The best way to protect personal information is never to disclose it. But that’s impossible in today’s information age. We give personal information to businesses and governments in any number of transactions. Each time, we are forced to trust those who receive our information to safeguard it. Is this trust justified? Can we reasonably expect the custodians of our data to take the steps necessary to safeguard our information? Or is that hope a pipe dream?
The problem of externalities
One would think business and governments would see an economic incentive to securing the information of consumers and taxpayers, and that they could simply pass on the costs of protecting personal information. Unfortunately, it isn’t that simple. The economic incentive to protect information may not be readily apparent to data custodians. In fact, it may not exist at all.
An externality is an economic concept that describes situations where a transaction creates a cost (or benefit) for a third party not involved in the transaction. According to Bruce Schneier in “Economics and Information Security,” an externality occurs when “the people who could protect a system are not the ones who suffer the costs of failure.” The cost of a data breach may be squarely focused on the victim whose data was compromised. Thus, there may be little economic incentive for custodians to go to great lengths to protect information when a breach of confidentiality results in no financial harm to the custodian.
Schneier further points out in “The ‘Hidden Cost’ of Privacy,” that “protecting individual privacy remains an externality for many companies . . . basic market dynamics won’t work to solve the problem. Because the efficient market solution won’t work, we’re left with inefficient regulatory solutions.” Indeed, getting data custodians to internalize externalities is typically done by regulation or the specter of liability.
Corporate duty to safeguard personal information
Based on the number of individual data breaches and the number of sensitive records exposed each year, it is safe to say public and private institutions are hemorrhaging sensitive information into unauthorized hands. A growing public outcry is attempting to hold data custodians accountable for failing to reasonably protect sensitive information.
Increasingly, corporations that collect, store and use personal information have a duty to safeguard the data. Sophisticated consumers demand contractual assurances. Duties are also imposed by legislation and judicial mandates. An array of federal and state data privacy laws compel private and public entities to safeguard certain types of personal information (like health, financial or educational records) and to alert victims of breaches.
Further, corporate directors themselves have a duty to ensure adequate controls over financial reporting and data protection to prevent fraud. A long line of cases in Delaware, for example, holds directors personally liable “for failing to act in good faith in discharging his or her oversight responsibilities.” (Stone v. Ritter)
To be sure, the U.S. is not yet like Europe, the British Commonwealth and certain countries in South America, where virtually all personally identifiable information is protected by comprehensive regulation. The statutory and regulatory environment in the U.S. is a complex, industry-specific and context-sensitive patchwork of laws. Even a corporate director’s oversight duties are breached only where there is “a sustained or systematic failure of the board” to ensure data privacy. (See In Re Caremark Int'l, )
But the lack of comprehensive regulations can lull companies into a deceptive sense of ease. For all the following reasons, legal counsel should advise companies to make the necessary investment to ensure data privacy:
- The trend is clearly toward European-style regulation of sensitive personal information. States like California and Massachusetts lead the way with aggressive breach notification laws.
- The expectations of consumers that their information will be protected—and an increasingly electric climate of personal privacy and consumer protection generally—combine to spur aggressive enforcement of existing regulations.
- Industry best practices may already exceed the minimum requirements set by regulations, particularly where national or multi-national competitors already comply with higher standards. Indeed, a number of comprehensive standards have already emerged, such as SANS 20 Critical Controls.
- More and more contracts impose data privacy obligations, including representations, warranties, indemnities and notice requirements, the breach of which can result in significant damages.
- As consumer expectations are increasingly seen as reasonable, as best practices emerge, and as contracts require data protection, the likelihood of civil liability also grows. Best practices impose a de facto standard of care by which all companies will be judged.
- Finally, high profile reports of lost or stolen information further ignite concerns. News of a breach can be a public relations disaster.
It is incumbent on in-house counsel to help companies see the upside of protecting consumers’ personal data and to make the necessary investment to do so. At a minimum, counsel should carefully track regulatory developments, consumer responses, industry best practices, contractual duties and the likelihood of litigation.
