The Home Depot Data Breach

© 2014 Colourbox

With up to 60 million customers affected, the recent security breach at North America’s largest hardware store, The Home Depot, once again proves that even some of the largest retailers have not implemented business processes that ensure the timely detection and communication, if not prevention, of such incidents. This post sheds a light on their dire consequences for consumers and what lawmakers in the U.S. and the E.U. intend to do about it.

Rate this:

The top 8 issues all CIO’s, CSO’s and CPO’s should know about how to notify data breaches in Europe

As the EU is about to enact a General Data Protection Regulation that will introduce a general obligation to notify personal data breaches for all companies doing business in Europe or directing it towards EU-based customers, we provide the reader with 8 of the most important aspects related to the implementation of this new obligation.

Rate this:

The Sony PlayStation Network Hacking Case (An Analysis of the UK ICO’s Resolution)

Sony Playstation. Photo by Armando Becerra (2013)

On January 14, 2013, the UK Information Commissioner’s Office imposed Sony PlayStation Network a monetary penalty of GBP 250,000 for its serious breach of the UK Data Protection Act – a penalty Sony eventually decided not to appeal in July. The penalty comes after the company was hacked in April 2011, compromising the personal information of millions of its customers. In this article, I highlight why the ICO made a brilliant move and interpretation of the Act.

Rate this:

The State of the State: U.K. Government Data Breaches

Government data breaches are very much a parochial problem in the U.K., causing indignation in widespread locales. In its recently published Annual Report for 2012/13, the Information Commissioner’s Office (ICO) states that data leaks by local authorities are a priority area for the data protection body. The ICO receives both individual complaints and declarations of self-reported data breaches from public and private entities.

Rate this:

The State of the State: U.S. Government Data Breaches

"Head in Hands" by Alex E. Proimos. Shot on December 14, 2009 at Monnaie, Paris, France. Available at http://www.flickr.com/photos/proimos/4199675334/. Published under a Attribution-NonCommercial 2.0 Generic (CC BY-NC 2.0) license.

Government data breaches run the gamut, but recently we are hearing about years-old security vulnerabilities that are not discovered by the government agencies themselves, but by outsiders. Plus, a review of the broad numbers regarding U.S. government data breaches of the past four years.

Rate this:

Towards a New Personal Data Breach Notification Framework in the EU

The European Commission published recently a Proposal for a Regulation on personal data protection. If adopted, it would repeal the 1995 Data Protection Directive. The Proposal includes a new data security framework: both the data controller and the data processor would have to implement appropriate technical and organizational measures in order to ensure that data is secure; a personal data breach would have to be reported within 24 hours to the supervisory authority, and also, without undue delay, to the data subject if the breach would adversely affect his personal data or privacy. We comment some of the pending issues.

Rate this:

New Brazilian Data Protection Bill Adopts Data Breach Notification Regime

"Metrô-Linha Vermelha" (Photo by "mlsirac"; shot on Sept. 11, 2010 in Sao Paulo, Brazil). Available at http://www.flickr.com/photos/mlsirac/4988830112/ (Creative Commons "Attribution-NonCommercial-NoDerivs 2.0 Generic (CC BY-NC-ND 2.0)" license.)

The new Brazilian Data Protection bill currently in discussion provides a whole new approach to data protection for the country. It also follows the current trend of several countries, the European Union included, by adopting a data breach notification regime. The text would make companies liable without the need to prove omission or negligence. Currently they are only liable to the extent of damages resulting from the misuse of information leaked or stolen due to a data security breach.

Rate this:

Comentários ao Anteprojeto de Lei Brasileiro sobre Proteção de Dados Pessoais

"Chove no Recife" (Photo by "Nuage Bleu"; shot on Jan. 9, 2010). Available at http://www.flickr.com/photos/13075815@N03/4258751419/ (Creative Commons Attribution-NonCommercial-ShareAlike 2.0 Generic (CC BY-NC-SA 2.0)" license.)

O Brasil, em contramão a muitos de seus pares no cenário mundial, ainda não dispõe de proteção adequada para dados de natureza pessoal. Mesmo levando em consideração as proteções à intimidade e à privacidade estabelecidas pela Constituição Federal e pelo Código Civil, e o amparo aos dados consumeristas, imposto pelo Código de Defesa do Consumidor, … Continue reading

Rate this:

La CNIL publie son premier guide sur la sécurité des données

"La sécurité" - Photo by Boris Drenec (2008). Shot on March 3, 2008. Available at http://www.flickr.com/photos/_boris/2360263645/in/pool-632629@N22/ (Creative Common "Attribution-NonCommercial-ShareAlike 2.0 Generic" license.)

La CNIL vient de publier son premier guide pratique sur la sécurité des données. Cette publication s’inscrit dans un mouvement plus général en Europe qui tend à renforcer le niveau de sécurité des données personnelles en prévoyant l’obligation de notifier les violations de sécurité. Dans ce cadre, la CNIL invite à un audit des systèmes d’information, à une évaluation des risques, et explique en 17 fiches pratiques les éléments essentiels et solutions techniques pour garantir la sécurité des données. Les entreprises procédant à des traitements de données à caractère personnel pourront utiliser ce guide afin de se conformer à l’obligation de sécurité prévue par la Directive “Données personnelles” et par la loi Informatique et Libertés. Ce guide sera d’une grande utilité pour les responsables de traitements, directeurs de systèmes d’information et CIL qui souhaitent améliorer la sécurité des traitements de données dans leurs entreprises.

Rate this:

Will France adopt a law requiring the notification of security breaches?

A French bill “to better guarantee the right to privacy in the digital age” has implemented the European Directive 2009/136/EC by requiring the data controller to inform the “Data Protection Correspondent” (a person within an organization who could be the controller or someone assisting the controller), or in the absence thereof, the French data protection authority (the Commission Nationale de l’Informatique et des Libertés), of a breach of integrity or confidentiality. Those involved in the breach must also be informed, at least if security breaches are “likely to adversely affect” their personal data. The bill follows the recommendation of the Directive to notify individuals of security breaches for all sectors, not just electronic communications. It was adopted by the French Senate on March 24, 2010 and is currently before the National Assembly.
(A French version of this article is also available in this blog.)

Rate this:

  • Blog authors

  • Copyright notice

    © Copyright 2010-2014 "Information Security Breaches & The Law".
    All rights reserved, unless noted otherwise under each author's post, page or other material.
    If you would like to discuss licensing terms, contact us at: info [at] security-breaches [dot] com.

  • Enter your e-mail address here to follow this blog and receive notifications of new posts by e-mail.

  • The “Global Information Security Breach Professionals” Group on Linkedin

  • Wordpress Blog Stats

    • 42,273 hits