www.cooperlevenson.com NEW JERSEY PENNSYLVANIA DELAWARE NEVADA By Michael Salad, Esq. and Peter Fu, Esq. Increased reporting about data breaches in the popular media has caused the mistaken belief that cyber risks are limited to the sphere of e-commerce. In reality, cyber risks are broad – represented by virtual hazards that individuals and organizations encounter on a daily basis. As modern society increasingly relies on data technologies, the magnitude of virtual hazards continues to grow correspondingly. The continuous evolution of the electronic data continuum often leaves users overwhelmed and unable to understand the impact that cyber risks have on professional and personal lives. To simplify the landscape, this paper compartmentalizes cyber risks in to three traditional categories of liability: government enforcement, insurance coverage and litigation defense. Government Enforcement – Federal Cyber risks associated with government enforcement are the indirect risks of utilizing data technologies. This type of risk is often the greatest potential liability that users encounter because the threat of fines, penalties or loss of license are far more likely to occur than a data breach. Federally, cyber risks generally consist of liabilities relating to finance, health and national security data. Financial professionals are required to comply with the Gramm Leach Bliley Act (“GLBA”), which requires financial institutions to implement standards to limit the purposeful disclosure or unauthorized access to consumer nonpublic information. These standards require consumers to be notified of authorized and unauthorized disclosure of nonpublic information. The Health Insurance Portability and Accountability Act (“HIPAA”) requires most of the healthcare industry to comply with federal data retention and storage laws. Congress authorized national defense and intelligence agencies to compel data disclosure by businesses that store personally identifying data, including daily financial penalties from failures to comply. Federal laws regarding cyber risk are industry specific, which causes companies that provide hybrid services to become highly vulnerable to regulatory liabilities. For example, the GLBA provides that unauthorized access of data requires notification to the affected customers. However, under HIPAA, only wrongful transmission of data requires the same notification. Government Enforcement – New Jersey The State of New Jersey mandates similar requirements to GLBA and HIPAA. New Jersey law also requires notification to the New Jersey State police, certain credit monitoring bureaus, as well as to consumers in the event of an electronic data breach. New Jersey law defines a breach as any unauthorized access to consumer personal information. Additionally, New Jersey legislators have recently proposed legislation Continued that would subject online service providers and businesses that utilize any electronic platform subject to sales and use tax. Insurance Coverage Cyber risks associated with insurance coverage are also indirect risks of utilizing data processing and retention technologies. Cyber risk is a comprehensive concept that includes mechanical failures in hardware to malicious third party actions. Prior to 2014, adverse electronic data events were highly disputed among insurance companies, insurance regulators and insurance consumers. The only insurable electronic data events under a general commercial liability policy were events that were directly incident to the physical destruction or physical theft of data processing or retention devises. An enormous gap in insurance coverage was created for businesses facing increasingly common cyber risks such as data breach or loss. For example, an accounting firm with standard general commercial liability coverage could not claim a business loss for a loss of customer data, even if the losses arose from the physical destruction of a server or computer. Similarly, loss of customer data that arose from virtual destruction of a server or computer were not covered by insurance. In 2014, insurance regulators in all but four states in the United States agreed to permit the Insurance Service Office, the insurance industry conglomeration responsible for promulgating all standard insurance coverage forms, to specifically exclude all cyber events from general commercial liability policies, effective May 2014. As such, cyber risks have become akin to flood risk but without the safety net of federal flood insurance. Cyber events are widely treated as catastrophic events by insurance companies. Accordingly, negotiating a reasonable cyber risk insurance policy can be very complex. Businesses and individuals unfamiliar with the electronic data life cycle should seek professional assistance to ensure appropriate coverage for cyber events. Litigation Costs of Cyber Risks Cyber risks associated with litigation are direct risks that arise from data processing and retention technology. These risks are broader than data breaches and encompass consequential costs of utilizing technology. The best way to mitigate cyber risks is to contractually agree to alternative dispute resolution for all contracts involving the exchange of electronic data. Along with reduced litigation costs, the adjudicator in such disputes is often selected due to an expertise with cyber risks, minimizing the risk of judges or juries unfamiliar with data processing and retention capabilities. 1] 15 U.S.C.A. § 6801 [2] 15 U.S.C.A. § 6802 [3] 42 U.S.C.A. § 1320d-1 [4] 6 U.S.C.A. § 1861 [5] 6 U.S.C.A. § 121 [5] 6 U.S.C.A. § 121 [6] N.J. Stat. Ann. § 56:8-163 Michael Salad can be reached at 609.572.7616 or msalad@cooperlevenson.com. Peter Fu can be reached at 609.572.7556 or pfu@cooperlevenson.com.