The New Law of Information Security:What Companies Need to Do Now
By Thomas J. Smedinghoff, Baker & McKenzie
We are in the midst of a significant expansion of corporate obligations regarding security for digital information. Most businesses are, or soon will be, subject to two key legal obligations:
- A duty to provide reasonable security for their corporate data and information systems
- A duty to disclose security breaches to those who may be adversely affected by such breaches.Although information security law has been developing for some time, pressures for enhanced corporate legal obligations to implement information security safeguards were accelerated by several recent highly publicized security breaches involving the loss or disclosure of sensitive personal information.
Described by many as the “perfect storm,” the controversy began with a February 15, 2005 disclosure by ChoicePoint, Inc., a company previously unknown to most people, that sensitive personal information it had collected on 145,000 individuals had been compromised, and was at risk of unauthorized use for purposes such as identity theft. In the five months that followed, over 60 additional companies, educational institutions, and federal and state government agencies, almost all household names, also disclosed breaches of the security of sensitive personal information in their possession, affecting a cumulative total of over 50 million individual records.
And perhaps most significantly, the persons whose sensitive information was compromised included the chairman of the FTC and as many as 60 U.S. Senators.
Get the complete whitepaper here
|
