Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

Cybersecurity events, such as ransomware attacks and business email compromises, can impact even the best-prepared business. Unfortunately, a corporate victim of a cybersecurity event may itself become the target of litigation or government enforcement actions, adding costly insult to serious injury. Recently, the Florida and West Virginia Legislatures crafted legislation seeking to provide companies with certain limited protection from private litigation after they suffer a data breach despite their cybersecurity planning and execution. Once these legal frameworks are enacted into law, businesses subject to <a>them </a>will be able to undertake certain measures to invoke cybersecurity safe harbor provisions to obtain legal liability protection if they suffer a data breach.

contentpilot/introduction

core/heading

Recently, the Florida Legislature passed <a href="https://www.flsenate.gov/Session/Bill/2024/473" target="_blank" rel="noreferrer noopener">House Bill 473</a>, which will enter into force if (or, more likely, “when”) signed into law by Governor Ron DeSantis. HB 473 provides certain liability protection for state governments and <a>commercial </a>entities (and their agents). Specifically, it provides that private-sector organizations that maintain personal information will not be “liable in connection with a cybersecurity incident” if they substantially comply with Florida’s <a href="https://www.flsenate.gov/laws/statutes/2014/501.171" target="_blank" rel="noreferrer noopener">personal data breach notification statute</a> and have adopted a cybersecurity program that substantially aligns with certain standards, guidelines, or regulations, which include (but are not limited to) the following:

core/paragraph

core/list

Entities regulated by state or federal cybersecurity standards (e.g., healthcare entities, financial institutions) would be required to comply with these applicable standards for the liability protections to apply.

HB 473 also provides that an organization can demonstrate “substantial alignment” with these cybersecurity frameworks “by providing documentation or other evidence of an assessment, conducted internally or by a third party, reflecting that [its] cybersecurity program is substantially aligned with the relevant framework or standard or with the applicable state or federal law or regulation.” Such an assessment must take into account the size and complexity of the covered entity, the nature and scope of its activities, and the sensitivity of the information to be protected. These organizations must, within one year, update their cybersecurity program to “substantially align” with any amendments made to cybersecurity frameworks approved within the law.

In an action relating to a cybersecurity incident, the defendant (i.e., the covered entity) has the burden of proof to establish substantial compliance.

Importantly, the law does not define “cybersecurity incident” or “personal information,” nor does it seek to describe the scope of the law’s immunity. These issues will likely be resolved by the courts.

As noted above, West Virginia also recently adopted a cybersecurity safe harbor statute, <a href="https://www.wvlegislature.gov/Bill_Status/bills_history.cfm?INPUT=5338&amp;year=2024&amp;sessiontype=rs" target="_blank" rel="noreferrer noopener">House Bill 5338</a>, although it contains more detail than other similar state laws and appears to be narrower than Florida HB 473.

HB 5338 provides that a covered entity that creates, maintains, and complies with certain cybersecurity standards is “entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.”

A covered entity is defined as “a business that accesses, maintains, communicates, or processes personal information or restricted information in or through one or more systems, networks, or services located in or outside this state.” The terms “personal information” and “restricted information” relate to various types of personally identifiable information with varying degrees of sensitivity.

HB 5338 provides that a cybersecurity program must contain administrative, technical, operational, and physical safeguards, and shall be designed to do all of the following:

HB 5338 also provides that the “scale and scope” of a cybersecurity program is “appropriate” if its operational costs are “no less than the covered entity’s most recently calculated maximum probable loss value.”

A covered entity satisfies all the of the law’s requirements if its cybersecurity program “reasonably conforms” to any of the following cybersecurity programs:

When any revisions to these frameworks are published, a covered entity must adopt them “within the time frame provided in the relevant framework upon which the covered entity intends to rely to support its affirmative defense, but in no event later than one year after the publication date stated in the revision.”

HB 5338 separately addresses educational institutions’ cybersecurity programs, providing that “[a]ny institution of higher education in [West Virginia] may offer a cybersecurity assessment program as part of an undergraduate or graduate program relating to cybersecurity to any business in the state.” It further provides that such an institution, or any employee or student thereof, offering these cybersecurity assessment programs are “immune from civil liability that arises from the failure of a covered entity to conform to the provisions of this article."

To effectively and efficiently avail themselves of these cybersecurity safe harbor statutes, businesses should consider the following three areas.

Formalize existing security measures. Many businesses have already implemented some technical, physical, and administrative data security measures to protect data in their custody and control. For example, businesses routinely use encryption protocols, firewalls, and other technical programs to safeguard corporate data, as well as incident response procedures, confidentiality requirements, and other administrative security measures. However, these safeguards, plans, and policies may have been generated and implemented in a disparate and inconsistent manner. To identify the scope of cybersecurity programs and demonstrate compliance with cybersecurity standards set forth in the safe harbor laws, these policies should be reviewed and consolidated under a unified, written cybersecurity plan.

Identify where the program aligns. Once a business determines the scope of its existing cybersecurity program, it should compare and contrast it to the acceptable frameworks set forth in the cybersecurity safe harbor laws to identify the security framework with which it most closely aligns. Thereafter, the business will be better positioned to more narrowly create and implement the remaining elements of the cybersecurity framework needed to satisfy the safe harbor provision.

Satisfy outstanding requirements. Once a business determines the acceptable cybersecurity framework with which it most closely aligns, it should implement any outstanding physical, technical, and administrative measures needed to satisfy the framework’s remaining requirements. In addition, to ensure that a business can rely upon the safe harbor provision, it will need to establish an internal or external process to continuously monitor its cybersecurity program for compliance purposes.

The new laws in Florida and West Virginia and similar laws in other states (e.g., <a href="https://www.cga.ct.gov/2021/ACT/PA/PDF/2021PA-00119-R00HB-06607-PA.PDF" target="_blank" rel="noreferrer noopener">Connecticut</a>, <a href="https://admin.thompsonhine.com/wp-content/uploads/1137/doc/Steven_G._Stransky_and_Thomas_F._Zych.pdf" target="_blank" rel="noreferrer noopener">Ohio</a>, <a href="https://le.utah.gov/xcode/Title78B/Chapter4/78B-4-P7.html" target="_blank" rel="noreferrer noopener">Utah</a>) provide incentives for companies to adopt cybersecurity measures to protect personal information in their custody and control. Cyberattacks continue to increase in scope and sophistication, and these statutes offer a valuable safe harbor to businesses that proactively build a cybersecurity program.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/03/Privacy-Cybersecurity-Update-Florida-and-West-Virginia-Create-New-Cybersecurity-Safe-Harbor-Laws.pdf

Florida and West Virginia Create New Cybersecurity Safe Harbor Laws

Services