data breach

A recently passed bill in Ohio grants covered entities an affirmative defense against tort claims in data breach suits filed in the state or brought under Ohio law. Experts said the law probably won't stop plaintiffs attorneys from filing a claim in another forum, though they noted the law may encourage more companies to ensure they have data breach protection in place.

The law provides a “safe harbor” for covered entities against tort claims that allege “failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.” Covered entities, however, need to prove they created, maintained and complied with a cybersecurity program that conforms to an industry-recognized cybersecurity framework.

Covered entities are defined in the law as businesses that access, maintain, communicate or process personally identifiable information (PII) in one or more system or network in Ohio.

A covered entities' cybersecurity program must “reasonably conform” to the up-to-date version of the NIST frameworks, HIPAA, Gramm-Leach-Bliley Act, Federal Information Security Modernization Act, Health Information Technology for Economic and Clinical Health Act or the payment card industry data security standard.

The affirmative defense would apply to only a tort claim brought in an Ohio court or under Ohio law that alleges the entity's failure to implement reasonable security standards caused a data breach.

The bill is set to go into effect Nov. 2.

Cleveland-Marshall College of Law professor Brian Ray, who served on a subcommittee that assembled the Ohio legislation, called dealing with cyber breaches “a constant game of cat and mouse” and said the committee intended to provide an incentive to companies and raise the bar for combating cyber breaches.

Ray said the committee tried to identify industry standards already in place that would incentivize companies to obtain cyber breach protection.

Not all attorneys found the legislation listed an objective way to definitively say that companies had complied.

“The problem is, none of these standards are fixed in stone, there's no certification attached,” said Frances Floriano Goins, the Cleveland-based co-chair of Ulmer & Berne's cybersecurity and privacy group. “The standard says a lot regarding the generalization of what is required but not the specifics of what they must contain.”

“A covered entity will have the burden of proof to demonstrate that it meets all three eligibility requirements,” wrote Baker & Hostetler attorneys Brian Bartish and Craig Hoffman regarding the new law on the firm's Data Privacy Monitor. “There is a big difference between writing a cybersecurity plan and actually implementing it correctly at the start, let alone demonstrating compliance with the program requirements at the time of a security incident.”

Lawyers also said large companies were usually already complying with industry-specific and recognized frameworks for data security and breach prevention but Ohio's legislation incentivizes smaller companies to adopt those frameworks.

Historically, data breach laws were used to punish companies, but this Ohio law differs because it provides safe harbors, said David Zetoony, Bryan Cave's global data privacy and security practice lead.

However, Ohio is currently the only state that provides an affirmative defense and smaller, midsize companies may not see the fiscal lure in implementing and documenting more security frameworks when a tort claim can easily be brought in another state.

“From a litigation standpoint the effect is minimal,” said Zetoony. Although the Ohio legislation may start a wave of similar state regulations, he said.

“The world of cybersecurity has been driven by state law, not federal law. … Good ideas and sea changes always happen with the states,” Zetoony said.

Ray, the Cleveland-Marshall law school professor who worked on the bill, shared Zetoony's sentiment.

“If more states follow it, it may move the needle.”