Banking Law

We've discussed (most recently here) incidents that demonstrate how expensive to banks data security breaches can be. Lawyer and law technology columnist Eric Sinrod cited a recent study conducted by The Ponemon Institute and co-sponsored by PGP Corporation that, says Eric, confirms what we've always suspected: "the cost of data breaches is substantial."

The average global total cost of each data breach in 2009 was $3.43 million, with an average cost of $142 per affected record. And here in the United States, the average total cost per breach was a staggering $6.75 million, with an average cost of $204 per affected record.

When I first read this, I wondered how much of the additional cost in the United States might be attributable to the fact that we're the most over-lawyered country on the planet; in fact, I'd suspect the most over-lawyered spot in the known universe. Apparently, however, it's not the fault of the lawyers but of the laws.

Perhaps not surprisingly, the costs were highest where data breach notification laws place requirements on organizations that experience a breach to disclose the details of breach incidents. Accordingly, the costs were the highest in the United States, where practically all states at this point have passed data breach legislation. And Germany, where similar laws were placed last year, experienced the second-highest costs.

Interestingly, but not surprisingly, a whopping percentage of losses relate to lost business to the company that suffers the data breach.

In a wake up call to companies, on average 44% of incurred data loss expenses related to lost business. When customers learn of data breaches, they evidently take their business elsewhere. This should encourage companies to do their very best in preventing and addressing breaches. With respect to the percentage of data loss expenses relating to lost business, the numbers come in like this: Australia 33%; France 30%; Germany 34%; the United Kingdom 46%; and the United States a whopping 66%.

I've become convinced that the major risk of data security breaches is reputational risk. The report seems to bear this out. A bank may have in place "commercial reasonable" information security measures that will pass muster with bank regulators as being in compliance with FFIEC information security guidelines and safety and soundness principles. A bank may also have limited its legal liability to its customers by means of its agreements with its customers. Nevertheless, all the well thought out, legally compliant procedures and written account documents in the world aren't going to save the bank from the ultimate hammer that any customer wields--taking its business elsewhere. That hammer blow can become even more painful if, as has occurred recently in Texas and elsewhere, local media picks up on a data breach that morphs into full-blown litigation and the customer alleges that not only doesn't the bank have adequate security measures, but when those measures fail, the bank refuses to make the customer whole.

Eric does offer one bright note from the report. Not surprisingly, that bright note involves hiring "skilled" legal counsel.

The report also demonstrates that when third-party and/or criminal attacks caused breaches, costs increased due to added forensics and investigations that were launched. The report further details that when there is a strong Chief Information Security Officer (CISO) who took active responsibility for managing a breach, costs were lower across the board in all five countries that were studied.

...It behooves organizations to get their data houses in order on the front-end, and when a breach happens notwithstanding best preventative efforts, the breach should be managed swiftly and effectively by a strong CISO with the assistance of legal counsel skilled in this area.

Gosh, I wonder which "skilled legal counsel" Eric has in mind? Since Eric doesn't state that the report suggested that the CISO be "assisted" by skilled legal counsel, we'll chalk that suggestion up to "literary license."