Search

INTRODUCTION 418 I. THE SCIENCE AND LEGISLATION OF BIOMETRICS 421 A. BIOMETRICS IN THE MODERN WORLD 422 B. MODERN RISKS IN THE BIOMETRICS FIELD 424 C. STATE BIOMETRIC REGULATION 427 [...]

CONTENTS INTRODUCTION I. DATA SECURITY A. Data Security Law 1. Purpose 2. Structure a. Protection Duties i. Data Security Rules ii. Reasonable Security Standards b. Notification Duties c. Remedies 3. [...], By broad consensus, data security laws have failed to stem a rising tide of data breaches. Lawmakers and commentators blame these failures on some combination of underenforcement and the laws failure to recognize the full range of data breach harms. Proposed solutions would augment or expand existing data security laws. These proposed solutions share a fatal flaw: they are rooted in traditional theories of deterrence by punishment. Data security laws come in three forms: duties to protect data, duties to notify consumers after a breach, and post-breach remedies. Almost every data security law is enforced through sanctions, most of which are applied after a company discovers a data breach. In theory, companies increase their data security efforts to avoid sanctions. While appropriate for companies that purchase software, this approach is ineffective when applied to companies that build and provide software as an online service. In the cloud context, improving cybersecurity practices increases expected sanctions. And the cloud context matters. Online data security implicates almost all personal data; online services hold the lion's share of personal data and offline firms rely heavily on cloud software to operate their businesses. This Article calls for a new approach to data security regulation, founded on a systemic view of data security practice. By focusing on system-level incentives instead of individual outcomes, lawmakers can bring data security law back into harmony with policy goals.

CONTENTS I. INTRODUCTION. II. AUTOMATED DECISION-MAKING, AI, AND MACHINE LEARNING SYSTEMS A. Current Capabilities and Technology B. The Shortcomings Inherent in Current AI and ML Models 1. Intentional Discrimination 2. [...], Automated decision-making ("ADM") systems, whether deploying artificial intelligence, machine learning, or other algorithmic processes, have become ubiquitous in modern life, but their use is often unnoticed or invisible to society at large. Currently no federal laws require notice or disclosure to individuals when an ADM is used to collect their data, evaluate them, or make determinations about their lives. This is particularly concerning for the employment relationship because notice and transparency are essential for personal privacy, and the surreptitious use of ADM systems deprives applicants and employees of the ability to understand employers' decision-making processes and to seek redress under applicable antidiscrimination laws. Some state and local governments have recognized this danger and have taken initial steps to protect applicants and employees, while the European Union has proposed a sweeping AI regulation that would govern all phases of development of such systems there. This article proposes a system of regulations based on notice and transparency that takes into consideration existing laws governing the employment relationship and complements those laws in order to produce a legal framework that promotes applicant and employee rights, while also allowing flexibility for the development of ADM systems that benefits employees, employers, and society.

INTRODUCTION 415 I. BACKGROUND 417 A. CYBERATTACKS IN GENERAL 417 B. GOVERNMENT ENTITIES AS TARGETS 419 C. ARTICLE III STANDING 419 1. THE CIRCUIT COURTS: STANDING GRANTED 423 2. THE [...]

I. INTRODUCTION In July 2015, Siouxland Anesthesiology, Ltd., suffered a data breach of 13,000 patient records due to a "hacking/IT incident" later determined to be a criminal malware attack.' The [...], Reading about major data breaches in the news is a disturbing, but all too common, occurrence these days, and South Dakota companies are no exception. In fact, since South Dakota's data breach notification law. Senate Bill 62, became effective on July 1, 2018, fifty-five data breaches have been reported to the South Dakota Attorney General. While some of these breaches are known to have occurred in the healthcare sector due to HIPAA breach reporting requirements, identifying other industries is not possible because the information is not available to the public. While the act strengthens post-breach reporting on some organizations not subject to federal legislation, others, like "covered entities " and "business associates "falling under HIPAA's purview, are only required to meet HIPAA's Privacy and Security Rules. In the absence of a comprehensive, industry-neutral federal data security regulatory scheme, South Dakota needs to adopt a proactive statutory measure to strengthen protections for South Dakota residents' Personally Identifiable Information ("PII") and Protected Health Information ("PHI"). This comment will highlight healthcare data breaches in South Dakota, as they are readily identifiable and a significant source of data breaches within the state, while also providing an overview of data breach trends. Additionally, this comment will explore the legal landscape of health information data security in South Dakota and how other states, like Nebraska, are taking action to protect the data and privacy of their residents. Finally, this comment will argue for proactive legislation beyond data breach notification laws.

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.clsr.2010.01.006 Byline: Mark Burdon (a), Bill Lane (a), Paul von Nessen (b) Abstract: Public and private sector organisations are now able to capture and utilise data on a vast scale, thus heightening the importance of adequate measures for protecting unauthorised disclosure of personal information. In this respect, data breach notification has emerged as an issue of increasing importance throughout the world. It has been the subject of law reform in the United States and in other jurisdictions. This article reviews US, Australian and EU legal developments regarding the mandatory notification of data breaches. The authors highlight areas of concern based on the extant US experience that require further consideration in Australia and in the EU. Author Affiliation: (a) Faculty of Law, Queensland University of Technology, Australia (b) Business Law and Taxation, Monash University and Consultant, McCullough Robertson Lawyers, Australia

INTRODUCTION During the past four years, over 354,140,197 pieces of personal identifying information have been compromised as a result of data breaches. (1) These breaches have imposed a huge financial [...]

I. INTRODUCTION A. Large Scale Data Breaches The term "data breach" is generally and broadly defined to include "an organization's unauthorized or unintentional exposure, disclosure, or loss of sensitive personal [...], Individuals have been at risk of having their personal information stolen and used to commit identity-related crimes long before the emergence of the Internet. What the Information Age has changed, however, is the method by which identity thieves can access and exploit the personal information of others. One method in particular leaves hundreds of thousands, and in some cases tens of millions, of individuals at risk for identity theft: large scale data breaches by skilled hackers. In this method, criminals remotely access the computer systems of government agencies, universities, merchants, financial institutions, credit card companies, and data processors, and steal large volumes of personal information on individuals. Such large scale data breaches have revolutionized the identity theft landscape as it relates to fraud on existing accounts through the use of compromised credit and debit card account information. Large scale data breaches would be of no more concern than small scale identity thefts if criminals were unable to quickly and widely distribute the stolen information for subsequent fraudulent use (assuming, of course, that the breach would be quickly detected). Such wide-scale global distribution of stolen information has been made possible for criminals with the advent of criminal websites, known as 'carding forums,' dedicated to the sale of stolen personal and financial information. These websites allow criminals to quickly sell the fruits of their ill-gotten gains to thousands of eager fraudsters worldwide, thereby creating a black market for stolen personal information. This article first provides a brief background on large scale data breaches and the criminal 'carding' organizations that are responsible for exploiting the stolen data. Second, the article provides an in-depth examination of the process by which large volumes of data are stolen, resold, and ultimately used by criminals to commit financial fraud in the underground carding world. Third, this article discusses how carding activity is linked to other crimes, including terrorism and potentially drug trafficking. Fourth, this article outlines several recent investigations and prosecutions of carding organizations and the individual carders themselves. Fifth, this article examines the responses by the credit card industry and state legislatures to the recent increase in reported data breaches. Finally, this article outlines several recommendations to enhance the government's ability to continue to successfully prosecute carders and carding organizations. 'Cyber-crime has evolved significantly over the last two years, from dumpster diving and credit card skimming to full-fledged online bazaars full of stolen personal and financial information.' (1) Brian Nagel, Assistant Director, U.S. Secret Service