It usually happens after a reported data breach. The organization experiencing the breach sends notifications to affected individuals, as well as federal and or state agencies where appropriate and perhaps other parties. Not long thereafter, the organization receives an inquiry from one or more government agencies. These inquiries typically seek more information about the breach and its incident response process, but also the nature and extent of the organization’s data security policies and procedures in place prior to the breach. Deficiencies in any of these areas could support getting “whacked”!
On December 16, Pennsylvania’s Attorney General and soon to be Governor, Josh Shapiro, announced a settlement with a company that experienced a data incident in April 2021 that exposed 30,295 Pennsylvania consumers’ payment card information. Following an investigation jointly conducted by Mr. Shapiro’s office and its counterpart in New York, it was determined that the company “failed to properly employ reasonable data security measures in protecting consumers’ payment card information.” The forensic investigation revealed that in December 2020, an unknown hacker exploited a vulnerability in the company’s web servers that allowed them to steal customers’ payment card information and other personal information.
The company has agreed to pay $100,000 each to both the Pennsylvania and New York Attorneys General Offices. It also agreed to implement several security policies designed to protect consumer personal information including: (i) designating an employee to coordinate and supervise its information security program; (ii) conducting annual security risk assessments of its networks; and (iii) conducting annual employee training.
Businesses are increasingly facing a multitude of data privacy and security frameworks. Healthcare providers, for example, have to consider the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its privacy and security regulations, as well as more stringent state regulation. Of course, healthcare providers that process credit or debit cards for payment, also will have to consider the applicable provisions of the Payment Card Industry Data Security Standard (“PCI DSS”). A restaurant in New York will very likely need to consider the PCI DSS rules, but also the NY SHIELD Act when it considers what safeguards it needs to protect personal information. An insurance broker or agent also may have several frameworks to evaluate, such as HIPAA, if it is a business associate, and depending on the state of operation, that state’s version of the NAIC Data Security Model Law (nearly half of the states have adopted a version of this law).
In connection with his office’s announcement, AG Shapiro stated,
“Every corporation that does business in Pennsylvania needs to stay alert and protect their customer’s personal data or they will have to answer to my office in court.”
Pennsylvania Senior Deputy Attorney General Tim Murphy shared the announcement of the settlement on LinkedIn, noting,
Here is another data breach settlement following a joint investigation with my friends from the NY Office of Attorney General. My colleagues in the cyber community (especially insurers) should take note that some AG offices are going to keep whacking companies who lack basic components of an information security program.
Data breaches are difficult if not impossible to prevent in all cases, even when significant efforts are made to prevent them. When a breach happens, organizations should be prepared to respond, but also be positioned to avoid getting “whacked” should federal and/or state agency investigations follow. They can bolster their position in those cases with a strong compliance program that includes, among several other things, becoming more aware of their compliance requirements; conducting risk assessments; shaping their policies and procedures based on those assessments; documenting their processes, policies, procedures; and training employees.
Happy New Year and good luck in 2023!
About this Author
Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.
In short, his practice focuses on the matrix of laws governing the privacy, security, and…
You are responsible for reading, understanding and agreeing to the National Law Review’s (NLR’s) and the National Law Forum LLC’s Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.
Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is www.NatLawReview.com intended to be a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us.
Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.
The National Law Review – National Law Forum LLC 3 Grant Square #141 Hinsdale, IL 60521 Telephone (708) 357-3317 or toll free (877) 357-3317. If you would ike to contact us via email please click here.
