Law@Work

When a business experience’s a data breach, after calling the CIO, its second call is going to be to its counsel, as it should be. Inevitably the business wants to know two things: what have you done to protect me from this exposure and what is my total exposure. Counsel better be prepared with a good answer to both, and I do not mean the standard lawyer response; “it depends.”

First, Counsel should have instituted policies and procedures to mitigate this exposure and should be in a position to reassure the victimized business. These policies include: (i) retaining only the most essential customer/employee information to minimize the risk of exposure; (ii) encrypting data; (iii) using outside vendors who are insured and can provide some cover; (iv) instituting policies to limit employee’s access to confidential information; and (v) instituting state-of-the-art data protection procedures. If counsel has done this, counsel can paint a picture of exposure that is favorable and limited.

Second, counsel must assess and, even more importantly, limit the total exposure. This means analyzing the type of data compromised and taking the appropriate steps to report the breach. Were customer account numbers stolen? If so, and the business is not a bank, the effect of the breach may be minimal and manageable. Did the hackers access highly confidential information like social security numbers, health data, trade secrets, sales data, bank account/credit card numbers, or other personal identifiers? If so, the business needs to act accordingly. Is the data from foreign entities? If so, counsel needs to have a plan to address foreign compliance.

Of course, unless you are a lawyer practicing in this area, you may not know the answers or solutions off the top of your head, but, at minimum you need to know the questions to ask:

1. What type of data was compromised?
2. How many accounts/people are effected?
3. Is the data in a form that it cannot be readily accessed (e.g., encrypted)?
4. What is the source of the data?
5. What states’ and/or countries’ laws might apply?