Liability time bomb
You haven’t heard about big data-security lawsuits so far, but it’s just a matter of time
 By  Wayne Rash, Infoworld
April 09, 2004  

"Accountability breeds caution," explains Washington attorney Andrew Greenwald. Greenwald, who specializes in professional negligence, liability, and personal injury cases in Washington and Maryland, says it’s only a matter of time before we start seeing significant awards to people and businesses who have had information released that was supposed to be kept private. 

Greenwald also thinks that such cases are necessary to produce accountability in the handling of information that should be secure. The lack of accountability and the lack of pain when security lapses happen are two reasons such lapses keep happening.

They are also the reasons why CFOs continue to see security as a cost to be trimmed as much as possible. After all, why worry about keeping customer information truly secure if there’s no downside if you don’t? This is especially true because security costs money, and many such executives would like to keep even necessary costs down, if only to keep their bonuses flowing.

What this means for you, of course, is that it’s hard to get approval to spend the money you really need to spend to keep information out of the hands of those who would misuse it. You can’t get the staff you need to manage the security you need to manage, you can’t upgrade your infrastructure to the latest technology, and you can’t get the training you need to stay on top of the latest threats.

And, of course, if someone steals a bunch of credit card numbers and uses that information to steal an identity, you know who’s going to get the consequences (hint: it’s not the CFO who declined your request for training or that secure server for the customer database).

Right now, you may have other things to worry about. If you’re in the health care field, you have to comply with privacy rules. You have similar requirements if you’re in the financial services industry. But suppose you’re just a company with no special babysitting agency? Then you only have to protect the private information of your customers and business partners well enough to keep from losing them. That’s not much of an assurance.

A better assurance would be for your CFO to know with certainty that a breach of protected information would bring down a ton of legal consequences. At this point, however, that hasn’t happened. According to Greenwald, the field is too new. In addition, companies frequently settle such claims privately to keep their security problems out of the media (and in the process deny us the lurid tales to publish).

Another reason, Greenwald says, is that protection standards for a customer’s or business partner’s information vary from state to state. But neither of those issues is likely to keep security lapses out of the courts for long.

One of these days, some company will do something egregious enough that a trip to the courts, and a big punitive damage settlement, will be the result. (Remember the old saying about an ounce of prevention?) Point out to your CFO -- and your board -- that there’s no sense in making your company be the first to suffer such an event.