New Mexico recently became the 48th state to enact a data breach notification law. This continues the accelerated pace of state data breach legislative activity in the last two years. Since 2015, at least 41 states have considered legislation relating to data security incidents, and at least 16 states have enacted or amended such laws.
Cybersecurity
CFPB Management Challenges Include Information Security
By Kim Phan on
On September 29th, the Office of the Inspector General (OIG) that oversees the CFPB released a memorandum detailing the major management challenges facing the CFPB. The memo identified four areas of improvement that, unless addressed, would otherwise hamper the CFPB’s ability to accomplish its strategic objectives:
- Ensuring an Effective Information Security Program
- Ensuring Comprehensive Policies
…
CFPB brings its first data security enforcement action
By Kim Phan on
Last August, we blogged about a Third Circuit decision that held the FTC can regulate cybersecurity policies and procedures as “unfair” acts or practices under Section 5 of the FTC Act. In our blog post, we commented that banks and other companies subject to the CFPB’s jurisdiction faced the possibility that the CFPB could begin…
ACC releases largest study of its kind on cybersecurity preparedness among in-house counsel
By Daniel JT McKenna & Philip N. Yannella on
Posted in Cybersecurity, Regulatory and Enforcement
The Association of Corporate Counsel Foundation (ACC) released a State of Cybersecurity report on December 9, 2015. Ballard Spahr was the only law firm that served on the advisory board for the study and helped to formulate the survey questions. The report provides valuable insights on cybersecurity issues from more than 1,000 corporate lawyers at…
Company prevails in challenge to FTC data security complaint
By Barbara S. Mishkin on
As we have previously observed, banks and other companies subject to the CFPB’s jurisdiction face the possibility that the CFPB could begin using its authority under Sections 1031 and 1036 of the Dodd-Frank Act (which proscribe unfair, deceptive or abusive acts or practices) to regulate cybersecurity policies and procedures.
For companies also subject to the…
CFPB Information Security Remains a Challenge
By Kim Phan on
The Office of the Inspector General (OIG) has released the “2015 list of major management challenges” faced by the CFPB that the OIG believes will hamper the CFPB’s ability to accomplish the CFPB’s strategic objectives. Like the 2014 list, one of the challenges identified by the OIG is the need to ensure…
Federal appeals court confirms FTC authority to regulate cybersecurity policies and procedures
By Barbara S. Mishkin on
Posted in Cybersecurity, Regulatory and Enforcement
Banks and other companies subject to the CFPB’s jurisdiction face the possibility that the CFPB could begin using its authority under Sections 1031 and 1036 of the Dodd-Frank Act (which proscribe unfair, deceptive or abusive acts or practices) to regulate cybersecurity policies and procedures. For companies also subject to the FTC’s jurisdiction, however, the threat…
CFPB and federal banking regulators increase focus on cybersecurity
By Keith R. Fisher on
Posted in Cybersecurity, Regulatory and Enforcement
As part of their increased focus on cybersecurity, the CFPB and federal banking are taking steps to raise financial institutions’ awareness about the need for preparedness. On June 24, 2014, the Federal Financial Institutions Examination Council (FFIEC) launched a web page that combines available resources from the federal regulators on cybersecurity.
In addition to heightening…