The Download - July 2015

Edited by Stuart P. Ingis, Michael A. Signorelli and Ariel S. Wolf

Introduction:

In this issue, we review a number of federal agency developments, including the issuance of guidance by the Federal Trade Commission on data security practices, and by the Federal Communications Commission on the Telephone Consumer Protection Act. We discuss new laws enacted in three states addressing privacy and identity theft issues. On the international scene, we review legislative changes in Canada and privacy enforcement efforts in France. Finally, we include an announcement about new developments in Venable's State Attorney General Practice Group.

In this Issue:

Around the Agencies

• FTC Releases Report on Data Security Practices Summarizing Enforcement Actions
• CFPB Releases Faster Payment System Principles
• National Telecommunications and Information Administration Announces Multi-stakeholder Processes for Drone Technology and Cybersecurity
• Federal Communications Commission Issues Telephone Consumer Protection Act Guidance
• FFIEC Releases Cybersecurity Assessment Tool

From the White House

• White House Releases Proposed Privacy and Trust Principles

In the States

• Delaware Legislature Passes Privacy Laws
• Rhode Island Adopts Identity Theft Protection Law
• New Jersey Assembly Passes Bill Restricting Use of IDs by Retailers

International

• Canada Passes Federal Data Protection Law
• French Data Protection Authority sends enforcement notices to 20 websites for failing to obtain consent for cookies

Announcements

• Senator Mark Pryor to Lead Venable's State AG Practice, Joined by Erik Jones, and Kevin Turner

Around the Agencies

FTC Releases Report on Data Security Practices Summarizing Enforcement Actions

On June 30, 2015, the Federal Trade Commission ("FTC") released a report entitled "Start with Security: A Guide for Business." ¹ The report summarizes certain security practices that the FTC has identified in its more than 50 enforcement actions pertaining to data security. The report divides these security practices into the following categories: (1) collection, use, and disposal of personal information, (2) access control, (3) authentication practices, (4) encryption, (5) network segmentation and monitoring, (6) remote access, (7) product development, (8) service providers, (9) updating procedures, and (10) paper, physical media, and devices.

The report encourages businesses to adopt a number of security practices within each category. Specifically, the report recommends that businesses limit their collection of personal information to only that information for which they have a business need, that they dispose of personal information once they no longer have a business need for it, and that they substitute fictitious information for personal information whenever possible. The report also encourages businesses to limit access to personal information and administrative access to only those employees who have a business need for such access. The report further recommends that businesses implement strong authentication procedures, which should include developing a password policy that requires employees to use complex passwords, prohibiting the storage of user credentials in clear text, implementing a policy of suspending or disabling an account after repeated failed login attempts to guard against brute force attacks, and protecting against authentication bypass.

The report further recommends that businesses encrypt personal data from the moment they collect it until the moment they destroy it, use industry-tested forms of encryption, and make sure that the encryption is properly configured. According to the report, businesses should segment their networks so that they can provide increased security for particularly sensitive information, and they should implement intrusion detection technology so that they can identify and prevent attacks on the network. Businesses should also require that individuals with remote access to their network implement basic endpoint security, such as using a firewall and antivirus software, and they should limit the level of access that a third party can have within their network.

Additionally, the report recommends that businesses that develop products and services should ensure that their software engineers are trained in secure coding practices, that they follow the secure development guidelines set by the platform when applicable, that they verify that any privacy and security features work as intended, and that they test for common vulnerabilities. The report also encourages businesses to supervise the security practices of their service providers. Businesses are encouraged to incorporate appropriate security requirements into their contracts with third parties, and to conduct regular oversight of their service providers' security practices. Business should also regularly update their security with the timely implementation of software updates and patches and respond quickly to fix any publicly announced vulnerabilities. Finally, the report encourages businesses to protect paper records and portable media by securely storing records and devices, implementing secure transportation practices when transportation of portable media is necessary, and implementing secure data disposal procedures.

CFPB Releases Faster Payment System Principles

On July 9, 2015, the Consumer Financial Protection Bureau ("CFPB") released a set of principles setting out its vision for the consumer protections that should be incorporated into the development of faster payment systems. ² The principles address a number of issues, including consumer control, fraud and error resolution, transparency, cost, and access, among others. They encourage businesses that are developing faster payment systems to clearly inform consumers about when, how, and the terms under which they have authorized a payment, to provide mechanisms for reversing erroneous and unauthorized transactions, to clearly disclose any fees, and to make the system broadly accessible.

The principles also highlight a number of best practices with respect to privacy and data security. Specifically, the principles encourage businesses to provide consumers with information—when such information will be helpful to consumers—about how their data is transferred through the payment system, including what data is transferred, who has access to it, how the data can be used, and its potential risks. The principles also encourage businesses to build into their systems protections to detect and limit errors, unauthorized transactions, and fraud. The principles call for such systems to allow gateway institutions to offer consumers enhanced security protections and limit the value of consumer payment credentials by implementing tokenization or other such tools.

Footnotes

To view this article in full, please click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.