There’s no question that this is one of the most difficult times we have faced. The turnaround from nearly full employment to 3,000,000 new unemployment claims, the sequestration of two-thirds of the population, the closing of restaurants, entertainment venues, places of worship, mass furloughs and layoffs, the elimination of the social interactions which we thrive on – these are not normal times. And, moreover, the world that emerges from the Covid-19 pandemic will be very different from the world that preceded it.
So with all of this going on, when many of you are simply trying to see how you can survive and emerge from this crisis, why should you worry about privacy and security?
Things Will Return to Normal
Eventually – and hopefully not terribly long from now – life will gain a new normality. It won’t necessarily be business as usual, but it will be some kind of business, and one thing that will return are the laws and regulations that govern us now. Just as the California Attorney General has decided (as of now) not to delay enforcement of the California Consumer Privacy Act, the other strictures regarding privacy and security aren’t going away. The crisis will not cause the FTC to stand down on its enforcement of claims of unfair and deceptive trade practices, the Department of Health and Human Services will continue to enforce HIPAA, the federal banking regulators will enforce the Gramm-Leach-Bliley Act, and as soon as they can meet, electronically or in person, state (and perhaps even federal) legislatures will press for more stringent privacy and security laws and regulations.
Some Changes will be Permanent
One change that is likely to stick beyond the end of the crisis is the move to remote working. Many workers will find that they like to work at home. Many businesses will realize that keeping their workforce in offices is less productive and costly. The possibility that waves of Covid-19 or other viruses may continue will make working remotely more common. And the success of online meeting tools – Zoom, Webex and others – will make both workers and companies realize that while in-person meetings are important, they aren’t always necessary.
A side effect, and one that we are already seeing, is the need to protect the expanding edge of network environments. As networks expand from the physical dimensions of an office to homes, security profiles change. Firms will need to consider how to maintain a secure computing environment when they have less control over that environment.
Security and Privacy is an Asset
An effective and compliant privacy and security program is a valuable asset that can differentiate a firm from its competitors. Clients and customers are increasingly sophisticated and recognize that a company whose privacy policy is dated before 2020 has not addressed the new obligations of companies to protect the personal information of its clients, customers, employees and others is behind the times.
Moreover, there are increasing liabilities associated with poor security and non-compliance. It is unlikely that any entity that does business in California is unaware of the private right of action that the California Consumer Privacy Act grants to individuals whose personal information has been compromised because a company failed to maintain “adequate security,” and that individual plaintiffs may be awarded between $250 and $750 for failure to maintain adequate data security. Many other state proposals, as well as federal initiatives, include a similar private right of action. In the absence of a data breach, the CCPA includes an enforcement mechanism giving the California Attorney General the ability to seek damages of between $2,500 and $7,500 for each violation of the CCPA. The stakes for companies are high, and getting higher.
What to Do?
In a crisis, companies should take the time to prepare for the aftermath. Many firms should see how they can adapt their business operations to take advantage of new opportunities and fend off threats. Companies now have the ability to allocate resources to protect themselves from breaches and establish compliance programs, which they will not as business eventually ramps up again. Companies that look forward to the new business environment and prepare for it will survive and thrive; those that do not will be left behind.
The JMBM Cybersecurity and Privacy Group assists clients both in complying with laws and achieving real data and information security. For more information, contact Robert Braun (RBraun@jmbm.com) or Michael Gold (MGold@jmbm.com).
Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.
JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.