BIG Changes For Company Customer Data Security Policies

Nevada is the first of several states adopting new laws forcing businesses to change their customer data protection policies, The Wall Street Journal reports. Massachusetts, beginning in 2009, will require businesses collecting information about their residents to encrypt sensitive data stored on laptop computers and other portable devices. Michigan and Washington state are also considering similar regulations.

The new laws are something many businesses will have to deal with, since the laws apply to out-of-state companies with operations or customers in those states. While it isn’t clear if state authorities intend to crack down on mom-and-pop businesses, the laws establish a liability that could be used in civil suits against any business following a data breach, privacy lawyers say.

Nevada law stipulates companies that have a security breach, but have complied with the new law, will cap their damages at $1,000 per customer, for each occurrence. Those that don’t comply would be subject to unlimited civil penalties under the proposed enforcement plan.

Many businesses are starting to buy security technology in anticipation of these new laws. According to Forrester Research, about 31% of large corporations and 22% of small- and medium-size firms currently have at least some laptops with encrypted hard drives, a way of protecting information on a computer if it is lost or stolen.

Massachusetts estimates businesses with 10 employees will need to spend an estimated $3,000 up front, plus an additional $500 a month in order to comply, the WSJ reports. Security executives at larger firms said they the costs will be similar per employee.

The new laws are stricter than past regulations, which only required businesses to notify people whose personal information they lost. Researchers found that notification laws only reduce identity theft by just 2%. More than 500 organizations have publicly disclosed a breach in 2008, up from the 446 disclosed in 2007, according to the Identity Theft Resource Center, a San Diego nonprofit group. ❖