A recently passed bill in Ohio grants covered entities an affirmative defense against tort claims in data breach suits filed in the state or brought under Ohio law. Experts said the law probably won’t stop plaintiffs attorneys from filing a claim in another forum, though they noted the law may encourage more companies to ensure they have data breach protection in place.
The law provides a “safe harbor” for covered entities against tort claims that allege “failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.” Covered entities, however, need to prove they created, maintained and complied with a cybersecurity program that conforms to an industry-recognized cybersecurity framework.
