States Enact Safe Harbor Laws That Provide Affirmative Defenses In Data Breach Litigation

In response to the growing threat of cybersecurity attacks, some state legislatures are creating incentives for private-sector companies to strengthen their cybersecurity practices. Those incentives include safe harbor laws authorizing companies facing data breach litigation to assert an affirmative defense against liability if the company can establish that it maintained an information security program that conforms to recognized standards. These policies have the goal of encouraging companies to adopt cybersecurity best practices, even in sectors that do not currently have specific cybersecurity requirements. The following provides an overview of these policies enacted by several states.