|
Regulation
|
Promulgated by
|
Description
|
|
Payment Card Industry Data Security Standard(PCI DSS)
|
|
ThePCI DSSis a set of requirements for enhancing the security of payment customer account data. It was developed by the founders of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa to help facilitate global adoption of consistent data security measures. PCI DSS includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. Using the Payment Card Industry (PCI) Data Security Standard as its framework, CISP provides the tools and measurements needed to protect against cardholder data exposure and compromise across the entire payment industry. The PCI Data Security Standard consists of 12 basic requirements supported by more detailed sub conditions.
The Council has also issued requirements called the Payment Application Data Security Standard (PA DSS) and PCI Pin Transaction Security (PCI PTS).
Who is affected:Retailers, credit card companies, anyone handling credit card data.
https://www.pcisecuritystandards.org/security_standards/documents.php
|
|
Safe Harbor Act
|
|
What it covers:The Safe Harbor Act, which went into effect in October 1998, prohibits the transfer of personal data to non-European Union nations that do not meet the European "adequacy" standard for privacy protection established by the European Union Data Protection Directive (see above). The Act was intended to bridge the different privacy approaches of the U.S. and Europe, thus enabling U.S. companies to safely engage in trans-Atlantic transactions without facing interruptions or even prosecution by European authorities.
Who is affected:U.S. companies doing business in Europe.
|
|
Children's Online Privacy Protection Act (COPPA)
|
|
COPPA, which took effect in 2000, applies to the online collection of personal information from children under 13. Monitored by the Federal Trade Commission (FTC), the rules limit how companies may collect and disclose children's personal information. They codify what a Web site operator must include in a privacy policy, when and how to seek verifiable consent from a parent and what responsibilities an operator has to protect children's privacy and safety online.
Who is affected:Operators of commercial Web sites and online services directed to children under 13 that collect personal information from children, as well as general audience Web sites with the actual knowledge they are collecting personal information from children.
Link to the law:http://www.ftc.gov/ogc/coppa1.htm
|
|
Fair and Accurate Credit Transaction Act (FACTA)
|
|
Passed in December 2003, FACTA is an amendment to the Fair Credit Reporting Act that is intended to help consumers avoid identity theft. Accuracy, privacy, limits on information sharing, and new consumer rights to disclosure are included in the legislation. The Act also says businesses in possession of consumer information or information derived from consumer reports must properly dispose of the information.
The Red Flags Rule establishes new provisions within FACTA requiring financial institutions, creditors, etc. to develop and implement an identity theft prevention program. The Red Flags Rule has been delayed several times and is currently scheduled for enforcement by the FTC starting December 31, 2010.
Who is affected:Credit bureaus, credit reporting agencies, financial institutions, any business that uses a consumer report and creditors. As defined by FACTA, a creditor is anyone who provides products or services and bill for payment.
Link to the law:http://www.ftc.gov/os/statutes/031224fcra.pdf
|
|
Federal Rules of Civil Procedure (FRCP)
|
|
In place since 1938, the FRCP discovery rules govern court procedures for civil lawsuits. The first major revisions, made in 2006, make clear that electronically stored information is discoverable, and they detail what, how and when electronic data must be produced. As a result, companies must know what data they are storing and where it is; they need policies in place to manage electronic data; they need to follow these policies; and they need to be able to prove compliance with these policies, in order to avoid unfavorable rulings resulting from failing to produce data that is relevant to a case.
Security professionals may be involved in proving to a court's satisfaction that stored data has not been tampered with.
Who is affected:Any company that is—or could be—involved in a civil lawsuit within the federal courts. Also, because states have adopted FRCP-like rules, companies involved in litigation within a state court system are also affected.
Link to the rules:http://www.law.cornell.edu/rules/frcp/
|
|
European Union Data Protection Directive
|
|
The European Union Data Protection Directive (EUDPD) standardizes the protection of data privacy for citizens throughout the European Union (EU) by providing baseline requirements that all EU member states must achieve in national regulations. The EUDPD has a strong influence on international regulations due to the limitations it puts on sending EU citizens' personal information outside of the European Union to areas that are deemed to have less than adequate standards for data security. Example of specific laws in countries representing EU member states are the Finnish Personal Data Act (523/1999) and Amendment (986/2000), the Danish Act on Processing of Personal Data (Act No. 429) of May 31, 2000, and the Austrian Federal Act concerning the Protection of Personal Data (Datenschutzgesetz 2000 - DSG 2000). The EUDPD, member state transpositions of the Directive, and the regulations enacted pursuant to it impact companies that do business in the EU or that handle the data of EU citizens.
Link to the law:http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2001:008:0001:0022:EN:PDF
Additional legislative documents and case law: http://ec.europa.eu/justice/policies/privacy/law/index_en.htm
Who it impacts:European businesses, as well as non-European companies to which data is exported (see Safe Harbor Act, below).
|
|
The Federal Information Security Management Act
|
|
The Federal Information Security Management Act of 2002 (FISMA) was enacted to bolster computer and network security within the U.S. federal government and affiliated parties (such as government contractors) by mandating yearly audits. FISMA has brought attention within the federal government to the previously neglected area of cyber security. At the time of this writing, however, many government agencies have received extremely poor marks in this area on their official report cards. The average grade of 67.3 percent for 2004 was an improvement of only 2.3 percentage points over 2003, and experts warn that this average must increase for the federal government to truly protect itself and its citizens.
|
|
California Senate Bill 1386(CA SB 1386)
|
|
CA SB 1386 was introduced in July 2003 as a first attempt by a state legislature to address the problem of identity theft. In short, the bill introduces stiff disclosure requirements for businesses and government agencies that experience security breaches that might endanger the personal information of California residents. It is expected that many organizations in the Unites States are subject to these requirements. In addition, many other states since have, or are planning to, enact similar legislation.
|
|
Personal Information Protection and Electronic Documents Act(PIPEDA)
|
|
PIPEDA is a Canadian federal regulation that governs the collection, use, and disclosure of personally identifiable information in the course of commercial transactions. The act was created in response to European Union data protection directives that limit trade with nations whose privacy protection does not meet EU standards. PIPEDA incorporates and makes mandatory provisions of the Canadian Standards Association's Model Privacy Code of 1995. The act covers all of the Canada except those provinces that have "substantially similar" legislation (namely British Columbia, Alberta, and Québec) and covers all inter-provincial trade.
Who is affected: All private-sector companies doing business in Canada.
Link to the law: http://www2.parl.gc.ca/HousePublications/Publication.aspx?pub=bill&doc=c-6&parl=36&ses=2&language=E
|
|
Nevada Personal Information Data Privacy Encryption Law NRS 603A
|
|
What it covers: In January 2010, Nevada was the first state to enact a data security law that mandates encryption for customers' stored and transported personal information.
Who is affected: Businesses that collect and retain personal information of Nevada residents.
Link to the law: http://www.leg.state.nv.us/nrs/nrs-603a.html
|
|
Massachusetts 201 CMR 17 (aka Mass Data Protection Law)
|
|
This Massachusetts law—which went into effect March 2010—works to protect the state's residents against fraud and identity theft. It requires that any business that stores or uses personally identifiable information about a Massachusetts resident develop a written, regularly audited plan to protect this information. It takes a risk-based approach—rather than a prescriptive one—to information security. That means it directs businesses to establish a security program that takes into account the business size, scope, resources, nature and quantity of data collected or stored and the need for security rather than requiring the adoption of every component of a stated program.
More about Mass 201 CMR 17 and data breach notification
• The 201 CMR 17 survival guide
• Mass data protection law's tough requirements
• How NOT to write a disclosure letter
Who is affected: Businesses that collect and retain personal information of Massachusetts residents in connection with the provision of goods and services or for the purpose of employment.
|
|
Law on the Protection of Personal Data Held by Private Parties—Mexico
|
|
Published in July 2010, this Mexican law requires organizations to have a lawful basis—such as consent or legal obligation—for collecting, processing, using and disclosing personally identifiable information. While there is no requirement to notify processing activities to a government body, as in many European countries, companies handling personal data must furnish notice to the affected persons. Individuals must also be notified in the event of a security breach.
Link to the law(Spanish language): http://www.dof.gob.mx/nota_detalle.php?codigo=5150631&fecha=05/07/2010
Who it will impact:Mexican businesses, as well as any company that operates or advertises in Mexico or uses Spanish-language call centers and other support services located in Mexico.
|
|
Customs-Trade Partnership Against Terrorism (C-TPAT)
|
|
C-TPAT is a worldwide supply chain security initiative established in 2004. It is avoluntaryinitiative run by U.S. Customs and Border Protection, with the goals of preventing terrorists and terrorist weapons from entering the U.S. It is designed to build cooperative government-business relationships that strengthen and improve the overall international supply chain and U.S. border security. Businesses are asked to ensure the integrity of their security practices and communicate and verify the security guidelines of their business partners within the supply chain.
More about C-TPAT and supply chain security
C-TPAT and cargo security: Sea change
10 steps to loading dock security
Benefits for participating in C-TPAT include a reduced number of CBP inspections, priority processing for CBP inspections, assignment of a C-TPATsupply chain securityspecialist to validate security throughout the company's supply chain and more.
Who is affected:Trade-related businesses, such as importers, carriers, consolidators, logistics providers, licensed customs brokers, and manufacturers.
|
|
Free and Secure Trade Program (FAST)
|
|
FAST is avoluntarycommercial clearance program run by U.S. Customs and Border Protection for pre-approved, low-risk goods entering the U.S. from Canada and Mexico. Initiated after 9/11, the program allows for expedited processing for commercial carriers who have completed background checks and fulfill certain eligibility requirements. Participation in FAST requires that every link in the supply chain -- from manufacturer to carrier to driver to importer -- is certified under the C-TPAT program (see above). Cards cost $50 and are valid for 5 years.
Benefits of using FAST and C-TPAT include:
Upon terrorist alerts, FAST/C-TPAT drivers will be allowed to cross the border.
Dedicated lanes for greater speed and efficiency
Reduced cost of compliance with customs requirements.
Who is affected:Importers, carriers, consolidators, licensed customs brokers, and manufacturers.
Link to FAST program details:http://www.cbp.gov/xp/cgov/trade/cargo_security/ctpat/fast/fast_driver/
|
|
Electronic Fund Transfer Act, Regulation E (EFTA)
|
|
Enacted in 1978, this law protects consumers engaging in electronic fund transfers from errors and fraud. It carries out the purposes of the Electronic Fund Transfer Act, which establishes the basic rights, liabilities, and responsibilities of EFT consumers of financial institutions that offer these services. EFTs include ATM transfers, telephone bill-payment services, point-of-sale terminal transfers in stores and preauthorized transfers from or to a consumer's account (such as direct deposit and Social Security payments). Effective August 2010, a new provision states that institutions may not impose dormancy, inactivity or service fees for pre-paid products, such as gift cards, nor can they have an expiration date of less than five years.
Who is affected:Financial institutions that hold consumer accounts or provide EFT services, as well as merchants and other payees.
|