While federal lawmakers might be hesitant to enact national data privacy legislation, some states are quickly moving to define reasonable cybersecurity—and protect those that adhere to them. But even as legislators extend “safe harbor” protections to encourage cybersecurity, lawyers noted some companies might ignore the incentive to avoid burdensome responsibilities.
In March, Utah joined Ohio in enacting a safe harbor provision that can grant compliant companies an affirmative defense to litigation stemming from a data breach. To obtain that legal defense, companies must adhere to a “reasonable security” program. Utah legislators defined a reasonable cybersecurity plan, in part, as measures that protect personal information, have protocols for responding to breaches and notifying impacted individuals, and reasonably conforms to “recognized cybersecurity frameworks,” such as National Institute for Standards and Technology (NIST) programs.
