What Chicago Public Schools Can Teach About Determining Breach Liability
A former contractor at Chicago Public Schools allegedly stole data pertaining to volunteers, vendors and staff. Determining where the liability falls between school and contractor isn't always cut and dry.
November 09, 2018 at 11:00 AM
4 minute read
Detention is probably not going to cut it this time around. According to the Chicago Sun-Times, a former Chicago Public Schools contractor named Kristi Sims stands accused of stealing data pertaining to 80,000 employees, volunteers and vendors from a school database.
The case illustrates the complexity of the client/vendor relationship, specifically when it comes to accountability following the exposure of personal data. Determining where the liability may fall could depend as much on pre-existing contracts as it does any kind of state law.
“The CPS incident brings up a lot of best practices because we see this a lot with respect to schools, with respect health care facilities, with respect to all businesses that hold this identifiable data. They're working with vendors every day,” said Valerie Montague, a privacy professional and a partner with Nixon Peabody.
And sometimes those vendors forget to flip off the switch. The contracting company that employed Sims had recently terminated her for performance-based issues but neglected to revoke her access to the board of education's Google Drive account, allowing her to remotely compromise sensitive information such as employee ID numbers, addresses and dates of birth.
The question of who could be held responsible—CPS or the contracting company—is a little bit like the chicken and the egg. Montague thinks that, if an investigation or lawsuit of any kind were to materialize, the school would probably be the primary target. Timothy Hayes, an associate focusing on privacy and cybersecurity, thinks there's a chance the liability could be split both ways.
“As the entity that collected the data, the CPS had a duty to the individuals whose data they collected to protect that data and to ensure that any third parties handling that data also protected that data. Also, the contractor whose mishandling of the data resulted in the breach had a duty to the CPS to protect the data they were contracted to handle,” Hayes said.
In Illinois, the Student Online Personal Protection Act is the only school-specific state law regulating data privacy and security, but then it applies mostly to educational technology companies. SOPPA prohibits the sale of student data along with using it to create student profiles or engage in targeted advertising.
The data that Sims allegedly stole from CPS' database wouldn't qualify as “personal information” under Illinois law. No Social Security numbers, driver's license numbers or medical/health insurance information were taken, so it wouldn't have triggered any of the state's breach notification laws either. In these instances, the currency at stake is public opinion.
“Not only do parents trust that schools will keep their children physically safe, but there is an expectation that schools will keep their children's data and identities safe, as well. Repairing any damage to that relationship falls on every member of a breach response team, including the lawyer,” Hayes said.
Protecting clients like schools or corporations often begins prior to a formal relationship with a vendor even commencing. Nixon Peabody advises those under their guidance to perform a thorough review of the policies and procedures a contractor incorporates to secure data. For example, asking how quickly access can be revoked to former employees couldn't hurt.
Once talks reach the contract stage, clearly-defined language designating the burden of liability can help eliminate any potential ambiguity in the event of an incident.
Montague noted that, “if your organization is pursued by a regulator or by an individual, you can then take your contract and pursue your vendor for failure to meet the requirements of the contract to protect that data. And to terminate access for an employee who is no longer with the organization.”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllLaw Firms Are Turning to Online Training Platforms as Apprenticeship Model Falters
UChicago Law Professors Release Desk Reference Breaking Down Crypto, Web 3 for Attorneys
4 minute readK&L Gates Partners With AltaClaro to Offer Gen AI Supervisory Course for Firm Partners and Managers
6 minute readBerkeley Law Taps Big Tech, Law Firms and ACLU to Design New AI LLM Program
Trending Stories
- 1The Law Firm Disrupted: Playing the Talent Game to Win
- 2A&O Shearman Adopts 3-Level Lockstep Pay Model Amid Shift to All-Equity Partnership
- 3Preparing Your Law Firm for 2025: Smart Ways to Embrace AI & Other Technologies
- 4BD Settles Thousands of Bard Hernia Mesh Lawsuits
- 5A RICO Surge Is Underway: Here's How the Allstate Push Might Play Out
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250