04/26/2016
Ozg Compliance Management: Data Security Laws and Regulatory in Delaware
http://delaware.ozglaw.com/2016/03/ozg-compliance-management-data-security.html
Each company that collects, processes, shares, stores, or disposes of personal data must ensure that these data are protected with the appropriate security measures. The Federal Trade Commission and State Attorneys General have interpreted the Federal and State Unfair and Deceptive Practices Acts to require the use of appropriate security policies and procedures. Numerous laws, regulations, and industry standards contain specific detailed provisions that define the required security safeguards.
Adopting reasonable security measures makes sense. Failure to do so exposes a company to fines or penalties from the regulators, class action suits for negligence by injured parties, and much more. If personal data are lost, exposed or compromised, the incident is likely to become known by the public, and in many cases, widely reported on blogs and tweets.
Goodwill Erosion – Bad press will negatively affect the image and brand of the company.
Financial Loss – Customers will take their business elsewhere; sales will be lost. The company will incur great expenses to compensate those whose personal data were affected by the incident.
Decreased Market Value – The value of the stock and market capitalization is likely to decrease.
Fines, Penalties or Damages – The disclosure of the deficiencies in the company data security policies and data handling practices, or its failure to comply with relevant laws may result in the assessment of significant fines or penalties by the regulators, stringent reporting and auditing requirements and much more.
We have worked on data protection matters since the early 2000s, and have a unique in-depth, experience and expertise with these issues. We have assisted hundreds of businesses of all sizes, in all markets, with respect to data security issues. We keep abreast of the most recent data security legal developments in the United States and abroad.
The depth and breadth of our knowledge of the data security bills, laws, regulations, government enforcement actions, jurisprudence, standards and industry guidelines provide the framework within which we advise businesses, shape internal policies, procedures and processes, and draft contracts that follow the applicable mandates, or train the company’s workforce and leadership on the relevant data protection issues and recent developments.
Our compliance services aim at providing our clients with the ability to understand the requirements of the complex and ever changing requirements that apply to their business. As security counsel to businesses, we have worked on a variety of data security matters.
Counseling on Applicable Laws and Standards
Depending on the market in which our client evolves, different laws apply to their business. We are very familiar with these laws and can quickly respond to their request, usually without any research time. For example, we regularly counsel our clients, on the data security laws and regulations that govern the handling of:
Financial information – under the Gramm Leach Bliley Act (GLBA), Fair Credit Reporting Act (FCRA), Fair and Accurate Credit Transaction Act (FACTA), Red Flags Rules;
Healthcare information – under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act;
Children information – as required under the Children Online Privacy Protection Act (COPPA) and other Federal and State laws;
Company documents management – in connection with record disposal laws;
Data of foreign residents, which are protected under foreign data protection laws such as those in force in Member States of the European Union;
State data security laws and regulations, such as the Massachusetts security regulations;
Security breach disclosure laws;
Industry standards, e.g. PCI DSS.
http://delaware.ozglaw.com/2016/03/ozg-compliance-management-data-security.html
