PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

Why Enforce Privacy and Security Laws?

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
October 15, 2014

law blog 1by Daniel J. Solove

law blog 2

PART 1

Are privacy and security laws being enforced effectively? This post is part of a series called Enforcing Privacy and Security Laws.

How are privacy and security laws enforced? How should they be enforced? What enforcement works well? What doesn’t? What are the various agencies that are enforcing privacy laws doing? How do the agencies compare in their enforcement efforts?

I plan to explore these questions in a series of posts. Collectively, I’ll call this series “Enforcing Privacy and Security Laws.”

Continue Reading

Why Being Well-Regulated Is Good for Business

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
October 6, 2014

?????????????

by Daniel J. Solove

After Apple announced that it wouldn’t provide law enforcement with an easy back door to access data on people’s devices, we heard loud whining coming from the FBI and various security proponents that this would be bad for security.

Continue Reading

The Best Preventative Medicine for Health Data Breaches

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
October 6, 2014

data breach 1

by Daniel J. Solove

Last week, I gave a keynote address at a conference called Safeguarding Health Information: Building Assurance through HIPAA Security, sponsored by the National Institute of Standards and Technology (NIST) and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR). I’d like to summarize my remarks here for anyone interested who wasn’t able to attend.

Continue Reading

How to Enter the Privacy Profession

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 29, 2014

privacy profession

by Daniel J. Solove

The privacy profession is growing by leaps and bounds, but entering it is tricky. My law students and others frequently ask me how they can enter the privacy field. Most jobs seem to require a few years of experience, but the privacy profession is still relatively new, and getting this experience can be difficult because there are not many clear paths to entry.

Once in the field, the demand is high for privacy professionals with experience. But there is a bottleneck in getting into the club. I have written about this problem in a previous blog post.

Continue Reading

Big Myths About Big Data

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 23, 2014

big data post

by Daniel J. Solove

The FTC held a workshop this Monday about Big Data. The term “Big Data” is used everywhere these days, and depending upon who is talking about it, Big Data is either the hippest thing in the world and the producer of miracles that will save the human race, or it is the scourge of all evil and the doom of freedom and democracy. I think that neither is the truth, and I want to dispel some myths about Big Data:

Continue Reading

Why Do Lawsuits for Data Breaches Continue Even Though the Law Is Against Plaintiffs?

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 22, 2014

chess pic 1

by Daniel J. Solove

If there’s a big data breach, the class action lawyers will start nipping like a bunch of hungry crocodiles. Upwards of forty separate lawsuits were filed against Target after its data breach, and one was filed the day after the breach became public knowledge.

The law, however, has thus far been far from kind to plaintiffs in data breaches. Most courts dismiss claims for lack of harm. I have written extensively about harm in a series of posts on this blog, and I have chided courts for failing to recognize harm when they should.

Continue Reading

Does Training Really Work? Can It Reduce Data Security Breaches?

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 18, 2014

does training work 1

by Daniel J. Solove

According to a recent report by Enterprise Management Associates, 56% of employees are not receiving any sort of data security awareness training.

This is a rather distressing statistic. It is particularly distressing because according to another study, “when specific employee behaviors are addressed in a meaningful way to bring about a security-aware culture, the incidence and cost of non-compliance plummets.”

Continue Reading

Why the C-Suite Should Have Coffee with the Privacy and Security Officers Every Week

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 10, 2014

 

c suite blog 1

by Daniel J. Solove

As I discussed in a previous post, the two key things that organizations can do to prevent data incidents can be summed up in a simple rhyme:

The C-Suite must care

The workforce must be aware

In this post, I want to focus on the “C-Suite” – a term used for the upper management of an organization, its top officers.

The C-Suite must care about data security.

But far too often, the C-Suite doesn’t fully appreciate the risks and could use a better understanding of the law.

Continue Reading

10 Biggest Data Breaches: Facts and Lessons

Daniel Solove     @daniel-solove.bsky.social
Founder of TeachPrivacy
September 3, 2014

 

97a2e379-d119-4fcc-9941-5876170888d8

by Daniel J. Solove

Recently, hackers from China stole 4.5 million records of patients from a hospital chain in Tennessee. Do you think that’s big? As a Bloomberg article notes, however,” they haven’t come close to entering the ranks of the biggest breaches of all time. In fact, they haven’t even cracked the top 10.”

Bloomberg has a terrific infographic about the top 10 largest data breaches in the United States.

Continue Reading