It usually happens after a reported data breach. The organization experiencing the breach sends notifications to affected individuals, as well as federal and or state agencies where appropriate and perhaps other parties. Not long thereafter, the organization receives an inquiry from one or more government agencies. These inquiries typically seek more information about the breach and its incident response process, but also the nature and extent of the organization’s data security policies and procedures in place prior to the breach. Deficiencies in any of these areas could support getting “whacked”!

On December 16, Pennsylvania’s Attorney General and soon to be Governor, Josh Shapiro, announced a settlement with a company that experienced a data incident in April 2021 that exposed 30,295 Pennsylvania consumers’ payment card information. Following an investigation jointly conducted by Mr. Shapiro’s office and its counterpart in New York, it was determined that the company “failed to properly employ reasonable data security measures in protecting consumers’ payment card information.”  The forensic investigation revealed that in December 2020, an unknown hacker exploited a vulnerability in the company’s web servers that allowed them to steal customers’ payment card information and other personal information.

The company has agreed to pay $100,000 each to both the Pennsylvania and New York Attorneys General Offices. It also agreed to implement several security policies designed to protect consumer personal information including: (i) designating an employee to coordinate and supervise its information security program; (ii) conducting annual security risk assessments of its networks; and (iii) conducting annual employee training.

Businesses are increasingly facing a multitude of data privacy and security frameworks. Healthcare providers, for example, have to consider the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its privacy and security regulations, as well as more stringent state regulation. Of course, healthcare providers that process credit or debit cards for payment, also will have to consider the applicable provisions of the Payment Card Industry Data Security Standard (“PCI DSS”). A restaurant in New York will very likely need to consider the PCI DSS rules, but also the NY SHIELD Act when it considers what safeguards it needs to protect personal information. An insurance broker or agent also may have several frameworks to evaluate, such as HIPAA, if it is a business associate, and depending on the state of operation, that state’s version of the NAIC Data Security Model Law (nearly half of the states have adopted a version of this law).

In connection with his office’s announcement, AG Shapiro stated,

“Every corporation that does business in Pennsylvania needs to stay alert and protect their customer’s personal data or they will have to answer to my office in court.”

Pennsylvania Senior Deputy Attorney General Tim Murphy shared the announcement of the settlement on LinkedIn, noting,

Here is another data breach settlement following a joint investigation with my friends from the NY Office of Attorney General. My colleagues in the cyber community (especially insurers) should take note that some AG offices are going to keep whacking companies who lack basic components of an information security program.

Data breaches are difficult if not impossible to prevent in all cases, even when significant efforts are made to prevent them. When a breach happens, organizations should be prepared to respond, but also be positioned to avoid getting “whacked” should federal and/or state agency investigations follow. They can bolster their position in those cases with a strong compliance program that includes, among several other things, becoming more aware of their compliance requirements; conducting risk assessments; shaping their policies and procedures based on those assessments; documenting their processes, policies, procedures; and training employees.

Happy New Year and good luck in 2023!