Race to the Top – States Push to Broaden Breach Reporting Requirements

Facebook just reported a massive data breach impacting over 50 million user accounts. And while most investment advisers are not likely to experience a breach of that scale, what is likely is that a cyber incident will occur at some point. Consequently, state regulators continue to expand the protections they require for their residents through increasingly strict data breach reporting requirements, in some cases coming very close to the international requirements imposed by the European Union’s General Data Protection Regulation (GDPR).

During a panel discussion, “State of the Data Breach: Legislative Changes and the Impact of GDPR,” at the recent CSS compliance conference in San Diego, Andrew Hartnett, Officer at Greensfelder, Hemker & Gale, P.C., Ronan Brennan, Chief Product Officer at CSS, and E.J. Yerzak, Director of Cyber IT Services at CSS brought attendees on a legislative journey of all that has changed in 2018 on the breach reporting front – from Alabama and South Dakota becoming the 49th and 50th states to enact data breach laws to various states including Colorado and California amending theirs. Cynthia LaRose, Chair of the Privacy and Data Security Practices at Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C., supplemented the discussion with some helpful materials about GDPR myths and misconceptions compared to the reality of the regulation.

Mr. Brennan highlighted the operational challenges firms face in complying with GDPR, such as mapping a comprehensive inventory of data and data flows as well as the importance of vendor management.

The session concluded with Mr. Hartnett reminding attendees that despite all of the changes we have seen recently in data breach laws in 2018, at the end of the day what is really important is not to memorize the nuances of all 50 state breach laws and GDPR but rather to focus on improving our cybersecurity programs (policies, procedures, testing, and training) from the outset to hopefully avoid a breach from occurring in the first place. Lining up legal and forensics support in advance to assist with the breach investigation and reporting can help firms to save their energy and efforts for maintaining an effective cybersecurity program throughout the year.


For more information on the CSS Shield cybersecurity solution, or to set up a demo, click here.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Tips to Prevent an SEC OCIE Investment Adviser Exam from Going Bad

Strategies to employ when an SEC OCIE adviser exam goes bad drew a great crowd at the recent CSS Ascendant Fall Compliance Conference. Proactively pointing an exam in the right direction was a consistent theme, summarized by the familiar refrain: “There is no substitute for preparation.” A few keys to note if you find your … Continued

Giving Voice to Values: A New Approach to Ethics

The “Giving Voice to Values” program grew out of Professor Mary Gentile’s frustration of what was going on in both the financial industry and in higher education. She was frustrated and angry about the poor way that ethics was being taught in universities and applied in real-world scenarios. What developed out of her frustration is … Continued

Tips for Developing a Tailored Private Fund Compliance Calendar

As regulatory concerns proliferate and become more complex, developing and monitoring your “to-do” list becomes of paramount importance.  John Gentile, the Director of Private Fund Manager Services for Compliance Solutions Strategies and Michael Emanuel, a Partner at Stroock & Stroock & Lavan LLP provided attendees of the recent CSS 2019 Fall Conference some insight into … Continued