How Will Ohio's New 'Safe Harbor' Breach Law Affect Enterprises?
A new law in Ohio grants companies an affirmative defense in Ohio courts if a data breach occurs but the company can prove it had cybersecurity programs in place that meet industry-recognized security frameworks. Some lawyers say the law uses the carrot instead of the stick as an incentive for companies.
September 10, 2018 at 11:45 AM
4 minute read
The original version of this story was published on Legal Tech News
A recently passed bill in Ohio grants covered entities an affirmative defense against tort claims in data breach suits filed in the state or brought under Ohio law. Experts said the law probably won't stop plaintiffs attorneys from filing a claim in another forum, though they noted the law may encourage more companies to ensure they have data breach protection in place.
The law provides a “safe harbor” for covered entities against tort claims that allege “failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.” Covered entities, however, need to prove they created, maintained and complied with a cybersecurity program that conforms to an industry-recognized cybersecurity framework.
Covered entities are defined in the law as businesses that access, maintain, communicate or process personally identifiable information (PII) in one or more system or network in Ohio.
A covered entities' cybersecurity program must “reasonably conform” to the up-to-date version of the NIST frameworks, HIPAA, Gramm-Leach-Bliley Act, Federal Information Security Modernization Act, Health Information Technology for Economic and Clinical Health Act or the payment card industry data security standard.
The affirmative defense would apply to only a tort claim brought in an Ohio court or under Ohio law that alleges the entity's failure to implement reasonable security standards caused a data breach.
The bill is set to go into effect Nov. 2.
Cleveland-Marshall College of Law professor Brian Ray, who served on a subcommittee that assembled the Ohio legislation, called dealing with cyber breaches “a constant game of cat and mouse” and said the committee intended to provide an incentive to companies and raise the bar for combating cyber breaches.
Ray said the committee tried to identify industry standards already in place that would incentivize companies to obtain cyber breach protection.
Not all attorneys found the legislation listed an objective way to definitively say that companies had complied.
“The problem is, none of these standards are fixed in stone, there's no certification attached,” said Frances Floriano Goins, the Cleveland-based co-chair of Ulmer & Berne's cybersecurity and privacy group. “The standard says a lot regarding the generalization of what is required but not the specifics of what they must contain.”
“A covered entity will have the burden of proof to demonstrate that it meets all three eligibility requirements,” wrote Baker & Hostetler attorneys Brian Bartish and Craig Hoffman regarding the new law on the firm's Data Privacy Monitor. “There is a big difference between writing a cybersecurity plan and actually implementing it correctly at the start, let alone demonstrating compliance with the program requirements at the time of a security incident.”
Lawyers also said large companies were usually already complying with industry-specific and recognized frameworks for data security and breach prevention but Ohio's legislation incentivizes smaller companies to adopt those frameworks.
Historically, data breach laws were used to punish companies, but this Ohio law differs because it provides safe harbors, said David Zetoony, Bryan Cave's global data privacy and security practice lead.
However, Ohio is currently the only state that provides an affirmative defense and smaller, midsize companies may not see the fiscal lure in implementing and documenting more security frameworks when a tort claim can easily be brought in another state.
“From a litigation standpoint the effect is minimal,” said Zetoony. Although the Ohio legislation may start a wave of similar state regulations, he said.
“The world of cybersecurity has been driven by state law, not federal law. … Good ideas and sea changes always happen with the states,” Zetoony said.
Ray, the Cleveland-Marshall law school professor who worked on the bill, shared Zetoony's sentiment.
“If more states follow it, it may move the needle.”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllGoogle Fails to Secure Long-Term Stay of Order Requiring It to Open App Store to Rivals
Orrick Secures Summary Judgment for RingCentral in Privacy Class Action
NY Lateral Partner Moves Spike, Especially in PE and Funds Practices
'That's Not the Job' for the DOL: Crop of Suits Against Biden Administration
6 minute readTrending Stories
- 1The Law Firm Disrupted: Playing the Talent Game to Win
- 2A&O Shearman Adopts 3-Level Lockstep Pay Model Amid Shift to All-Equity Partnership
- 3Preparing Your Law Firm for 2025: Smart Ways to Embrace AI & Other Technologies
- 4BD Settles Thousands of Bard Hernia Mesh Lawsuits
- 5A RICO Surge Is Underway: Here's How the Allstate Push Might Play Out
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250