Incident Response

On May 31, 2019, the Cyberspace Administration of China (“CAC”) released the draft Regulation on the Protection of Children’s Personal Information Online (“Draft Regulation”) for public comment. (An official Chinese version is available here and an unofficial English translation of the Draft Regulation is available here.) The comment period ends on June 30, 2019.

As mentioned in our last blog post (available here), CAC issued the draft Measures for Data Security Management (“Draft Measures”) just last week, which set out the general regulatory framework that will govern the collection and use of personal information by network operators (broadly defined as “owners and managers of networks, as well as network service providers”). The release of this new Draft Regulation demonstrates CAC’s intention to set out more stringent requirements for network operators if they collect, store, use, transfer or disclose the personal information of minors under 14 years old. We discuss the key requirements of the Draft Regulation in a greater detail below.Continue Reading CAC Releases Draft Regulation on the Protection of Children’s Personal Information Online

Among the many issues that can give rise to the initial uncertainty of responding to a significant cybersecurity incident is a failure by incident response team members to understand the perspectives and priorities of other stakeholders. But this complicating factor can readily be mitigated through cross-functional education and relationship building before an incident occurs.

In the first part of a two-part article in Cybersecurity Law Report (subscription required), Steve Surdu and Jennifer Martin, members of Covington’s cybersecurity practice with extensive experience responding to cyber incidents, explain the differences in how forensic analysts and lawyers approach incident response, and how those differences, if understood, can complement one another rather than lead to tension. 
Continue Reading Working Effectively with Forensic Firms

The second annual study on data breach preparedness was released by the Ponemon Institute on September 24, and the study indicates that the number of companies that have had a data breach is on the rise.

Ponemon Institute conducts independent research on privacy, data protection, and information security policy.  For the September 2014 study, Is Your Company Ready for a Big Data Breach?, Ponemon Institute surveyed 567 U.S. executives from organizations ranging in size from less than 500 to more than 75,000 employees about how prepared they think their companies are to respond to a data breach.

It appears that for an overwhelming number of the study’s participants, the answer to “Is your company ready for a big data breach?” is, unfortunately, “No.”Continue Reading Ponemon Institute Releases Second Annual Study on Data Breach Preparedness

A recent surveyof public company directors and general counsel reveals that data security risk is the top legal concern among both key governance groups.  According to the 12th annual Law and the Boardroom Study by Corporate Board Member and FTI Consulting, 48% of directors and 55% of general counsel…

Continue Reading Data Security Top Concern of Directors, GCs