ICLG – Cybersecurity Laws and Regulations – USA Chapter covers common issues in cybersecurity laws and regulations, including cybercrime, applicable laws, preventing attacks, specific sectors, corporate governance, litigation, insurance, and investigatory and police powers.
ICLG.com > Practice Areas > Cybersecurity > USA 
1.1 Would any of the following activities constitute a criminal or administrative offence in your jurisdiction? If so, please provide details of the offence, the maximum penalties available, and any examples of prosecutions in your jurisdiction:
Hacking (i.e. unauthorised access)
Yes. The federal Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, is the primary statutory mechanism for prosecuting cybercrime, including hacking, and also covers some related extortionate crimes such as in the context of ransomware. The CFAA provides for both criminal and civil penalties (which in the criminal context can range from 10 to 20 years imprisonment for some aggravated offences, with the penalties for non-aggravated offences otherwise listed below), and specifically prohibits: (1) unauthorised access (or exceeding authorised access) to a computer and obtaining national security information (imprisonment up to 10 years); (2) unauthorised access (or exceeding authorised access) to a computer that is used in interstate or foreign commerce and obtaining information (imprisonment up to one year); (3) unauthorised access to a non-public computer used by the United States government (imprisonment up to one year); (4) knowingly accessing a protected computer without authorisation with the intent to defraud (imprisonment up to five years); (5) damaging a computer either intentionally or recklessly (imprisonment up to five years); (6) trafficking in passwords (imprisonment up to one year); (7) transmitting threats of extortion, specifically threats to damage a protected computer and threats to obtain information or compromise the confidentiality of information (imprisonment up to one year); and (8) cyber-extortion related to demands of money or property (imprisonment up to five years). In Van Buren v. U.S., 140 S. Ct. 2667 (2020), the Supreme Court substantially limited the ability of the CFAA to penalise insider threats.
Other relevant laws applicable to cybercrimes include the Electronic Communications Protection Act (“ECPA”), which provides protections for communications in storage and in transit. Under the Stored Communications Act (Title II of the ECPA), 18 U.S.C. § 2702, it is a criminal violation to intentionally access without authorisation (or exceed authorised access) a facility that provides an electronic communications service (“ECS”), which could include, among others, email service providers or even some employer provided email. Violations of the ECPA are subject to penalties ranging from up to 10 years for repeat violations for an improper purpose. The ECPA also prohibits intentionally intercepting electronic communications in transit under the Wiretap Act (Title I of the ECPA), 18 U.S.C. § 2511, with some exceptions available for law enforcement, service providers and others (including, potentially, employers). The Economic Espionage Act of 1996, 18 U.S.C. §§ 1831–1839, and the Defend Trade Secrets Act of 2016, 18 U.S.C. §§ 1836–1139, are further sources of potential criminal and civil penalties against the theft of trade secrets and other valuable intellectual property.
In addition to federal statutes, numerous states have passed statutes prohibiting hacking and other cybercrimes, some of which are broader than the federal statutes described. New York, for example, prohibits the knowing use of a computer with the intent to gain access to computer material (computer trespass), N.Y. Penal Law § 156.10, with penalties of up to four years’ imprisonment. New York is merely one example; dozens of such state laws exist. Determining which statute is applicable depends on several factors under conflict of law rules, including the location of the alleged act and the location of the impacted individuals.
Denial-of-service attacks
Yes, a DOS attack could violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) (intentionally damaging through knowing transmission, imprisonment up to 10 years), as well as state computer crime laws.
Phishing
Yes, among other statutes, phishing could violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) or constitute wire fraud under 18 U.S.C. § 2702, which carries a potential sentence of up to 20 years’ imprisonment.
Infection of IT systems with malware (including ransomware, spyware, worms, trojans and viruses)
Yes, planting malware would violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) (intentionally damaging through knowing transmission, imprisonment up to 10 years), as well as state computer crime laws.
Distribution, sale or offering for sale of hardware, software or other tools used to commit cybercrime
Conspiracy to commit an offence is often separately subject to criminal sanction. Whether distribution of hacking tools would constitute a crime would depend on whether the actor intended for them to be used for illegal purposes. If there were evidence of criminal intent, a person may be liable for aiding and abetting the violation of the CFAA, 18 U.S.C. § 1030(a)(5)(A), or related computer crime laws. With respect to federal statutes, aiding and abetting is subject to the same sentence as commission of the offence.
Possession or use of hardware, software or other tools used to commit cybercrime
As with distribution, mere possession of hacking tools would be difficult to prosecute in the absence of intent to use them for illegal purposes or related conspiracy. If there were evidence of criminal intent or conspiracy and some overt act taken towards that end, a person may be liable for an attempt to violate the CFAA, 18 U.S.C. § 1030(a)(5)(A), or related computer crimes laws. With respect to federal statutes, attempt is subject to the same sentence as commission of the offence.
Identity theft or identity fraud (e.g. in connection with access devices)
Yes, identity theft could be charged under the federal identity theft statute, 18 U.S.C. § 1028, as well as numerous state laws.
Electronic theft (e.g. breach of confidence by a current or former employee, or criminal copyright infringement)
Yes, electronic theft could violate the CFAA, 18 U.S.C. § 1030(a)(2) (obtaining information, without authorisation or exceeding authorisation, imprisonment of up to one year, or five if aggravating factors apply). It may also, or alternatively, violate the Economic Espionage Act, 18 U.S.C. §§ 1831–1839, which creates two crimes based on the theft of trade secrets; the first makes it a crime to acquire, without authorisation, trade secrets in order to benefit a foreign government, and the second if the theft will create economic benefit for others and will injure the target of the theft. While some courts previously held that obtaining information otherwise available on a computer system in violation of written policies prohibiting such access could constitute a violation of the CFAA, the Supreme Court recently found in Van Buren v. U.S. that violations of such purpose-based restrictions (i.e. restrictions imposed by contract or company policies) do not themselves constitute violations of the CFAA without other acts that exceed technical restrictions. 141 S. Ct. 1648 (2021).
Unsolicited penetration testing (i.e. the exploitation of an IT system without the permission of its owner to determine its vulnerabilities and weak points)
Yes. Unsolicited penetration testing could constitute a violation of the CFAA if the tester obtains data as a result or causes damage. To the extent information was obtained from the systems tested, such testing could violate 18 U.S.C. § 1030(a)(1) (national security information, imprisonment up to 10 years), (2) (obtaining information, imprisonment up to one year, or five if aggravating factors apply), or (3) (government computers, imprisonment up to one year). If the penetration tester causes damage, e.g. by impairing the integrity or availability of a system or data, the action could constitute a violation of § 18 U.S.C. § 1030(a)(5).
Any other activity that adversely affects or threatens the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data
The CFAA, 18 U.S.C. § 1030(a)(2), and wire fraud statute, 18 U.S.C. § 2702, as well as numerous state laws apply to a wide variety of criminal conduct online.
1.2 Do any of the above-mentioned offences have extraterritorial application?
Yes, the USA PATRIOT Act amended the CFAA and Access Device Fraud statute, 18 U.S.C. § 1029, to expressly apply them extraterritorially.
1.3 Are there any factors that might mitigate any penalty or otherwise constitute an exception to any of the above-mentioned offences (e.g. where the offence involves “ethical hacking”, with no intent to cause damage or make a financial gain)?
The nature of the crime, whether it was intentional or unintentional, whether it was committed for economic benefit or malice or ethical hacking, and the number of past offences may impact the severity of any penalty. The existence of a robust corporate compliance programme, as well as cooperation with law enforcement, may help to mitigate any penalty or influence prosecutorial discretion.
2.1 Applicable Law: Please cite any Applicable Laws in your jurisdiction applicable to cybersecurity, including laws applicable to the monitoring, detection, prevention, mitigation and management of Incidents. This may include, for example, data protection and e-privacy laws, intellectual property laws, confidentiality laws, information security laws, and import/export controls, among others.
Numerous federal and state laws include cybersecurity requirements. The Federal Trade Commission (“FTC”) has been particularly active in this space and has interpreted its enforcement authority under § 5(a) of the FTC Act, applying to unfair and deceptive practices, as a means to require companies to implement security measures. The FTC has brought numerous enforcement actions against companies it alleges failed to implement reasonable security measures. The US Supreme Court, however, has recently circumscribed the FTC’s abilities to seek monetary penalties for potential violations of the FTC Act without first utilising its administrative procedures.
Some federal laws, however, are sector-specific or extend only to public companies. Securities law generally prohibits fraud in connection with securities, and the Securities and Exchange Commission (“SEC”) has been rigorous in the enforcement of disclosure requirements for adequate public disclosures regarding cybersecurity risks and material cybersecurity incidents. Moreover, the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations require “financial institutions” to implement written policies and procedures that are “reasonably designed” to ensure the security and confidentiality of customer records, and protect against anticipated threats and unauthorised access and use. The Health Insurance Portability and Accountability Act (“HIPAA”) includes cybersecurity requirements applicable to protected health information in the possession of certain “covered entities” and their “business associates”.
At the state level, many states have passed laws imposing security requirements. Most of these statutes require some form of “reasonable security”. New York’s SHIELD Act, for example, requires reasonable security for personal information and specifies measures that may satisfy that standard. The California Consumer Privacy Act (“CCPA”) (expanded by the California Consumer Privacy Rights Act beginning in 2023) creates a data breach right of action for Californian residents with statutory penalties of $100 to $750 per consumer and per Incident if plaintiffs prove that the impacted business failed to implement reasonable security procedures to protect the personal information. Recently passed data protection laws in Virginia and Colorado also require “appropriate” security measures, and Massachusetts regulations have long imposed specific security requirements regarding personal information, including the implementation of a written security programme and encryption of certain data. Regarding defensive measures, including a Company’s ability to monitor for potential attacks, the Cybersecurity Information Sharing Act (“CISA”) has two primary impacts. Firstly, it allows companies to monitor network traffic, including taking defensive measure on their own systems. Secondly, it encourages the sharing of cyber-threat information between companies and with the government.
2.2 Critical or essential infrastructure and services: Are there any cybersecurity requirements under Applicable Laws (in addition to those outlined above) applicable specifically to critical infrastructure, operators of essential services, or similar, in your jurisdiction?
The Cybersecurity and Infrastructure Security Agency Act created CISA, a component of the Department of Homeland Security, and the federal agency responsible for protecting critical infrastructure in the United States. CISA coordinates between government and private sector organisations in protecting critical infrastructure and has begun to develop and transmit information to private sector entities regarding its expertise in cybersecurity vulnerabilities, incident response and cybersecurity risk. As a recent example, along with the FBI and NSA, the agency published substantial information regarding the Conti ransomware, including technical details, attack techniques, and mitigations to reduce the risk of compromise. The federal government has also issued sector-specific guidance for critical infrastructure operators, and the nuclear, chemical, electrical, government contracting, transportation and other sectors have detailed statutory and regulatory requirements.
2.3 Security measures: Are organisations required under Applicable Laws to take measures to monitor, detect, prevent or mitigate Incidents? If so, please describe what measures are required to be taken.
Generally, yes. U.S. cybersecurity laws exist at both the federal and state levels and vary by commercial sectors. For instance, several federal statutes have data breach notice provisions, but each state and four territories also have data breach laws. Many regulators expect regulated companies to have implemented “reasonable” security measures, taking into account factors such as the sensitivity of the data protected. In light of the proliferation of standards, many companies rely on omnibus cybersecurity frameworks like the NIST Cybersecurity Framework, covering efforts to identify and assess material foreseeable risks (including vendor security), design and implement controls to protect the organisation, monitor for and detect anomalies and realised risks, and respond to and then recover from Incidents.
In addition to general reasonable security requirements, some U.S. state laws or regulations are more prescriptive. For example, the New York Department of Financial Services Cybersecurity Regulation includes specific requirements such as annual penetration testing for covered entities.
2.4 Reporting to authorities: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents (including cyber threat information, such as malware signatures, network vulnerabilities and other technical characteristics identifying a cyber-attack or attack methodology) to a regulatory or other authority in your jurisdiction? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and scope of information that is required to be reported; and (d) whether any defences or exemptions exist by which the organisation might prevent publication of that information.
Yes, all states and four territories have requirements for the reporting of Incidents and most of these statutes require reporting to state regulators. The nature and scope of the information that is required to be reported varies by state or territory. For example, California requires the following information in notices sent to individuals: (1) the name and contact of the reporting person; (2) a list of the types of personal information breached; (3) the date of the breach (or estimated range); (4) whether notification was delayed by a law enforcement investigation; (5) a general description of the breach incident (if possible); and (6) toll-free numbers and addresses of the major credit card reporting agencies.
These state requirements are in addition to federal requirements that are sector-specific. For example, the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) requires covered entities and business associates to report certain Incidents involving Protected Health Information (“PHI”). Public companies must also report material events.
Timeframes for reporting vary by state or agency, with most requiring notification around the same time that individuals are notified (or sometimes in advance). Vermont requires any notification to its Attorney General to be sent within 15 days. Covered financial institutions are required to report breaches to the New York Department of Financial Services within 72 hours. At the request of law enforcement agencies, however, some notifications may be delayed.
Information about cyber threats generally need not be reported, although the federal government encourages participation in Information Sharing and Analysis Centers (“ISACs”) or Information Sharing and Analysis Organizations (“ISAOs”) where threat intelligence is shared within sector-specific groups of companies.
2.5 Reporting to affected individuals or third parties: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to any affected individuals? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of information that is required to be reported.
All 50 U.S. states and four territories have now passed breach notification statutes with varying requirements. Typically, breach notification statutes require notification be sent to individuals whose electronic Personal Information, as defined therein, was acquired in an Incident, though some states require notification based on access to such information alone. State definitions of Personal Information triggering data breach notification generally apply to the first name or first initial and last name in combination with another identifier, when not encrypted or redacted, such as social security number, driver’s licence or identification card number, or account number, or credit card or debit card number in combination with any required security code, access code or password that would permit access to the individual’s account. Increasingly, states are also including in the definition of Personal Information, health and biometric information, as well as usernames and passwords that provide access to an online account. Many states also require that notice be sent to Attorney Generals or other state agencies, often depending on the number of individuals impacted. Most states allow for consideration of whether there is a risk of harm to the data subjects, but some states do not allow for such consideration.
Timeframes for notification vary by state; however, 30 days is a common standard. Additionally, some sector-specific laws provide notification requirements. The HIPAA Breach Notification Rule, 45 CFR §§ 164.400–414, requires HIPAA-covered entities and business associates to provide notifications in the event of certain Incidents impacting PHI.
2.6 Responsible authority(ies): Please provide details of the regulator(s) or authority(ies) responsible for the above-mentioned requirements.
The regulator varies by sector, law and state. The FTC is the principal U.S. federal privacy regulator covering most for-profit businesses not overseen by other regulators. The SEC regulates many financial institutions and the OCR is primarily responsible for enforcing HIPAA. State Attorneys General have broad authority regarding enforcement of cybersecurity matters. In addition, federal and state regulators in particular sectors, such as insurance, have further enforcement powers.
2.7 Penalties: What are the penalties for not complying with the above-mentioned requirements?
The U.S. has no single framework for non-compliance with notice requirements and penalties will depend heavily on the relevant law and regulator. In addition to regulatory penalties, private plaintiffs may file actions alleging non-compliance with relevant laws. For example, the CCPA provides for statutory damages of between $100 to $750 per consumer and per Incident in the event of a data breach caused by the failure to have in place reasonable security measures.
2.8 Enforcement: Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements.
Hundreds of actions have been brought for non-compliance. For instance, Equifax agreed to pay at least $575 million as part of a settlement with the FTC, Consumer Financial Protection Bureau (“CFPB”) and 50 U.S. State Attorneys General, or other state regulators charged with overseeing data security, related to its 2017 data breach allegedly impacting approximately 147 million people. Government authorities alleged that Equifax failed to have in place reasonable security for the information it collected and stored.
Typical of the FTC’s enforcement is a case involving Uber in which it entered into an expanded settlement with Uber arising from a 2016 data breach, which the FTC alleged was not disclosed to the FTC for more than a year. The FTC had previously settled allegations related to an earlier 2014 breach. The FTC had alleged that Uber failed to live up to statements that access to rider and driver accounts were closely monitored, which, the FTC alleged, was not the case, rendering the statements false or misleading.
3.1 Are organisations permitted to use any of the following measures to protect their IT systems in your jurisdiction (including to detect and deflect Incidents on their IT systems)?
Beacons (i.e. imperceptible, remotely hosted graphics inserted into content to trigger a contact with a remote server that will reveal the IP address of a computer that is viewing such content)
Generally, yes.
Honeypots (i.e. digital traps designed to trick cyber threat actors into taking action against a synthetic network, thereby allowing an organisation to detect and counteract attempts to attack its network without causing any damage to the organisation’s real network or data)
Generally, yes, subject to the CFAA.
Sinkholes (i.e. measures to re-direct malicious traffic away from an organisation’s own IP addresses and servers, commonly used to prevent DDoS attacks)
Generally, yes, subject to the CFAA.
3.2 Are organisations permitted to monitor or intercept electronic communications on their networks (e.g. email and internet usage of employees) in order to prevent or mitigate the impact of cyber-attacks?
Yes, the CISA provides broad authorities to monitor network traffic, and employers can generally monitor employee communications where they first provide transparent notice of the monitoring and obtain consent from their employees.
Although the CISA may pre-empt them, state torts such as invasion of privacy may also limit an employer’s ability to monitor employee communications, but tort law claims can be overcome where an employer can show that the employee did not have a reasonable expectation of privacy in the communication. Notices and consents to monitoring should be carefully drafted to ensure compliance.
3.3 Does your jurisdiction restrict the import or export of technology (e.g. encryption software and hardware) designed to prevent or mitigate the impact of cyber-attacks?
Yes. Export Administration Regulations restrict the export of certain strong dual-use encryption technologies; however, licence exceptions may be available for exports.
4.1 Does market practice with respect to information security vary across different business sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws.
Cybersecurity laws in the United States vary significantly by business sector. There is currently no single U.S. cybersecurity law of general application other than, arguably, restrictions of “unfair” trade practices. Most businesses must comply with sector-specific federal and states laws. Healthcare organisations, for example, may need to comply with HIPAA, and many financial institutions are required to comply with the GLBA. Related state laws impose additional requirements.
4.2 Excluding requirements outlined at 2.2 in relation to the operation of essential services and critical infrastructure, are there any specific legal requirements in relation to cybersecurity applicable to organisations in specific sectors (e.g. financial services or telecommunications)?
Each of the sectors of critical infrastructure in the U.S. has its own separate regulatory regime. Energy, chemical, transportation and other sectors have detailed rules specific to their area. For example, in the financial services sector, financial services organisations must comply with the GLBA and its implementing regulations (which vary depending on the organisation’s functional regulator). The SEC, other regulators and industry groups, such as the Financial Industry Regulatory Authority (“FINRA”) and the National Futures Association (“NFA”), have published cybersecurity guidance that should be carefully reviewed. Red Flag Rules published by regulators require covered firms to adopt written programmes to detect, prevent and mitigate identity theft. The Fair Credit Reporting Act (“FCRA”) and Fair and Accurate Credit Transactions Act (“FACTA”) impose requirements with respect to credit reports. The FTC’s Disposal Rule, 16 C.F.R. § 682, issued pursuant to FACTA, requires certain practices for the destruction of certain information contained in or derived from a credit report. State regulators sometimes impose very significant further regulations, particularly in New York. A different example would be the Communications Act, as enforced by Federal Communications Commission (“FCC”) regulations, which requires telecommunications carriers and providers of Voice over Internet Protocol (“VoIP”) services to protect “customer proprietary network information”. Substantial fines and penalties can be assessed for failure to ensure adequate protections.
5.1 In what circumstances, if any, might a failure by a company (whether listed or private) to prevent, mitigate, manage or respond to an Incident amount to a breach of directors’ or officers’ duties in your jurisdiction?
Public company boards of directors and officers owe shareholders fiduciary duties, including the duties of care and loyalty. To fulfil these duties, among other things, boards and officers must ensure that they are properly informed regarding the company’s cybersecurity risks and the efforts the company has made to address them. Boards must also ensure that investors receive materially accurate disclosures of investment risk.
In the event of an Incident, boards and officers may face scrutiny and potentially litigation relating to their oversight of the company’s cybersecurity. For example, in the Yahoo! data breach, individual board members and officers faced a shareholder derivative action alleging that they failed to exercise their fiduciary duties, failed to ensure that proper security measures were in place, failed to adequately investigate the Incident and made misleading statements. The allegations were ultimately settled for a reported $29 million. In that same Incident, the SEC issued a $35 million fine.
5.2 Are companies (whether listed or private) required under Applicable Laws to: (a) designate a CISO (or equivalent); (b) establish a written Incident response plan or policy; (c) conduct periodic cyber risk assessments, including for third party vendors; and (d) perform penetration tests or vulnerability assessments?
Federal and state laws may impose specific cybersecurity requirements that depend on the entity’s functional regulator and the residence of the data subject. For example, the New York Department of Financial Services has issued regulations requiring covered financial institutions (which include banks and insurance companies) to, among other things, designate a CISO (or equivalent), establish a written Incident response plan and conduct a periodic risk assessment, annual penetration testing and biannual vulnerability assessments. Massachusetts information security regulations, likewise, require organisations that collect certain Personal Information from Massachusetts residents to implement a comprehensive information security programme that, among other things, identifies and assesses reasonably foreseeable internal and external risks to the security, confidentiality and integrity of such information. The New York SHIELD Act deems companies as compliant with its reasonable security requirement if they implement specified administrative, technical, and physical safeguards, including appointing an employee responsible for coordinating its cybersecurity programme and regularly testing the effectiveness of key controls, systems, and procedures. While not expressly required by regulation, the SEC has identified measures such as risk assessments, Incident response plans and penetration testing as elements of a robust cybersecurity programme for public companies and SEC registrants.
5.3 Are companies (whether listed or private) subject to any specific disclosure requirements (other than those mentioned in section 2) in relation to cybersecurity risks or Incidents (e.g. to listing authorities, the market or otherwise in their annual reports)?
Public companies are required to publicly report material cybersecurity risks, including material past Incidents. Even if a past Incident is not material, companies should consider them in evaluating their disclosures regarding cybersecurity. The SEC has recently increased its enforcement activity regarding public company disclosures. For example, the SEC alleged that Pearson plc, a London-based education company, made misleading disclosures regarding cybersecurity risks as hypothetical when it had recently been made aware of a breach. The SEC has issued guidance regarding the factors public companies should report with respect to cybersecurity. Private companies do not have the same public disclosure obligations but may need to inform potential investors or purchasers regarding past Incidents or cybersecurity risks.
6.1 Please provide details of any civil or other private actions that may be brought in relation to any Incident and the elements of that action that would need to be met.
Organisations that publicly announce Incidents involving a large amount of Personal Information will often confront class action litigations filed by plaintiffs whose information was impacted by the Incident. Typically, these actions involve several theories, including breaches of express or implied contracts, negligence, other common law tort theories, violations of federal or state unfair or deceptive acts or practices statutes or violations of other state and federal statutes, such as the CCPA.
Contract theories may involve claims of breach of contract where there is a written agreement between the plaintiff and the defendant that contains an express promise of reasonable security measures to protect personal information. Even if such a term is not included in the contract, many plaintiffs will assert a claim of implied contract, arguing that the receipt of a plaintiff’s personal information implies a promise to protect the information sufficiently. Tort theories may involve negligence or other common law theories such as invasion of privacy, bailment, trespass to chattel, misrepresentations or unjust enrichment. Each of these theories may prove challenging to fit to the data breach context.
Consumer protection theories are often also alleged, claiming that a victim of a data breach committed unfair or deceptive acts or practices. Deception claims are typically premised on an alleged misrepresentation about the security practices of an organisation. Plaintiffs may also allege that a failure to protect information is “unfair”; although many courts will require a showing of substantial injury or widespread and serious consumer harm. Plaintiffs may also allege violations of other statutes such as the federal FCRA or other state laws.
In addition to establishing the elements of their claims, plaintiffs filing in federal court are required to show that they suffered injury-in-fact sufficient to establish standing. Even where an injury alleged is sufficient for standing, it may not be sufficient to state a claim for damages. Some damages theories that plaintiffs attempt to assert, with varying success, include risk of future identity theft, credit-monitoring costs, other costs related to mitigating risks related to an Incident and overpayment for the products and services associated with the Incident.
While most class actions involve plaintiffs whose information was allegedly compromised, there has been an increase in shareholder derivative and securities fraud actions arising from Incidents as well. In shareholder derivative actions, plaintiffs will typically allege that a company’s officers and board of directors breached their fiduciary duties, wasted corporate assets or committed other mismanagement in failing to ensure that the company maintained what the plaintiffs consider appropriate security. As a preliminary step to any derivative action, plaintiffs must first either ask the board of directors to bring the action and, should the board refuse, prove that its refusal was contrary to the board’s reasonable business judgment. Alternatively, they must prove that such a request would be futile. Both theories are difficult to prove.
Plaintiffs may also allege securities fraud. To do so, plaintiffs must allege that the company made materially false or misleading statements, typically regarding the state of its cybersecurity posture, and that the company knew about the falsity of such statements.
6.2 Please cite any specific examples of published civil or other private actions that have been brought in your jurisdiction in relation to Incidents.
As noted, the public announcement of an Incident will frequently result in class actions and other lawsuits being filed against the impacted organisation. Hundreds of actions have been filed over the years; some recent prominent examples include the following:
6.3 Is there any potential liability in tort (or equivalent legal theory) in relation to failure to prevent an Incident (e.g. negligence)?
Yes, plaintiffs in data breach actions will often accuse the defendant of negligence or other tort law violations. A preliminary question any plaintiff must answer is whether there is any duty to protect the plaintiffs’ information. The answer to that question may vary by state. Courts in several states have found no common law duty to protect personal information, while courts in other states have found such a duty under particular facts and circumstances. In Dittman v. UPMC d/b/a The University of Pittsburgh Medical Center, for example, the Pennsylvania Supreme Court found that an employer owes a duty to employees to use reasonable care to safeguard what the court described as the employee’s “sensitive” personal data when storing it on an internet-accessible computer system.
The CCPA creates a data breach right of action for Californian residents with statutory penalties of $100 to $750 per consumer and per Incident if plaintiffs prove that the impacted business failed to implement and maintain reasonable and appropriate security practices.
In some states, defendants may assert the economic loss doctrine, which generally provides that contracting parties seeking damages for purely economic losses must seek damages in contract rather than in tort.
7.1 Are organisations permitted to take out insurance against Incidents in your jurisdiction?
Yes. Standalone cyber insurance policies typically cover both third-party liabilities arising from the defence and settlement of Incident-related claims, along with first-party cover for the policy holder’s own losses, which could include investigation costs, legal fees, notification costs and the costs incurred in providing credit monitoring and identity theft services. Cyber insurance policy forms are typically not standardised and vary significantly from carrier to carrier. In light of the recent increase in ransomware and other cybersecurity incidents, cyber insurers are increasing rates and demanding more information about companies’ security controls.
General liability or other policies may, in some instances, cover cyber-related losses, but costs related to Incidents are often excluded.
7.2 Are there any regulatory limitations to insurance coverage against specific types of loss, such as business interruption, system failures, cyber extortion or digital asset restoration? If so, are there any legal limits placed on what the insurance policy can cover?
There are no regulatory limitations specific to cyber insurance, but some states do not allow for insurance against certain violations of law.
8.1 Please provide details of any investigatory powers of law enforcement or other authorities under Applicable Laws in your jurisdiction (e.g. antiterrorism laws) that may be relied upon to investigate an Incident.
Law enforcement retains numerous powers to investigate Incidents. In addition to standard warrant and subpoena powers, law enforcement may seek records stored by electronic communication services or remote computing services through the Stored Communications Act, intercept communications in transit through the Wiretap Act or obtain dialling or routing information through the Pen Register statute. The CLOUD Act authorises law enforcement to access certain information held by a United States-based service provider, even if the data is located in another country.
For Incidents involving national security or terrorism, law enforcement may have additional powers. Under the Foreign Intelligence Surveillance Act (“FISA”), the government can obtain information, facilities or technical assistance from a broad range of entities. National Security Letters (“NSLs”) offer an additional investigative tool for limited types of entities.
Federal regulatory authorities such as the FTC, SEC and OCR have powers to investigate Incidents within their respective jurisdictions. State regulators may also investigate Incidents to determine whether any state laws were violated.
8.2 Are there any requirements under Applicable Laws for organisations to implement backdoors in their IT systems for law enforcement authorities or to provide law enforcement authorities with encryption keys?
Under the Communications Assistance for Law Enforcement Act (“CALEA”), law enforcement requires certain telecommunications carriers and manufacturers to build into their systems or services necessary surveillance capabilities to comply with legal requests for information.
No general U.S. laws expressly require organisations to implement backdoors in their IT systems or provide law enforcement authorities with encryption keys. Under the All Writs Act, some courts in some instances have ordered reasonable assistance, including in one notable case, requiring Apple to provide assistance in circumventing security features – which Apple successfully resisted until it was moot.
Edward McNicholas
Ropes & Gray
Kevin Angle
Ropes & Gray
Ropes & Gray
The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Group
We find these publications very useful, which we use as a quick reference guide. The areas covered within the publication are well written, and kept concise. The publication enables us to have a better understanding of the telecommunications regime within the different countries. As a reference guide, this publication provides a good insight. Many thanks.
Sonya Arora, Legal and Regulatory Officer – TalkTalk Direct Limited
© 2002-2022 Copyright: ICLG.com | Privacy policy | Cookie policy
