data privacy

As lawmakers tackle protecting consumers' data, many often turn to the requirement for "reasonable security," which usually can be a vague threshold for private industry to meet. But plaintiff and defense attorneys agree, offering a more granular definition of reasonable security can also risk being overly proscriptive and easily outdated.

For instance, a recently proposed federal law, written by the bicameral and bipartisan Cyberspace Solarium Commission, risks inching toward being overly restrictive while too vague for compliance for many, defense attorneys said.

The commission proposes establishing a law that software developers are liable for damages from incidents that exploit known and unpatched vulnerabilities.

However, Troutman Sanders partner and cybersecurity, information governance and privacy practice leader Ron Raether cautioned that patching was being overemphasized as a solution. 

"The problem with focusing just on patching is it takes a singular approach to a multilayered set of issues," he said. "The law itself is thinking of patching as if it's a singular consideration, you should always patch if you have a vulnerability. Vulnerabilities come in different shapes and sizes."

Raether said a federal law requiring patching would lead companies to allocate more resources to patches and potentially not explore other worthwhile solutions.

"If I'm spending all my money on patching, maybe I'm not spending on antivirus or anti-malware or not restructuring my network. That would reduce my vulnerabilities beyond patchwork updating," he explained. "It's a good idea, mandating the way it is in [the report], but it's like suggesting I can cure a big problem with a single [measure]."

Though the recommended law would set a regulatory preference for patching, it still wouldn't provide much clarity regarding what's reasonable security, said Stradling Yocca Carlson & Rauth privacy and data security practice chairman Travis Brennan.

What's more, companies already have the incentive to improve cybersecurity quickly through patches and other measures, Brennan argued. He noted the California Consumer Privacy Act provides damages and injunctive or declaratory relief when nonencrypted personal data is breached and a business doesn't have reasonable security. What's missing is clarity regarding what constitutes reasonable security, and the commission's suggested law isn't the answer, Brennan said.

He also said the suggested national law wouldn't provide needed clarity for determining reasonable security. "I think businesses are looking for guidance of what is a reasonable security measure for them, and making developers liable for unpatched vulnerabilities only gets to a very smaller slice of a bigger issue. The bigger issue is, how do we define reasonable security measures that regulated businesses can implement?"

However, in doing so, the cybersecurity liability law would have to strike a careful balance in being not overly broad or specific.

Morgan & Morgan plaintiff attorney John Yanchunis described the challenge of lawmakers defining reasonable security because the "danger of defining it is [that] it's always changing, and I think that companies need to constantly adapt to both developing threats and the advancement of technology to protect and detect those harms."

Instead, legislation should aim for best practices and not define reasonable security. "When you inject the concept of reason, you can cause differences in opinion," Yanchunis said.