New FTC Data Breach Settlement Involving Individual Liability and Vendor Controls; NY Releases Data Security Business Guidance
November 7, 2008
Kelley Drye's Information Security and Privacy Practice has prepared an advisory with updates on two recent data security developments: a new Federal Trade Commission ("FTC") data breach settlement and a summary of the data security business guide recently released by the New York Consumer Protection Board. The FTC case is a reminder to businesses that regulators will attempt to hold a business responsible for its vendors' security controls (or lack thereof) if the business does not take reasonable steps to confirm that its vendors can reasonably protect personal data shared with them.