Shawn Tuma's presentation with Christopher Mitchell (of Crowe Horwath) at The Institute of Internal Auditors 9th Annual Fraud Summit. The title of the presentation is The Legal Side of Data Breach and Third Party Risk. The main point of the presentation is that when a company is breached through the fault of one of its third-party business associates, or other third-parties, the company is still responsible for all of the repercussions arising out of the breach and, at best, will then have to go and pursue its rights against the third party. Thus, companies need to ensure that their business associates and other third parties adhere to proper data security practices and they should be audited to ensure compliance.

1. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 1
The Legal Side of Data Breach and Third Party Risk
Shawn Tuma, Partner
BrittonTuma
469.635.1335
stuma@brittontuma.com
@shawnetuma
blog: shawnetuma.com
web: brittontuma.com
Shawn Tuma is a lawyer whose practice is focused on cutting-edge
cyber and information law and includes issues like helping businesses
defend their data and intellectual property against computer fraud, data
breaches, hacking, corporate espionage, and insider theft. Shawn stays
very active in the cyber and information law communities:
 Chair, Collin County Bar Association Civil Litigation & Appellate Law
Section
 College of the State Bar of Texas
 Privacy and Data Security Committee of the State Bar of Texas
 Computer and Technology, Litigation, Intellectual Property Law, and
Business Sections of the State Bar of Texas
 Information Security Committee of the Section on Science & Technology
Committee of the American Bar Association
 Social Media Committee of the American Bar Association
 North Texas Crime Commission, Cybercrime Committee
 International Association of Privacy Professionals
The information provided is for educational purposes only, does not constitute legal
advice, and no attorney-client relationship is created by this presentation.

2. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 2
“Authority” Governing Data Breach
• Laws
• Types
• Common Law (courts)
• Statutory Law (legislatures)
• Sources
• International
• Federal
• State
• Local
• Agency Rules & Regulations
• Industry Standards

3. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 3
What do these sources of “Authority”
have in common?
• Tell you what must be done following
a breach.
• Can you guess who “you” is?
• “You” is the entity breached.

4. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 4
What do you have to do following a data breach?
• Execute Breach Response Plan
• General Steps
• contact attorney (privilege)
• assemble your Response Team
• contact forensics
• contact notification vendor
• investigate breach
• remediate responsible vulnerabilities
• reporting & notification

5. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 5
What does “reporting & notification” mean?
• Law Enforcement
• State Attorneys General
• Federal Agencies
• FTC, SEC, HHS, etc.
• Industry Groups
• PCI, FINRA, FDIC
• Credit Bureaus
• Professional Vendors & Suppliers
• Consumers

6. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 6
Cost of a Data Breach!
• In 2012
• $188.00 per lost record
• $188.00 x “X” - $$$$$$$$

7. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 7
Story Time
• you were CEO of a world-wide company
• breach impacting 110 million customers
• $61 million in expenses alone
• 10% discount to all shoppers
• $5 million investment in cybersecurity coalition
• offer “free” identity theft and credit monitoring to all affected
customers
• Net earnings down 34.28%
• Earnings per share down 44.60%
• Non-cash losses down 487.71%
• US sales down 6.60%
• Lawsuits, possible enforcement actions, who knows?
• and then you learn …

8. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 8
Have you ever heard of …

9. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 9
Have you ever heard of …

10. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 10
Important Questions
• Whose 110,000,000+ customers were furious?
• Who spent $61 million in expenses?
• Who gave a 10% discount to all shoppers?
• Who gave $5 million to a cybersecurity coalition?
• Who offered “free” identity theft and credit
monitoring to all affected customers?
• Whose net earnings are down 34.28%?
• Whose earnings per share are down 44.60%?
• Whose non-cash losses down 487.71%?
• Whose US sales are down 6.60%?
• Who is defending lawsuits, enforcement actions?
• One more question …

11. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 11
Who can tell me the takeaway?
hint:
• it is related to the topic of this
presentation
• YOU ARE STILL LIABLE
FOR BREACHES CAUSED
BY 3RD PARTIES!!!

12. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 12
Allocating risk and mitigating risk by contract
• Allocating risk
• designate duties & responsibilities
A party bears the risk when the agreement allocates the risk to that party. TEX. JUR.
3d Contracts § 123
• indemnify
“An undertaking against loss or damage amounts to a guaranty of reimbursement
on a payment by the indemnitee. With respect to a promise to indemnify against
damages, a right to bring suit does not accrue until the indemnitee has suffered
damage or injury by being compelled to pay the judgment or debt.” 14 TEX. JUR. 3d
Contribution § 24
• Mitigating risk
• require mandatory policies, procedures, and security
standards for third parties

13. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 13
But all are just contractual obligations
• Look to you for relief, you must then go enforce
your contractual remedies
• Breach of Contract
• Inability to perform
• Unwillingness to perform
• Efficient breach theory
• Insolvency / bankruptcy
• Cost of litigation to enforce

14. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 14
The contractual obligations are important and needed
• Show diligence and taking data security
more serious than most
• FTC – looking at 3rd party contracts
• SEC – looking at policies and 3rd party contracts
• Post-breach = helpful for attorneys general
• But more is required

15. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 15
Recent agency advisory statements
• January 2014: SEC indicates that the new standard of care for
companies may require policies in place for:
1. Prevention, detection, and response to cyber attacks and data breaches,
2. IT training focused on security, and
3. Vendor access to company systems and vendor due diligence.
• January 31, 2014: GMR Transcription Svcs – FTC case – is
requiring businesses to follow 3 steps when contracting with 3rd
party service providers:
1. Investigate by exercising due diligence before hiring data service providers.
2. Obligate their data service providers to adhere to the appropriate level of
data security protections through contractual agreements with provider.
3. Verify that the data service providers are adequately protecting data as
required by the contractual standards.

16. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 16
Ronald Reagan, in dealing with Soviets, said…
“Trust, but verify.”
How do you verify?
Audit!

17. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 17
Key Takeaways
• You are still liable for breaches caused by 3rd
parties!
• Contractual agreements are not a magic
wand to make liability go away – you are still
responsible but now have a remedy against
the 3rd party
• “Trust, but verify” = Audit!
• Cyber Insurance

18. Digital Business Risk
www.brittontuma.com © 2014 Shawn E. Tuma 18
Sun Tzu – The Art of War
“In all fighting the direct method may be used for joining battle, but
indirect methods will be needed to secure victory.”
“You can be sure of succeeding in your attacks if you attack places which
are not defended.”
“The spot where we intend to fight must not be made known; for then
the enemy will have to prepare against a possible attack at several
different points; and his forces being thus distributed in many
directions, the numbers we shall have to face at any given point will be
proportionately few.”