The Latest in IT Security

EU to urge shorter data breach notification times

24
Jun
2011

Following a string of data breach notifications which seem to be less than forthcoming, the EU is urging much stricter guidelines for data breach reporting timelines. It a recent article, European Commissioner Viviane Reding was shocked “that companies needed two or three weeks to inform people that their personal data had been stolen.” Recently I blogged about a parallel effort in the U.S. to legislate standards for breach reporting, it seems the effort is gaining traction “across the pond” in Europe as well.

Following her speech to the British Bankers’ Association (BBA) about the proposed legislation, BBA stated that they already followed the “highest standards of customer protection in their data management”, and so expected little impact.

Referencing the recent data breaches at Sony, Sega and others, Reding wants to extend proposed legislation from the telecom and ISP’s to other sectors. She states, “I will make that mandatory everywhere in this new data protection reform. All personal data breach notification across all sections including banking and financial services.”

Expect organizations to argue the additional regulatory administration is unnecessary, but still the E.U. feels companies, especially financial service ones, haven’t reached the point of fairness in reporting to the consumer, especially regarding situations where customers may need to act quickly to protect their personal information before it is acted upon by cybercriminals.

A delayed notification becomes exponentially worse for customers if they use the same password on multiple websites, a common practice. In a recent blog, Randy Abrams notes, “Do you use the same password for your multiple social networking accounts, email accounts, and other online services? If you answer yes to this, then about once every 5 minutes is the optimal interval for changing your password. When you use the same password everywhere it only takes one Sony-style mistake to compromise all of your accounts. Remember, your passwords are on the Internet, and they are not entirely under your control.”

The usual advice applies, keep your own cyber-situational-awareness, the same as you might about your physical security, avoid shady places, etc. But when a trusted vendor has an unfortunate data breach and delays notification past what is responsible, expect increasing pressure from regulators to make it hurt.

Leave a reply


Categories

SUNDAY, SEPTEMBER 22, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments

Social Networks