How The FTC Guides Businesses Through Data Breaches

By: Michelle Cohen

The Federal Trade Commission (“FTC”) recently released a data breach guide for businesses, along with a video and blog to help companies following the immediate aftermath of a data breach.  The FTC also provides a model data breach letter to notify individuals of a breach.  The agency – which views itself as the nation’s primary “privacy police” has faced scrutiny from private parties and courts for allegedly enforcing privacy and data security standards without promulgating specific rules. The agency instead favors outreach efforts, such its blogs, guides and roundtables to educate industry and the public regarding what it views as best practices.

In this vein, the Guide and the model letter are not a “safe harbor” but offer suggestions on important steps that organizations can follow once they discover data breaches.  The FTC emphasizes that the Guide does not pertain to the actual protection of personal information or prevention of breaches, because the agency has already issued separate guidance documents on those subjects.  In fact, the FTC also recently updated its guide on protecting personal information.

Following a data breach, the Guide suggests key steps organizations can take, which include:

• Mobilizing the company’s breach response team to prevent further data loss – the team may include legal, information security, IT, human resources, communications, investor relations, and management; companies may consider hiring an independent forensics team;
• Securing physical areas – lock any physical areas affected by a breach; consider changing access codes;
• Taking affected equipment offline immediately – monitor all entry and exit points, and update authorized users’ credentials and passwords;
• Removing improperly posted information from the company’s website, for instance in a situation where personal information affected by the breach is posted on the company’s website. The FTC also advises companies to search the Internet to see if breached information has been posted on other websites and to contact the owners of those websites;
• Protecting evidence – the FTC reminds companies to retain forensic evidence (e. do not destroy it);
• Documenting the investigation, including interviewing people who discovered the breach and making sure employees (such as customer service representatives) know where to forward information that might assist the company in its investigation;
• Examining service provider relationships, to determine if providers have access to personal information and whether provider access privileges should be changed;
• Determining whether data was encrypted at the time of the breach (note: encryption may obviate the need for data breach reporting in many states);
• Implementing a communications plan that explains the data breach to employees, customers, investors, partners, and others such as the press. The FTC recommends “plain English” answers on a company’s website;
• Following legal requirements – such as state data breach notifications and notifying law enforcement;
• Offering at least a year of free credit monitoring – while not required, free monitoring has become standard and most regulators and consumers expect to see the offer in data breach notifications.

As to data breach notification letters, in addition to following the requirements of state laws, the FTC urges companies to advise people what steps they can take, based on the information exposed.  When a breach compromises social security numbers, individuals should be directed to contact the credit bureaus to request fraud alerts or credit freezes.  Since some scammers pounce on data breach victims, the FTC counsels organizations to tell consumers how they will be contacted going forward.  For instance, if the company will never contact individuals by phone, the company should tell consumers that – so individuals can detect telephonic phishing schemes.

The FTC encourages businesses to use the Guide and its accompanying materials to educate employees and customers, such as through newsletters and websites.  However, when facing an enforcement action or a lawsuit, will a company’s compliance with the Guide offer any relief from FTC or state Attorney General penalties or assist organizations in their defense in private data breach lawsuits?  Ultimately, the crux of breach liability usually relates to how it occurred, but taking swift, corrective actions following a breach should aid an organization when dealing with regulators and third parties by showing good faith actions to prevent further damages. Conversely, a company that fails to take corrective actions can exacerbate a breach and further negatively impact affected individuals and the organization.

The FTC’s Guide and accompanying materials are helpful references, particularly for smaller businesses.  As a practical matter, the words of advice I give companies facing a possible data breach is to first, take the time to determine what happened, how it happened, whether the breach continues, and what you can do to prevent it in the future.  While several states require reporting within a set number of days (e.g., 45), the laws allow organizations time to conduct factual inquiries, take corrective measures, and prepare to notify affected individuals.  Organizations should not rush through these key steps.  Second, communication is key.  A company facing a breach should develop a clear, consistent statement regarding the breach, the steps being taken and a single contact point.  The lack of a communication plan or a consistent message can cause a huge loss of customer and employee confidence and raise regulators’ interest.  Third, when preparing data breach notifications, organizations should note that it is likely that the letter will become public due to some states’ open records laws.  Numerous websites exist that track and publicize data breaches, based upon information in the notifications – often including copies of the actual letters.  Companies should not assume that regulators and consumers simply file the letters away.  While your organization cannot prevent the publicity, having a clear, concise data breach notification that meets each state’s requirements without providing excess data will help the company through the process and associated publicity.