Keeping data safe: new legal standards for companies doing business in the digital age.

If you keep information about your customers, soon you may be responsible for keeping it safe from hackers and identity thieves. Privacy laws dictate what businesses can do with the personal information that they collect from their customers, but until now, no legal obligations have been imposed on how companies maintain this information within their databases. A new California law requires companies and government agencies to notify consumers when the security of databases containing their personal information is compromised. This is just the first of new legal obligations on business owners to ensure the security of the customer data they collect and store.

Many companies today maintain databases of customer information. This information may include an individual's name, address, telephone number, email address, birth date, credit card number, passwords and shopping preferences. Businesses use this information not only to record transactions, but also for direct marketing and market research.

California's legislature has recognized that the widespread collection of personal information puts the privacy and financial security of individuals whose information is being collected increasingly at risk. Recent security breaches by hackers and break-ins at company facilities have prompted the public increasingly to demand that companies protect the personal information they collect.

On April 5, 2002, a hacker broke into a computer system at the Stephen P. Teale Data Center, the payroll facility for California State employees, which contained payroll information, Social Security numbers, and other sensitive personal information for approximately 265,000 California State employees. Concerned with the growing number of identity thefts, and in response to the incident at the Stephen P. Teale Data Center, the California legislature enacted Senate Bill 1386, which requires companies doing business in California and government agencies whose databases have been broken into to notify individuals if their personal information may have been acquired by an unauthorized person.

California's notification law went into effect on July 1, 2003 and applies to businesses and government agencies that own or maintain unencrypted personal information of California residents. The required notice must be made in the "most expedient time possible" and may be in writing or in the form legally prescribed for electronic records and signatures. Under certain circumstances, substitute notice can be given either by e-mail, a conspicuous posting on the company's website or notification to major statewide media. Companies that do not comply with California's notification law can face civil claims by residents who are harmed.

Providing notice of an electronic break-in may be sufficient to comply with California's new law and similar federal legislation currently being proposed, but it probably is not enough to insulate a business from liability for harm resulting from electronic crimes such as identity theft emanating from the security breach. Future lawsuits will likely center on the actions a company took after the break-in to minimize damage and to prevent a reoccurrence. Because laws tend to develop more slowly than business practices, legal rules and guidelines have yet to be formulated for the standard of care a business must follow to avoid liability for database security breaches. At a minimum, management teams will need to adopt data security practices as a hedge against future legal claims. Choosing which practices to adopt will be a challenge for companies with limited IT budgets and resources.

There are measures a business can take to comply with California's new security breach notification law and to minimize its exposure to lawsuits in the future for failing to ensure the security of personal information held in its databases. Some suggested measures include:

1. Establish an Information Security Program. An information security program contains not only technical safeguards, but administrative and physical safeguards as well. A company should assess internal and external risks to the security, confidentiality and integrity of its customer information and design and implement safeguards for preventing, detecting, and responding to database intrusions.

2. Unify Physical and Data Security Functions. A company's facilities management department typically handles physical security functions while the IT department handles database security. Unifying these functions, including creating a single reporting scheme for management of physical and data security operations within a company, will eliminate vulnerabilities that electronic intruders often exploit. Further, facilities access control systems should be integrated with computer network security systems to better enable managers to detect physical or electronic intrusions as they occur.

3. Establish an Electronic Communications Policy. Companies should implement an electronic communications policy governing employee access and use of the company's computer network and electronic communications devices. The policy, in conjunction with employee training, informs employees of restrictions on their access to company databases and computer networks and the consequences of accessing information without authorization.

4. Establish A Privacy Policy and Follow it. Companies should establish a privacy policy that is complete and accurate. The policy should describe the types of information the company collects, as well as how that information is used and what security measures are employed. The company must adhere to the policy in its collection, storage, use and transfer of personal data in order to avoid liability for misrepresentation or similar claims.

5. Establish Reasonable Notification Procedures. Companies that have a reasonable notification procedure in place as part of an information security program can fulfill the notification requirements of the new California law and proposed federal legislation. Notifying affected persons in accordance with an established notification procedure in the event a breach occurs provides a company flexibility in determining how to inform consumers of the security breach. Additionally, having notification procedures in place may help a company build trust with its customers who provide their personal information.

If a company discovers an unauthorized intrusion into its customer information database, the company should immediately seek the advice of experienced counsel to ensure that the steps it takes next do not make a bad situation even worse.

Kevin D. DeBre is a partner in the Intellectual Property and Technology Department of Greenberg Glusker Fields Claman Machtinger & Kinsella LLP. Denica E. Anderson was a summer clerk at the same firm and is presently attending law school at the University of Southern California. Joel Rakow of Tatum Partners LLP contributed to this article and the authors would like to thank Joel for his assistance.