Strict Liability For Breaches Of Personal Data
Mark Rasch writes for SecurityFocus about a recent lawsuit in Minnesota (PDF) in which a victim who was included in a data breach of a financial service provider's 550,000 customer database sued the company for breach of contract, breach of fiduciary duty and negligence.
As Rasch goes on to detail in his article, the court threw out the case on a summary judgment motion by the company - but questions whether the "reasonable man" standard applied by the court is still appropriate in the face of both the increased occurrence (or, at least, the reporting of occurrences) of data breaches and new practices for better preventing the release of personal information in the event of a data breach.
Important questions, indeed! The company successfully prevailed this time - but would another court reach a different conclusion as to what's reasonable in some similar future case? Chief Information Security Officers have an on-going obligation to continually ensure their institution can pass the "what's reasonable?" test - something that's a dynamic, not a static one point in time, process.
Add your comment... (note that all comments are reviewed before they're published)