This is part of a series of articles on transactional contracts issues by Prof. Michael L. Bloom and students in the Transactional Lab at the University of Michigan Law School.

In today's hyper-technical world, more and more businesses are required, whether by law or contracts incorporating industry standards, to provide some level of security for sensitive data and other information under their control. In addition, recent high-profile data breaches have elevated data security and privacy to top-of-mind status for businesspeople and lawyers alike. Accordingly, it has become increasingly necessary for deal lawyers, including those not specializing in data privacy or security, to have at least a high-level understanding of which laws may be governing and what industry publications are leading sources of best practices.

You Might Not Have to Reinvent the Wheel

An important start in orienting to the world of data privacy and security is realizing that there are published and widely followed industry standards for data protection and privacy. There are two main types of published standards: (1) statutory law and (2) third-party publications.

These provide substantive guidance for understanding what protocol and practices are expected for compliance with industry standards. In addition, deal lawyers may consider incorporating third-party publications by reference into their agreements, if seeking counterparty compliance with good data security practices.

Statutory Data Security and Privacy Laws

Some primary sources of data security and privacy laws include:

|
  • U.S. federal law, such as the Health Insurance Portability and Accountability Act (HIPAA), regulating certain health-care providers, health-care clearinghouses and health plans' handling of health information; and the Gramm-Leach-Bliley Act, regulating financial institutions' handling of sensitive data.
  • U.S. state laws that regulate the handling of personally identifiable information (i.e., information that can be used to identify an individual) and notification upon data breaches.
  • Non-U.S. regulation, such as the European Union Data Protection Directive, which regulates the collecting and processing of personally identifiable information stored in the European Union.

In the U.S., much of data security and privacy law is state law. Most state data privacy laws cover requirements for responding to unauthorized access to personally identifiable information. A few states, such as Massachusetts, Texas, and California, have implemented requirements for implementing security procedures to protect personally identifiable information. See 201 Mass. Code Regs. 17.00 – 17.05 (2013); Tex. Bus. & Com. Code Ann. § 521.052 (West 2013); Cal. Civ. Code § 1798.81.5(c) (Deering 2013).