What to do in the event of a data breach

If your organization suffers a data breach, you are required -- in many instances -- to notify individuals that their personal information may have been compromised. Security breach notification laws enacted in almost all states are designed to help protect affected individuals by giving them due warning and the opportunity to take action to protect themselves against the consequences of identity theft and unauthorized account access.

The requirements of the security breach notification laws, however, present a maze of compliance obligations. Although the 44 state laws governing breach notification are similar, each presents a somewhat unique approach to the basic set of issues. How a company prepares for and responds to a security breach can be key to ensuring compliance.

Prevention: Your best legal defense
Given the adverse publicity that often follows a breach disclosure, a premium should be placed on taking steps, in advance, to reduce or eliminate the risk of having to make a disclosure. Perhaps the most basic step is to reduce or eliminate the amount of notice-triggering information that your company collects and maintains.

[ For a complete understanding of IT's security obligations see "Data security: What the law requires of IT" and Thomas J. Smedinghoff's Enterprise Data Protection presentation ( Part 1 | Part 2 | Part 3 ) ]

First, you should review your information-collection practices, both to identify where sensitive personal information is collected and stored, and to assess whether such information is really needed. In many cases, the retention of information subject to the security breach notification laws, such as Social Security numbers, may not be necessary. If it is, it is vital to have an accurate understanding and inventory of the sensitive personal data your company collects, how it is used, where it is stored, and how it is protected.

It is, of course, important to ensure that appropriate security measures are in place to protect this data. Encryption, in particular, provides a potential legal benefit, as breach notification statutes apply only to the compromise of unencrypted personal information. Thus, to the extent reasonably feasible, encryption of all sensitive personal information may well help you avoid the need to make embarrassing disclosures.

Regardless of the level of security implemented, breaches may still occur. Thus, companies should develop and implement a well-thought-out incident response plan.

Notification in the wake of a breach
If a breach of personal information does occur, the first step is to determine whether notification is required, and if so, who must be notified. Those seemingly simple questions often require very complex analysis and a review of numerous state laws.