On January 24, 2013, the UK Data Protection Watchdog—the UK Information Commissioner's Office (ICO)—fined Sony Computer Entertainment Europe Limited £250,000 (about $400,000) for its alleged failure to implement appropriate security measures and prevent a security incident that occurred in April 2011. The incident arose from the hacking of Sony's PlayStation Network gaming platform. Sony was considering appealing the decision at the time of this alert's publication.1
According to the ICO's news release on Sony, the security incident compromised the "personal information of millions of customers, including their names, addresses, email addresses, dates of birth and account passwords. Customers' payment card details were also at risk."2 UK data protection law requires data controllers to implement "appropriate technical and organizational measures against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."3 In particular, the security measures "must ensure a level of security appropriate to the harm that might result from security breach and the nature of the data to be protected"4 while taking into account the "state of the technological development and the cost of implementing these measures."5
The ICO considered the security incident at issue to be a serious breach of the UK Data Protection Act because of the weakness of the security measures on the basis that "the attack could have been prevented if the software had been up-to-date; thus considering that the security breach could have been avoided with appropriate security measures." Deputy Commissioner and Director of Data Protection David Smith said: "If you are responsible for so many payment card details and log-in details then keeping that personal data secure has to be your priority. In this case that just didn't happen, and when the database was targeted—albeit in a determined criminal attack—the security measures in place were simply not good enough."
Following the breach, Sony has rebuilt its PlayStation Network to improve the security of personal information. The resulting investigation and fine illustrate the ongoing and increasing global importance of data security requirements, especially European Union (EU) requirements.6 They further raise the issue of whether and how EU regulators and affected individuals should be notified of security breaches.
Current Legal Framework on Data Breach Notification
No Pan-EU Data Breach Notification Requirements
Currently, there is no pan-EU obligation to notify data protection regulators or affected individuals when a security breach occurs, nor is there a general definition of what a data breach is. The EU is comprised of 27 sovereign countries with different data protection laws; thus, the EU legal framework for security breaches is not harmonized, and the question of whether, when, and under what conditions security breaches should be notified is to be assessed on a case-by-case basis.
Like in the U.S., breach notification requirements in the EU remain fragmented. As of today, just a few EU countries require companies to notify data breaches. For example, Germany and Norway require companies to notify regulators and affected individuals (under certain circumstances). In contrast, some countries, such as Austria, have a legal requirement to notify affected individuals but not regulators, whereas other countries, such as Denmark, Ireland, and the United Kingdom, follow a voluntary approach based on codes and guidelines issued by regulators.
Depending on applicable law, specific thresholds and additional requirements may apply as to the triggers (e.g., types of data, assessment of harm), timing, scope, and addresses of the notification.7
Sector-Specific Breach Notification Requirements (Telecom Providers and ISPs)
EU data protection law currently has a sector-specific breach notification requirement, which generally applies to telecom providers and Internet service providers (ISPs).8 The general rule is that both regulators and adversely affected individuals must be notified where notification is required. Depending on the nature of the breach, notification to regulators must include remedial steps to address the breach. In some cases, individuals need not be notified if the provider demonstrates sufficiently that it had taken appropriate data security measures prior to the breach.
The Upcoming EU Data Protection Regulation and Other Legislative Initiatives
The EU data protection legal framework is currently being revised. A draft legislation, the EU General Data Protection Regulation (Draft Regulation), is triggering intense debates regarding Europe's data protection future.9 The Draft Regulation is in the legislative process and, once adopted, will apply throughout Europe. Although the date of implementation (and effectiveness) is not certain, introduction of a general breach-notification requirement is widely expected.
Other current EU legislative initiatives would require companies to notify security breaches. For example, the EU Commission today issued a new proposal for a Directive on Network and Information Security ("Cyber Security Directive").10 If adopted, this Cyber Security Directive would go further than personal data breach requirements. It will require operators of critical infrastructures in some sectors (i.e., financial services, transport, energy, and health) and providers of "information society services which enable the provision of other information society services" (e.g., app stores, e-commerce platforms, Internet payments, cloud computing, search engines, and social networks) to report incidents that have a significant impact on the security of their core services.11
Conclusion
Although the EU legal landscape is currently not entirely harmonized and most European countries do not have a mandatory notification regime for general data breaches (other than those applicable to telecom providers and ISPs), European regulators may generally take action if a company fails to comply with security requirements and does not notify regulators of a security breach. The Sony case illustrates the types of sanctions that regulators may impose when data breaches occur. It also underlines the importance of reviewing a company's security practices and implementing appropriate processes to remediate security breaches and develop a breach-notification strategy. The fine, and attention arising out of the incident, suggests that breach notification and response represent an increasingly global issue for enterprises.
Wilson Sonsini Goodrich & Rosati's privacy and data security practice routinely advises clients on privacy and data security matters, including compliance with EU privacy or data protection legislation. The firm also regularly assists companies with all legal aspects associated with the collection, use, and disclosure of consumer data. For more information on our privacy and data security practice, please click here. For additional information, please contact Christopher Kuner at ckuner@wsgr.com or +32 2 274 57 20, Cédric Burton at cburton@wsgr.com or +32 2 274 57 22, Anna Pateraki at apateraki@wsgr.com or +32 2 274 57 21, or Gerry Stegmaier at gstegmaier@wsgr.com or (202) 973-8809.
