Security, Privacy & AI

Overview

A company makes commitments about security and data in its customer contracts, its data processing agreements, its privacy policy, its insurance applications, and its regulatory filings. Those commitments are enforceable, and they are what a company is measured against.

Some of the work is comparing what a company has promised against what it actually does. Other matters are narrower: negotiating a single agreement, answering one customer’s security review, or assessing a specific feature before it launches.

A good deal of the work is simply drafting the documents themselves: privacy policies, data processing agreements, security addenda, subprocessor lists, terms of service, and the data and AI provisions in customer and vendor agreements — whether a company is writing them for the first time or bringing what it already has into line with what it actually does.

Legal exposure from a data breach

Notification. All fifty states require notice to affected residents, most within a fixed period, and many require notice to the state attorney general. New York’s SHIELD Act separately requires reasonable administrative, technical, and physical safeguards, independent of whether a breach occurs.

State enforcement. State attorneys general enforce their states’ breach notification and data security statutes. A notification filed with a state attorney general can itself prompt an inquiry into whether the company’s safeguards met the standard the statute requires, and those offices have authority to seek penalties and injunctive relief.

Federal Trade Commission. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices, and the Commission has applied it to data security in two ways. A company that describes its security in a privacy policy, a customer agreement, or marketing materials in terms that do not match what it actually does may be found to have made a deceptive representation, whether or not a breach ever occurs. Separately, security failures that cause substantial consumer injury which consumers cannot reasonably avoid may be treated as an unfair practice, even where the company promised nothing specific.

Sector and disclosure obligations. Public companies have SEC disclosure obligations for material cybersecurity incidents. Protected health information brings obligations to HHS. Covered financial services companies in New York are subject to the Department of Financial Services cybersecurity regulation, including its annual certification requirement.

Private litigation. Consumer class actions commonly follow breaches involving personal information, and business customers bring contract claims.

Contractual liability. Enterprise agreements, data processing agreements, and security addenda contain specific obligations: named controls, notification periods, audit rights, indemnities, and in some cases liability for data incidents carved out of the general limitation of liability. Liability is measured against what was agreed, not against what was implemented.

Insurance. Cyber policies are underwritten on the representations made in the application, which operate as warranties. A material misstatement about controls can support a denial of coverage.

Director and officer exposure. Oversight of information security is increasingly treated as a board responsibility, and failures of oversight are pleaded as breaches of fiduciary duty.