Data security: What the law requires of IT

For most IT organizations, securing corporate data against compromise is priority No. 1. Girding the enterprise against breaches is a constant, thankless task requiring foresight, vigilance, and much in the way of IT expenditures. Keep up with the latest threats, or find your company in the headlines -- and your job on the line.

Such is the shift in attitude toward security in IT. In the Wild West, when Jesse James and Butch Cassidy robbed banks, we felt sorry for the banks and hunted down the outlaws. Today, when someone breaks into a company's computer system, our response is totally different: We blame the company for failing to provide adequate security.

[ Avoid "The top 10 security landmines" and keep up with the latest security trends on Roger Grimes' Security Adviser blog. ]

Codifying this shift is a complex blend of laws and regulations enacted to protect the confidentiality and integrity of valuable personal data and the individuals who might be harmed by a breach. Not complying with these mandates can result in grave legal consequences should your organization suffer a breach.

Here you will find a framework for understanding these legal initiatives, which, when viewed as a group, impose two key legal obligations on your organization: the duty to implement reasonable security measures to protect data, and the duty to disclose breaches to those affected.

The duty to provide security
There is no single statute or regulation that governs all of your company's information security obligations. Instead, an ever-expanding patchwork of legal requirements is continuously evolving to impose a comprehensive duty to provide "reasonable" or "appropriate" security to protect your corporate data.

At the center of this patchwork are numerous state and federal regulations: privacy laws that require companies to protect personal data; e-transaction laws that govern the accessibility and integrity of electronic records; corporate governance legislation that requires appropriate controls to protect public companies and their shareholders, investors, and business partners; and unfair-business-practice laws now interpreted to include failure to provide adequate security as an unfair business practice.

[ See Thomas J. Smedinghoff's "What the Law Requires" ( Part 1 | Part 2 | Part 3 ) as presented at InfoWorld's Enterprise Data Protection conference ]

Further complicating your obligations are recent lawsuits, in which a variety of legal theories have been asserted against organizations for failing to provide adequate security for their data. Some decisions have held that companies can be liable for negligence in failing to provide adequate security. Wolfe v. MBNA America Bank, which involved a negligence claim against MBNA America Bank for damages sustained by a victim of identity theft, is an example of this.