USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
insurance, upon discovering a potential data breach, organisations should: • immediately activate incident response plans and assemble response teams (legal, IT, security, com - munications, executive leadership); • contain the incident and preserve evidence for forensic investigation; • engage in communications with a threat actor using a threat actor communications expert; • conduct preliminary assessment to determine scope, nature and cause of the breach; • assess what personal data was accessed or acquired and which individuals are affected; and • evaluate risk of harm to individuals considering data sensitivity, likelihood of misuse and any actual misuse. There are many other additional actions that will likely need to be taken depending on the details surround - ing the incident, including, for example, the type of incident, type of data implicated, which laws are appli - cable, etc. Often, in the wake of an incident, competent authori - ties including state attorneys general, the FTC, HHS Office for Civil Rights, state regulators and sector- specific federal regulators initiate investigations based on breach notifications, consumer complaints or their own monitoring. Further, as information about the incident is made public, often following the required notifications, mass data privacy litigation follows, with plaintiffs filing class actions alleging negligence, breach of contract, breach of implied contract, unjust enrichment, violations of state consumer protection statutes and violations of state data breach notifica - tion laws, though standing requirements and damages theories remain contested and are addressed in detail in 2. Privacy Litigation . 1.7 Regulators Investigations The specific regulator having jurisdiction over inves - tigations is highly fact specific and can include a number of different federal agencies, state agencies and state attorneys general. However, regardless of the regulator, the investigation workflow is largely the same. Generally, the regulating authorities have moni -
tors in place to identify organisations which have suf - fered an incident and will do a preliminary fact-finding action to determine the scope and severity of the incident, which may be based on their own research (eg, of activity on the dark web), notifications made directly to them, notifications made to affected indi - viduals, complaints from the general public, or from other regulators who may not have jurisdiction, but did discover the incident. In most instances, an incident will give rise to overlap - ping jurisdiction amongst the regulators. This gives the regulators, who are often resource constrained, the ability to work together to allocate those resources. As such, many incident investigations are conducted by a consortium of regulators. Guidance Regulators often give guidance on privacy issues under their jurisdiction. Whether this guidance is binding depends on the regulator and through which mechanism the guidance was provided. This guid - ance often provides “safe harbour” rules in terms of which, if followed, the regulator will not pursue any actions. Further, regardless of the enforceability of the guidance, it can provide insight into what that par - ticular regulator reviews when making enforcement decisions. 1.8 Enforcement Proceedings and Fines Investigation and Enforcement Procedures Data privacy investigations in the US are initiated and conducted by multiple authorities with varying procedures depending on jurisdiction and applicable law. Enforcement proceedings vary greatly based on the regulator bringing the enforcement action. Most enforcements are resolved as the result of an agree - ment made between a regulator and the affected organisation. However, if no agreement is reached, the resulting actions differ between federal enforcement and state enforcement. At the federal level, most federal agen - cies have procedures internal to the agency to handle enforcement actions, causing federal court actions to be rare and arise only when an organisation appeals a decision made within the agency or if the agency refers a case to the Department of Justice. At the
550 CHAMBERS.COM
Powered by FlippingBook