Go back to the year 2005: the iPhone was still two years away, Facebook was still a niche product, Tweeting was a birds-only activity, and North Carolina became one of the first states in the union to enact a data breach notification statute.
The North Carolina Identity Theft Protection Act (ITPA) imposed data protection obligations that have now become standard in most states’ data breach notification statutes.
In the years following ITPA’s enactment, virtually all states have passed similar legislation. For its part, the North Carolina General Assembly seemed content to allow the ITPA to remain unchanged.
That state of affairs may be coming to an end.
Following a series of high-profile breaches in 2017, state lawmakers have signaled an inclination to take a tougher stance in the bipartisan Act to Strengthen Identity Theft Practices (ASITP). If ASITP becomes law, North Carolina will have some of the most stringent data protection laws in the nation.
“As more and more of our daily activities involve digital interactions, ensuring the safety of North Carolina’s citizen’s data is of critical importance,” said sponsoring Rep. Jason Saine. “When there is a breach, we need to ensure that consumers are notified in a timely fashion and that they have the tools they need to protect their personal identity from bad actors.”
Currently, ITPA in North Carolina mandates that businesses safeguard the personal information of their customers and clients. “Publishing” or failing to safeguard the personally identifiable information (PII) of residents could potentially violate the state’s Unfair and Deceptive Trade Practices Act. The violator would be liable for heavy damages and attorneys’ fees.
Among other provisions, ITPA requires that businesses:
- Protect social security numbers
- Dispose of records in a manner that protects sensitive information
- Institute policies to protect data, including employee training
- Notify affected North Carolina residents in the event of a data breach
ASITP stemmed from alarming statistics contained in the North Carolina Attorney General’s annual report. Attorney General Josh Stein noted that in 2017, 1,022 data breaches affected 5.3 million state residents, and hacking accounted for half of those breaches, a proportion that had doubled in five years.
The reports of hacking had increased by more than 3,500 percent in addition to an increase in reported phishing scams.
“This number is staggering and unacceptable,” Stein said. “North Carolina’s laws on this issue are strong – but they need to be even stronger. Rep. Jason Saine and I are partnering to do something about it.”
To this end, ASITP proposes two additional requirements. First, ASITP requires speedier notification to affected residents and regulators. ITPA’s only requirement is that notification be made without “unreasonable delay.” ASITP, however, would require notification within 15 days of discovery of the breach.
While 15 days may seem ample, affected business will find it to be aggressive.
Discovery of the breach, which starts the clock, is only the first step in the breach response process. In order to provide a fully informed notification, the affected business will need to investigate the nature and extent of the incident and should also consult with legal counsel regarding its obligations and potential exposure. Retention of experts and notification/remediation services (through counsel if possible, so as to protect legal privilege) will be required.
Depending on available coverage, it may have insurer-related obligations as well.
Given the complex nature and large number of tasks to be undertaken in the wake of a breach, a 15-day notice period could prove to be a very tight window. It is particularly tight for businesses that have not adequately prepared for a breach.
At a minimum, businesses should have anticipated the possibility of a data breach and drawn up contingency plans. Full incident response plans are even better, and ideally, those should have been periodically tested in so-called “table top” exercises.
Second, ASITP specifies that a breached business that failed to maintain “reasonable security procedures” will be deemed to have violated the Unfair and Deceptive Trade Practices Act. Moreover, each person affected by the breach would constitute a separate and distinct violation of the act.
Note that “reasonable security procedures,” like beauty, are often in the eye of the beholder. This is another reason why data security policies and contingency planning, preferably with assistance of counsel, should be adopted and undertaken before the business experiences a breach.
Being able to point to adequate and up-to-date security policies and planning will be helpful in showing that the business maintained “reasonable security practices.”
Given ASITP’s aggressive timetables and significant potential penalties, businesses should regularly review their security practices and procedures to mitigate legal and technical risk to the maximum extent possible. This is indeed an area where an ounce of prevention will be worth a pound of cure.