Insurance Against The FTC's Claims of Deceptive Acts and Practices: Developing Your Own Industry Standards For Data Security
We have been discussing what businesses can do to protect against the Federal Trade Commission commencing an enforcement action against them for allegedly failing to take reasonable precautions to ensure the safety of their customers' private data, such as financial information, dates of birth, social security numbers, and even health records: Develop, and implement, industry standard, and commercially reasonable, data security practices. This time, we will see just how effective those efforts are by, in effect, asking Target.
What makes such Industry Standard Practices and Commercially Reasonable Efforts so promisingly effective is that:
- They were approvingly cited as source of guidance as to what a business must do to properly protect its customers' data, by the court in the case entitled, The Federal Trade Commission, Plaintiff, v. Wyndham Worldwide Corp., et al., Defendants. Civil Action No. 13-1887 (ES), United States District Court, D. New Jersey. This was the same case which approved the FTC's right to police data security practices.
- Companies can define, on their own, what Industry Standard Practices and Commercially Reasonable Efforts, actually mean, for their business and their customers
Some companies, and industries, have gone to great lengths to define Industry Standard Practices and Commercially Reasonable Efforts for themselves. We previously pointed out the extraordinary data security efforts leading retailers were taking to protect the safety of their customers' sensitive, private information; how they were sharing information, between themselves and governmental agencies, and collaborating with outside experts, to develop industry standard practices in data security; how they established an independent entity, the Retail Cyber Intelligence Sharing Center, or R-CISC, to do exactly that. We also examined a benefit of, if not the actual reason for, the retailers' efforts: To protect themselves.
Retailers seem to be some of the most tempting targets of data security breaches. They handle large amounts of their customers' financial information every day. Credit and debit card numbers are perhaps the most inviting targets because they are so lucrative and can be turned into illicit gains so quickly by cyber-criminals. Here are some facts which might put the retailers' efforts into perspective: