While federal lawmakers might be hesitant to enact national data privacy legislation, some states are quickly moving to define reasonable cybersecurity—and protect those that adhere to them. But even as legislators extend “safe harbor” protections to encourage cybersecurity, lawyers noted some companies might ignore the incentive to avoid burdensome responsibilities.
In March, Utah joined Ohio in enacting a safe harbor provision that can grant compliant companies an affirmative defense to litigation stemming from a data breach. To obtain that legal defense, companies must adhere to a “reasonable security” program. Utah legislators defined a reasonable cybersecurity plan, in part, as measures that protect personal information, have protocols for responding to breaches and notifying impacted individuals, and reasonably conforms to “recognized cybersecurity frameworks,” such as National Institute for Standards and Technology (NIST) programs.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.
For questions call 1-877-256-2472 or contact us at [email protected]
