Understanding Global Differences in Data Breach Laws Critical to Incident Response

San Francisco — RSA Conference 2015 — Examine the Ponemon Institute’s ‘2014 Cost of Data Breach Study’ and it becomes clear there is a vast difference in the costs of dealing with a data breach in different parts of the world.

According to the report, one of the main factors affecting cost differences comes down to the severity of the various data breach laws and regulations in each country and how well those rules are enforced.

This reality makes it critical for businesses to understand the laws in the various geographies they operate in. At the RSA conference, a panel of experts explained Thursday that ignorance of data breach laws can drive up costs and potentially open a business up to penalties that make the bad news of a data breach even worse.

“We are facing a three-headed monster,” Larry Clinton, president and chief executive officer of the Internet Security Alliance, told the crowd. “The system is getting inherently weaker, attacks are getting…more sophisticated, and we are being faced with an explosion of new regulations.”

And more regulations seem to be always on the way. For example, earlier this year the NY State Attorney General proposed a plan to toughen the state’s data breach laws. There is also the ongoing controversy about the proposed federal Data Security and Breach Notification Act. 

But the situation can be even more complicated for businesses that are international in scope. Panelist Gene Fredriksen, chief information security officer at PSCU, recalled an incident at a company where a salesperson was laid-off following some merger and acquisition activity and responded by stealing proprietary information – including client lists. While uncovering the perpetrator was not difficult, he said, problems emerged when the situation was discovered to have impacted Germany, Spain, France and the U.K. as opposed to just the United States where executives felt they would have known what to do.

The executives were forced to rope in the legal staff to figure out how to handle the situation, which ultimately became a “laborious process,” he said.

James Halpert, a partner at international law firm DLA Piper and co-chair of its U.S. cyber-security practice, noted that different countries require different approaches. South Korea, for example, requires data notification up to “wazoo,” he said.

Studies have shown that moving too quickly in the aftermath of a breach can drive up costs, with organizations for example notifying too many people by mistake. Then there are the costs associated with fines and other expenses. 

“You want to know this if you going about running your incident response,” said Halpert. “You want to know what information has been lost and does that trigger a notice in these countries.”