220 likes | 355 Views
Identity Theft & Data Security Concerns Are You Meeting Your Obligations to Protect Customer Information?. Finance & Administration Roundtable February 28, 2007 Claudia Volk, Principal CJVolk Associates & Carol Van Cleef, Partner Bryan Cave, PC. Agenda. Background : Current Events
E N D
Identity Theft & Data Security ConcernsAre You Meeting Your Obligations to Protect Customer Information? Finance & Administration Roundtable February 28, 2007 Claudia Volk, Principal CJVolk Associates & Carol Van Cleef, Partner Bryan Cave, PC
Agenda • Background : Current Events • Disposal Rule of the Fair and Accurate Credit Transactions Act • Payment Card Industry Data Security Standard
Scope of the Problem • 10 million people each year are victims of identity theft • Mean fraud loss per victim in 2005 was $6,383. • Victims spend, on average, 40 hours and $422 to resolve issues related to identity theft. • Losses as a result of identity theft ranged from $53.2 billion in 2003 to $56.6 billion in 2005 Javelin Strategy & Research
Pervasiveness • Changing methods to pentrate data security • The threat within • MacAffee Analysis • Planted employees to engage in identity theft and money laundering • Avoid assumptions about the trusted employee
The Disposal Rule • Protect the privacy of the consumer’s information • Reduce risk and fraud of identity theft • Applies to any business or individual using consumer reports for business purposes • Federal Trade Commission • June 1, 2005 • State Laws may apply
The Disposal Rule • The FACT Act requires that: • Any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose {, } properly dispose of any such information or compilation • The Federal Trade Commission Rule • Any person who maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to, or use of information in connection with its disposal.
The Disposal Rule • Flexible • Reasonable measures based on • Sensitivity of data • Costs and benefits of different methods • Changes in technology • Consumer reports and any personal and financial information • No de minimus exception • Actual, statutory and punitive damages, plus attorney’s fees and civil money penalties
Key Terms • Consumer Information • Any record about an individual • Consumer report or derived from a consumer report • Information obtained from a consumer reporting company • Used or expected to be used in establishing eligibility for credit, insurance, and employment • Paper, electronic or other form • Compilation of such records • Not included: aggregate information or blind data
Key Terms • Disposal / Dispose • Discarding or abandonment of consumer information • Sale, donation or transfer of any medium on which consumer information is stored
Reasonable Measures • Non exclusive examples • Burn, pulverize or shred papers – cannot practicably be read or reconstructed • Destroy or erase electronic media – cannot practicably be read or reconstructed • Contract with a third party after appropriate due diligence • Review independent audit of operations or compliance with disposal rule • Obtain several references • Require certification by recognized trade associations • Review and evaluate information security polices or procedures • Take other appropriate measures to determine competency and integrity
Action Items • Catalog your information • Review where and how it is stored • Determine who can access it and how • Develop appropriate procedures and control to comply with the Disposal Rule • Designate a responsible person • Train employees • Audit
Some Suggested Policies and Procedures • Conduct personal background checks • Permanent employees • Temporary hires • Sensitive data limits • Access • Use • Distribution • Secure records – physical and online • Collect and retain only essential information • Make accessible disposal tools
General Data Safeguarding and Security Breach Tips • Integrate into information safeguarding program • Ensure information safeguarding program reflects other changes in law • Prepare ready response plan in the event of data security breach • Understand requirements of data security breach laws
Data Security Breach Laws • What businesses are covered? • What information is covered? • What triggers notification? • Who must be notified? • Who is responsible for the notice? • When must the notices be given?
Data Breach Notification Best Practices • Encrypt information • Prepare consumer notification plan • Notify general counsel or outside counsel immediately • Conduct an immediate internal investigation • Contact local law enforcement contact • Provide consumer and other notifications if necessary
Industry ResponseCardholder Information Security Program (CISP) • American Express®, Diners Club®, Discover®, JCB®, MasterCard® and Visa® USA • Safekeeping of account information requirements: • Storage of Cardholder Information • Destruction of Cardholder Information • Use of Third Parties • Reporting a Security Incident
Payment Card Industry (PCI) Data Security Standard • Build and Maintain a Secure Network • Protect Cardholder Data • Maintain a Vulnerability Management Program • Implement Strong Access Control Measures • Regularly Monitor & Test Networks • Maintain an Information Security Policy
VISA’s Cardholder Information Security Program (CISP) • Classification defines merchant audit requirements • Level 1 merchants: • Process > 6 million transactions annually • Have suffered a breach • Are identified as Level 1 by another card issuer • Risk is determined to warrant level 1 requirements • Level 2 process between 150,000 and 6 million e-commerce transactions annually • Level 3 process 20,000-150,000 e-commerce transactions annually • All other merchants are considered Level 4
What YOU can do • “Know thy data” • What you have collected • Where it is • Who has access to it • Stay informed about • Related laws and regulations • Current breach incidents • Best practices http://usa.visa.com/business/accepting_visa/ops_risk_management/ http://www.ftc.gov/bcp/edu/microsites/idtheft/business/data-breach.html
Questions and Comments? ? ? ?
Bryan Cave LLP CJVolk Associates, Inc. Contact Information 700 Thirteenth Street, NW Washington, DC 20005 www.bryancave.com Carol Van Cleef, Partner Phone 202-508-6112 Fax 202-508-6200 Carol.VanCleef@bryancave.com • 2776 S. Arlington Mill Rd, Ste. 530 • Arlington, VA 22206 • www.cjvolk.com • Claudia Volk, Principal • Phone 703-405-4404 • Fax 703-940-2510 • Claudia.Volk@cjvolk.com