Stud
Ve do s a e ofte a eak li k
Cro ell & Mori g |
• Vet ou e do s i ad a e espe iall those ha dli g se siti e o pe so al i fo atio
‒ Ma dated C e se u it Co t ols
‒ Audit Rights
‒ B oad Notifi atio O ligatio + I estigatio Rights
‒ I de it
‒ C e i su a e
‒ Co t ol of otifi atio s a d usto e o u i atio s
Co t a ti g Mitigatio St ategies ‐ Ve do s
Cro ell & Mori g |
• I dust /data spe ifi
• P a ti al Issues
• E ptio
• Mi i u use
• E plo ee a ess o t ols—least p i ilege
‒ Data dest u tio e ui e e ts
‒ Ce tifi atio
‒ Su ‐ e do s
Co t a ti g St ategies ‐ Ve do sC e se u it Co t ols
Cro ell & Mori g |
• Audit ight . a dati g audits
• Thi d pa t auditi g
Co t a ti g St ategies ‐ Ve do sAuditi g
Cro ell & Mori g |
• I ediate otifi atio of ea h
• Notifi atio of suspe ted ea hes as ell
• Outside s a d i side s
• U autho ized a ess, ot just isuse o theft
• Right to pa ti ipate i i estigatio
‒ Ve do sele tio
‒ Full dis losu e of i estigatio — ethods, fi di gs, o lusio s
‒ Be i dful of p i ilege o side atio s
Co t a ti g St ategies ‐ Ve do sNotifi atio + I estigatio Rights
Cro ell & Mori g |
• Li itatio o lia ilit
• T igge i g e e ts
‒ B ea h?
‒ Notifi atio ?
‒ La suits?
• Na o s ope
‒ What’s o e ed?
• Co t ol o e ho hi es the la e s
Co t a ti g St ategies ‐ Ve do sI de it Pitfalls to A oid
Cro ell & Mori g |
• Should e oupled ith audit e ui e e ts
• Othe ise ot o th the pape it’s itte o
• Pa ti ula l i po ta t fo s alle e do s that a ot e fi a iall apa le of ha dli g i de it o ligatio s
Co t a ti g St ategies ‐ Ve do sC e I su a e
Cro ell & Mori g |
• If ea h e ui es otifi atio , o t olli g o te t a d ti i g
• Regulato s
• Custo e s
• Othe affe ted thi d pa ties
• Call e te
Co t a ti g St ategies ‐ Ve do sNotifi atio a d Custo e Co u i atio s
Cro ell & Mori g |
• FTC‒ IoT: P i a & Se u it i a Co e ted Wo ld‒ Sta t ith Se u it ‐ A Guide fo Busi ess‒ P ote ti g Co su e P i a i a E a of Rapid Cha ge‒ Big Data: A Tool fo I lusio o E lusio ? U de sta di g the Issues‒ Co se t Ag ee e ts a d O de s
• Califo ia‒ Califo ia Data B ea h Repo t‒ P i a o the Go: Re o e datio s fo the Mo ile E os ste‒ Maki g You P i a P a ti es Pu li
• FDA‒ C e se u it Guida e fo De i es
Resou es: P i a a d Se u it
Cro ell & Mori g |
• Desig ith se u it a d authe ti atio to eet a o ti uall e ol i g sta da d of a e.
• Ide tif a d p ote t i te fa es et ee p odu t, de i es a d se i es.
• Wo k th ough ho the te h olog ope ates i o e tio ith legal li its o lia ilities a d i de ifi atio s.
• Test se u it easu es efo e lau hi g p odu ts o appli atio s a d th ough pe fo a e e olutio to e d of life.
• Sele t the se u e hoi e as ou default setti g.
• Use ou i itial o u i atio s ith usto e s to edu ate the a out the safest use of ou p odu t. –Co se t – o ti uous dis losu es
• Esta lish a effe ti e app oa h fo o ito i g a d updati g ou se u it p o edu es.
• Sha e hat ou’ e doi g to olle t a d se u e se siti e i fo atio a d defi e e e o e’s ole i the p o ess.
Co plia e Best P a ti es
Cro ell & Mori g |
K iste MadigaCou selk adiga @ o ell. o
Co ta t Us
Natha ial WoodCou sel
ood@ o ell. o
Cro ell & Mori g |
Cro ell & Mori g LLP is a i ter atio al la fir ith appro i atel la ers represe ti g lie ts i litigatio a d ar itratio , regulator ,
a d tra sa tio al atters. The fir is i ter atio all re og ized for its represe tatio of Fortu e o pa ies i high‐stakes litigatio , as ell as its o goi g o it e t to pro bono ser i e a d di ersit . The
fir has offi es i Washi gto , D.C., Ne York, Los A geles, Sa Fra is o, Ora ge Cou t , Lo do , a d Brussels.
© Cro ell & Mori g LLP
o ell. o
Top Related