Utah Creates Data Breach Safe Harbor

Sheppard Mullin Richter & Hampton LLP
Contact

Sheppard Mullin Richter & Hampton LLP

Utah recently amended its breach notice law to provide certain defenses to companies who suffer a data breach. It is now the second state, after Ohio, to include such provisions. Specifically, entities that create and reasonably comply with a written cybersecurity program may have an affirmative defense to litigation resulting after a data breach. For the safe harbor to apply, the written cybersecurity program must:

  • be designed to protect against the security, confidentiality and integrity of personal information and anticipated threats and hazards;
  • reasonably conform to a recognized cybersecurity framework like NIST 800-171 or 800-53, ISO 27000, PCI DSS, and federal laws such as HIPAA and GLBA (among others); and
  • be appropriate to the “scale and scope” of the company, the information it collects, the activities in which it engages, and its resources and tools available.

Even if a written cybersecurity program is in place, there are certain exceptions. For example, if the entity had actual notice of a threat to the security of the personal information. Or, if it did not act in a reasonable amount of time to take known remedial efforts to protect the personal information.

Putting it into Practice. The Utah and Ohio laws provide incentives for companies to protect information in light of the safe harbor from certain litigation claims after a data breach. As a reminder, beyond these laws, many states require a written cybersecurity program as part of their data security laws.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Sheppard Mullin Richter & Hampton LLP | Attorney Advertising

Written by:

Sheppard Mullin Richter & Hampton LLP
Contact
more
less

Sheppard Mullin Richter & Hampton LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.