Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

2024

NYDFS Releases Artificial Intelligence Cybersecurity Guidance For Covered Entities

On October 16, 2024, the New York State Department of Financial Services (the "DFS"), under its Cybersecurity Regulation—23 NYCRR Part 500—issued a memorandum providing guidance on the risks posed by artificial intelligence ("Guidance Memo").

SEC Will Prioritize AI, Cybersecurity, and Crypto in its 2025 Examination Priorities

On October 21, 2024, the US Securities and Exchange Commission ("SEC") Division of Examinations ("Examination Division") announced its 2025 Examination Priorities ("Report"). Investment advisers and broker-dealers should ensure that policies, procedures and surveillance efforts related to these priorities address concerns outlined in the Report.

SEC Enforcement Heats up on Key Public Company Topics: Cyber Disclosure, Director Independence and Regulation FD

The U.S. Securities and Exchange Commission's ("SEC") Division of Enforcement has recently brought a spate of enforcement actions relating to key topics for public companies. These include enforcement actions related to cybersecurity incident disclosure, director independence and Regulation Fair Disclosure ("Reg FD") violations, which are described below, and actions based on Section 13 and 16 beneficial ownership filings, as discussed in our prior alert.

Judge Rejects SEC’s Aggressive Approach to Cybersecurity Enforcement

On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.

NIS 2 Directive: Navigating the challenges of implementation, impact, and scope

The NIS 2 directive establishes a regulatory framework aimed at improving the level of cybersecurity across the EU.

SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures

On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.

2023

The SEC’s Charges Against SolarWinds and its Chief Information Security Officer Provide Important Cybersecurity Lessons for Public Companies

On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.

SEC Adopts Mandatory Cybersecurity Disclosure Rules

On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.

Shaping the future of digital and cybersecurity governance

In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

cybersecurity_square_800x800_4

Prioritizing cybersecurity at the corporate level

In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

digital mesh

Cybersecurity Developments and Legal Issues

The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.

client alert image

Directors face personal liability over cybersecurity failures

In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".

wafer circuit detail

2022

Director liability for cyber breaches: transatlantic warning signs?

Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.  

arrow

SEC Proposes Mandatory Cybersecurity Disclosure Rules

On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.

2021

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

2020

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

2019

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Alert
|
8 min read

White & Case Tech Newsflash

World in Transition

Our views on changing dynamics in energy, ESG, finance, globalization and US policy.

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers. Most of the California Privacy Rights Act ("CPRA") will not take effect until January 1, 2023, giving weary businesses some lead time for their compliance efforts. In this client alert, we set out the key changes for businesses to be aware of as they look forward to meeting their obligations under the CPRA

 

Background on the CPRA

Describing the CCPA as a great baseline, one of the CCPA's original proponents filed the CPRA ballot initiative (or Proposition 24) to further enhance consumer privacy in California. To preserve the full strength of the CPRA, the ballot initiative included a provision limiting legislative amendments that might weaken its provisions.  California voters elected to pass Proposition 24 at the ballot, paving the way for the CPRA to become effective on January 1, 2023. In the meantime, only the administrative provisions of the CPRA, which establish the California Privacy Protection Agency and call for new regulations, will become immediately effective.  

The CPRA contains a detailed rulemaking process, which directs the California Attorney General to begin issuing regulations until the California Privacy Protection Agency is established and is able to assume rulemaking responsibility. Much like the CCPA, the CPRA leaves the determination of many of its definitional and procedural nuances to a long rulemaking process. With final regulations required under the CPRA by July 1, 2022, many specificities will be left in flux until then. While businesses will not need to start from scratch to comply with the CPRA, more granular data-mapping will likely be required and businesses may need to reassess a number of choices made in their initial CCPA compliance efforts.  

 

CPRA's Changes to the CCPA

In its 52 pages, the CPRA makes significant changes to the compliance burden imposed on businesses by the CCPA. We set out below a summary of the key additions and modifications to the CCPA's existing requirements.

  • Establishes the California Privacy Protection Agency. The CPRA establishes the California Privacy Protection Agency (the "Agency") to take responsibility for promulgating rules and enforcing the amended CCPA via administrative proceedings and fines of between $2,500 and $7,500 per violation. Once it has been stood-up, but by no later than July 1, 2021, the Agency must assume the rulemaking responsibilities under the CPRA. Notably, the Agency will have the power to conduct audits of businesses to ensure compliance with the CPRA.  
  • Eliminates the 30-Day Cure Period for Violations of the CPRA. Under the CCPA, businesses were given 30 days to cure alleged violations before any administrative enforcement by the California Attorney General.  The CPRA eliminates that 30-day cure period permitted under the CCPA. Now, at most, the Agency has the discretionary power to provide the business with a time period to cure. However, it must do so with an eye to the intent of the business to violate the title and voluntary efforts it took to cure the alleged violation. In addition, the CPRA clarifies the scope of the right to cure available for personal information security breaches, noting, "implementation and maintenance of reasonable security . . . following a breach does not constitute a cure with respect to that breach."   
  • Requires the Implementation of Reasonable Security Procedures & Practices. The CPRA includes an affirmative requirement for businesses that collect consumers' personal information to implement reasonable security procedures and practices. Businesses must identify and implement procedures and practices that are appropriate to the nature of the personal information processed and the potential risks. Importantly, this affirmative obligation means businesses may face administrative fines (even in the absence of a data breach) where they fail to maintain reasonable security to protect consumers' personal information.  
  • Limits the Scope of the CCPA. The CPRA increases one of the threshold requirements to qualify as a "business" under the CCPA. To fall within the scope of the title, for-profit entities must process the personal information of 100,000 or more consumers or households, rather than 50,000 or more, as was the case under the CCPA.
  • Imposes Data Minimization & Storage Limitation Requirements. The CPRA limits the collection, use, retention and sharing of personal information to that which is "reasonably necessary" to achieve the specified purposes of processing. Businesses will likely need to revisit their data-retention policies to ensure compliance with this addition. 
  • Requiring Businesses to Perform Cybersecurity Audits and Risk Assessments. Subject to the eventual regulations issued under the CPRA, businesses "whose processing of consumers' personal information presents a significant risk to consumers' privacy or security," must perform annual cybersecurity audits and submit risk assessments to the Agency on a regular basis. The CPRA does not define processing that may result in a significant risk to the consumer, but requires a consideration of the size and complexity of the business and the nature and scope of the processing. Risk assessments will require businesses to weigh the benefits of the processing activities against the potential risk to consumers' rights associated with such processing. The goal of these risk assessments is to restrict or prohibit certain processing activities—where the risks of those activities outweigh the benefits to the business, consumers and other stakeholders. 
  • Enhanced Requirements for Vendor Agreements. The CCPA identified specific requirements and limitations that should be present in an agreement between a business and its service provider in order for transfers of personal information required under that contract to be excluded from the broad definition of "sale." The CPRA formalizes these relationships by mandating agreements when a business sells personal information to, or shares it with, third parties, contractors and service providers. As such, businesses may need to conduct a full audit and review of their data-sharing agreements to ensure they contain the provisions required under the CPRA. Additionally, service providers, contractors and third parties will also need to ensure they have adequate processes in place to comply with these required provisions.  
  • Creates a New Category of Sensitive Personal Information. The CPRA adds a new category of personal information, termed "sensitive personal information," and imposes additional restrictions on its collection, use and disclosure. Sensitive personal information includes data elements, such as government identification numbers, financial information, precise geolocation, racial and ethnic origin, the contents of certain communications and genetic data.
  • Expands Consumer Rights. The CPRA expands the Consumer Rights provided by the CCPA in a number of ways. These include:
    • Right to Correction. The CPRA adds a new consumer right by requiring businesses to use all commercially reasonable efforts to correct inaccurate personal information in response to a verifiable consumer request. 
    • Right of Deletion. The CPRA modifies the deletion right by requiring service providers, contractors and third parties to cooperate with the business to delete personal information pursuant to a consumer request. 
    • Right to Know. The CPRA expands the right to know by extending the period of time covered by consumer requests (applicable to personal information collected after January 1, 2022). The CPRA will also simplify compliance with the right to know for some businesses, as under certain conditions, disclosures in the privacy policy will be deemed to satisfy the business' obligation. 
    • Right to Opt Out of Sharing for Cross-Contextual Behavioral Advertising. The CPRA expands the right to opt out by requiring businesses to provide consumers with the ability to opt out of sharing personal information for the purposes of cross-contextual behavioral advertising. This change aims to ensure that consumers can opt out of this sharing even where it is not in exchange for valuable consideration.  
    • Right to Limit the Use & Disclosure of Sensitive Personal Information. The CPRA adds a new consumer right that allows a consumer to direct a business to limit its use and disclosure of the consumer's sensitive personal information for purposes other than those that are commercially necessary or as otherwise authorized by the CPRA. 

 

Next Steps

Although the new and modified obligations under the CPRA will not enter into force until January 1, 2023, businesses will need to be in a position to comply with obligations relating to personal information collected by businesses on or after January 1, 2022. Given the limitation on the power of the legislature to amend the ballot initiative, in all likelihood, today's language will be that which becomes enforceable in 2023. Despite the long lead time, businesses would be well-advised to begin the more detailed data-mapping processes, evaluations and establishment of cybersecurity programs and vendor agreement reviews that will be required by the CPRA at their earliest convenience to ensure they are not caught out once the deadline arrives. We will continue to provide updates and analysis of the CPRA's detailed requirements. Please do not hesitate to reach out, as our Data, Privacy & Cybersecurity Practice group is happy to take any questions about the new requirements under the CPRA and to assist your business in revisiting or implementing your compliance plans as January 1, 2023, approaches.

 

White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.

This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.

© 2020 White & Case LLP

Top