Page 31 - SMRH Eye on Privacy 2019 Year in Review Brochure

North Dakota Misuse Law Amended
Posted on May 10, 2019
North Dakota criminal law currently contains penalties for misusing the personal information of another. That law has been expanded, and beginning August 1, 2019, it is a class B felony to use a skimmer or scanning device to try get information from a payment card, credit card, or state ID without the permission of the authorized card holder. Also changing August 1 are more elements in the definition of personal information. Namely, payment card information, biometric data, and other “numbers, documents or information that can be used to access another person’s financial records.” Existing elements in the law included social security numbers, employee ID, mother’s maiden name, and the like.
PUTTING IT INTO PRACTICE: This amendment is a reminder that states have a variety of laws in place aimed at protecting individuals from the misuse of their personal information. These laws are constantly being re-examined, and the definition of personal information is ever-expanding.
Israel Expresses Concerns Over Investment Fund Security Measures
Posted on April 3, 2019
Israel’s investment industry has been reported as growing, and not surprisingly it has received interest from the Israeli Securities Authority. Late last year the ISA surveyed several funds and found that they were not following the requirements of Israel’s privacy laws. This resulted in a recent letter sent by the ISA to fund managers, warning the managers to take steps to protect customer information. Israel, like most countries around the globe, has a privacy law and corresponding regulations. Unlike many other jurisdictions, though, its privacy law has been deemed “adequate” by the EU, and as such, compliance can be a fairly rigorous exercise. Accompanying the ISA letter were “insights” on how to protect information, including things like software updates and user authentication. Included in the insights were recommendations that are not included in Israel’s privacy law or regulation. However, the insights do mirror requirements that exist under Israeli laws for banks and insurance companies.
PUTTING IT INTO PRACTICE: This letter shows the worldwide concern regulators have of ensuring companies protect consumer information.
SEC To Focus on Cybersecurity in 2019
Posted on March 27, 2019
For the fourth year running, the Securities and Exchange Commission’s Office continues to list cybersecurity as one of the top enforcement priorities for 2019. As it relates to cybersecurity, the SEC will be focusing on ensuring companies have proper configuration of network storage devices, robust information security governance, and established policies and procedures specific to protecting retail investors’ trading information and preventing cyber intrusions into retail brokerage accounts. The SEC also wants to see that companies manage both their own systems (including legacy systems), as well as maintaining adequate oversight of the practices of their partners and affiliates. The SEC has also articulated concern and focus regarding the cybersecurity practices of investment advisors. In particular, the SEC indicated it will review cybersecurity policies of investment advisors, with a focus on those with multiple branch offices or that have recently merged with other advisers. Investment advisors will need to demonstrate suitable governance and risk assessment of cyber risks, including incident response plans; robust controls and procedures around access to systems containing customer information; data preservation procedures; vendor management guidelines specific to cyber-related vendors; and cybersecurity training.
PUTTING IT INTO PRACTICE: The SEC continues to pay significant attention and scrutiny to the cybersecurity practices and preparedness of market participants and registered entities. Companies should keep this in mind as they prioritize and fund their security efforts throughout 2019.
Eye on Privacy 2019 Year in Review 30