Let's Be Reasonable: Clearer Guidance For Minimum Information Security Standards

"Reasonable" and "adequate" seem like benign terms — until you have to litigate using them as a standard for adequate data security. Over the coming years, the definition of "reasonable security" (and the alleged failure of companies to maintain that standard) will likely be much debated and litigated, costing companies millions of dollars due to the difficulty of agreeing and evidencing this level of safeguards. The only apparent certainty of a "reasonableness" standard in California is that the plaintiffs bar will sue to find out which combination of security controls (or lack thereof) will determine victory for the inevitable onslaught of class action cases.

Most data protection laws and regulatory agencies have historically lacked specificity regarding the minimum necessary controls for adequate data security. For example: