It’s a common complaint – most U.S. laws requiring data security never cough up the specifics of what must be done to comply. Unlike other areas of business regulation, data security requirements seem hopelessly vague:
- Several states’ PII laws require businesses to implement and maintain “reasonable security procedures and practices” to protect PII from unauthorized access, destruction, use, modification, or disclosure.
- Regulations under the Gramm-Leach-Bliley Act compel financial institutions to have a “reasonably designed”comprehensive information security program with administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.
- FACTA regulations require that consumer report information be disposed of “by taking reasonable measures to protect against unauthorized access to or use of the information….”
- HIPAA covered entities and business associates must address the security standards for ePHI in a way that protects against “reasonably anticipated threats or hazards” to ePHI security or integrity.
- The FTC enforces reasonable data security under Section 5 of the FTC Act, which prohibits unfair and deceptive acts in commerce, without explicitly mentioning data security and without any supporting regulatory standards for specific data safeguards.
Obviously, we can’t just put “remember to have reasonable data security” in a compliance checklist or internal audit protocol, because “reasonable” tells us nothing concrete about what specific security controls are needed to be compliant. So, why do these laws stop short of telling us specifically what to do?
Continue Reading Why don’t data security laws simply tell us what we need to do?
In a 
While preparing for an upcoming presentation for in-house lawyers on data security, I dusted off the events of three months ago, when Yahoo! Inc. unceremoniously fired its general counsel on March 1st, the very same day it filed its 
lp but think of the 
OK, IT mavens, listen up…how much better would your life be if you only had to manage and protect 20% of your company’s data? By eliminating 80% of your data you could free up oodles of storage, reduce licensing costs, shorten backup cycles, and drastically cut e-discovery preservation costs, not to mention go home on time for a change. For most this is an unrealistic pipe dream, but it doesn’t need to be. The trick is knowing which 20% to manage.
It lingers on – that vaguely guilty feeling that there’s something sanctionable, even illegal, about routinely destroying business data. That’s nonsense. It is well-settled United States law that a company may indeed dispose of business data, if done in good faith, pursuant to a properly established, legally valid data retention schedule, and in the absence of an applicable litigation preservation duty.
“What if ants were as big as dinosaurs?” I remember asking my kids that question, forever ago when they were young. Maybe the thought came from reruns of old monster movies, like the 1954 classic Them! (pictured here). Anyway, it was a cool game, for as the ant’s size multiplies, the laws of math, physics, and biology play their part:
There’s been a lot of news lately about “secret” messaging in government, including inside the White House and the EPA, and last week’s revelation that Vice President Pence conducted state business with a private email account while Governor of Indiana. So there’s lots of angst right now about under-the-radar communications. When you think about it, though, it’s really old news tied to new technology. The only difference is the growing sophistication of the tools in the last few decades. Old School: clandestine meetings in parking garages. New School: disappearing messages.
Sorry to revive ugly memories of last fall’s vituperative presidential campaign, in which 
It happens every day. A company spends a huge amount of money on a new technology system, without fully addressing the