Tag: security

Posted on

10 (Mostly) Interesting Links on Data Breaches

data-breach1Data breaches are on the minds of a lot of people today, beyond the usual group of privacy and security professionals, privacy advocates, and lawmakers as a result of the Target breach.

I’ve compiled a list of 10 interesting links on data breaches (including some regarding their intersection with payments and privacy:

1.  Over 660 million breaches–The Target breach is certainly substantial, but certainly not a new occurrence.  To date, according to Privacy Rights Clearinghouse’s tally which they began in 2005, 662,081,528 records have been breached.

2.  EMV (Chip and PIN) Cards Touted as the Solution–More influentials and groups are taking on the position that EMV or chip and PIN cards, are the solution to prevent hackers and cybercriminals to get access to personal data–Target’s CEO and the National Retail Federation are beating this drum lately.

3.  But Really, EMV Cards Are Not A Swift Solution–Certainly, faster adoption of chip and PIN, or EMV cards, will likely lower fraud, and will place the US among Canada, Europe and just about everywhere else in the plastic card carrying world.  And, issuers have been sending out credit cards with chip and PINs (I have a couple) to US cardholders.  But, the technology remains pretty useless until merchants have the proper readers and software to accept the cards.  It likely won’t be a few years until chip and PIN take over, as payment networks, Mastercard, Visa and American Express have given their merchants until 2015 to obtain hardware and software to accept EMV cards…

4.  Encryption–Heartland Payment Systems took a beating in 2008 after their 2008  breach, with one of their big clients, TJX Companies losing an estimated $171 million in that breach.  But, Heartland was able to turn it around and is now touting end-to-end encryption.

5.   There Is No Federal Data Breach Notification Law–The public knows about data breaches as a result of 46 state and the D.C.’s data breach Laws.  Otherwise, we likely would have no idea how many records with personal information have been breached or may have fallen into the wrong hands.

6.  California Is The First State To Pass A Data Breach Notification Law.  This happened back in 2002.

7.  California Adds Onto Its Data Breach Law— SB 46 expanded California’s data breach law to require notification when passwords and usernames are included.

8.  What Is The Customer’s Liability?–If an individual finds there has been fraud, it will  depend on how a transaction was made.  Bottom line, using a credit card is best at the checkout or online.  (PaymentsLaw.com is mentioned!)

9.  The Payments Landscape Will Forever Be Changed, Or Not–Such large data breaches do bring about larger discussions on whether or not significant changes will be made.  A few experts give their 2 cents.

10.  What To Do If Your Info Was Hacked—Good tips on what to do if you get a notice your information may have been hacked, from Privacy Rights Clearinghouse.

Posted on

New additions to CA Data Breach Law

data-breach1

I’ll try to use this blog to sum up some of relevant results of California’s recent legislative session.  For today’s blog, which is also the inaugural post, the focus is on the expansion of California’s Data Breach Notification Law.

SB 46, which was signed by Governor Brown last week, expands the definition of personal information in California’s Data Breach Notification Law (Cal Civ Code 1798.29 and 1798.82). The law will require notice when a California resident’s username or email address is breached, or reasonably believed to have been breached, with its password or security question and answer that provides access to an online account.

There is a also a new method for how notice is to be provided for this new category of personal information:

1.  If no other personal information has been breached, notice can be provided in an electronic or other form to “direct the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.”

2.  If the breach involves login credentials of an email account, then the notice cannot be made to the email address but rather by other methods, including “by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.”

Attorney General Harris released the office’s first report in 2012 on data breaches, with a few recommendations: 1. Encrypt personal information when moving or sending outside of the secure network 2. Review and tighten internal security controls 3. Make breach notices easier to read. 4.  Expand data breach law to include passwords. (Check)

Bottom line, if you own or license this new category of computerized unencrypted personal information, be prepared by year’s end, as SB 46 goes into effect January 1, 2014.

This blog is for general information and educational purposes, not to provide legal advice. If you need legal advice, please consult with a qualified attorney.