Intellectual Property Law

Data Security and Data Privacy in the Payment System

By Tim Armstrong, Derek Bambauer, and William McGeveran.

On Friday, March 19, Brooklyn Law School hosts a symposium on data security and data privacy in the payment system. There’s a terrific lineup of speakers, including James Grimmelmann of NYLS, Chris Jay Hoofnagle of Berkeley, Sarah Jane Hughes from Indiana-Bloomington, Adam Levitin of Georgetown, Juliet Moringiello from Widener, Frank Pasquale of Seton Hall, and BLS’s Ted Janger (the driving force behind the symposium). The abstract is below – you can RSVP on-line. And, it’s free (unless you need CLE credit)! Hope to see you there!

In the modern payment system tremendous amounts of data flow between and among financial institutions, consumers, merchants and data processors.  Some of the data is shared to effectuate transactions.  Other data is shared for customer service and marketing purposes.  Data privacy law governs the question of what uses of this information are appropriate. Data security law governs the ways in which such data must be secured from inadvertent disclosure.  The two subjects are linked but they raise very different sets of regulatory questions.  Consumers are often surprised at how their data is used, and protecting their expectations is important.  They are, however, frequently harmed when financial institutions fail to safeguard customer data.  Identity theft and other forms of fraud cause direct harm.  These distinctions are placed in high relief where financially sensitive data is involved, and the purpose of this conference is to consider legal mechanisms for generating appropriate rules and norms for information sharing, for enforcing those norms and for mitigating harm caused by accidental data leaks.

The conference will consider the manner in which consumers and financial institutions contract for data privacy and data security, possible regulatory responses to the limitations of a contract based regimes, and finally the possibility of a coordinated regulatory architecture to deal with and minimize the harm caused by security breaches.

Full post as published by Info/Law on March 06, 2010 (boomark / email).