House Financial Services Committee introduces bill to provide uniform reporting standards in the event of data breachesOctober 17, 2018 | Megan Stumph-Turner
In the spirit of National Cybersecurity Awareness Month, BSCR reports that Rep. Luetkemeyer of Missouri introduced H.R. 6743, a measure aimed at amending the Gramm-Leach-Bliley Act to provide a national uniform standard for addressing cyber security data breaches. The bill has already made some traction, as it was ordered by vote to be reported to committee last month.
Some key amendments would be to revise the following two sections of the GLBA:
Standards with respect to breach notification
Each agency or authority required to establish standards described under subsection (b)(3) with respect to the provision of a breach notice shall establish the standards with respect to such notice that are contained in the interpretive guidance issued by the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of Thrift Supervision titled Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, published March 29, 2005 (70 Fed. Reg. 15736), and for a financial institution that is not a bank, such standards shall be applied to the institution as if the institution was a bank to the extent appropriate and practicable.
Relation to State laws
This subtitle preempts any law, rule, regulation, requirement, standard, or other provision having the force and effect of law of any State, or political subdivision of a State, with respect to securing personal information from unauthorized access or acquisition, including notification of unauthorized access or acquisition of data.
The full text of the proposed amendments can be found at this link.
It is this second provision that is troubling some state-level authorities. In a letter to Chairman Hensarling, John W. Ryan, the President and CEO of the Conference of State Bank Supervisors (CSBS) expressed concern on behalf of state regulators that the bill, if enacted into law, could hurt efforts to protect consumers more than help. Arguing that the GLBA and state privacy laws already provide sufficient guidance for cyber breach events, Mr. Ryan contends that H.R. 6743 would actually undermine state consumer protection laws, and that it would undermine the authority of state attorneys general and other authorities to enforce reporting requirements.
BSCR will continue to monitor the status of H.R. 6743, and our Financial Services Law Blog will keep the community posted as to pertinent events.
A cyber thief was able to trick AT&T into providing Michael Terpin’s account information, enabling that thief to make off with nearly $24 million in cryptocurrency belonging to Terpin, according to a complaint filed in the U.S. District Court for the District of California in Los Angeles.
In the lawsuit, among other things, Terpin alleges that AT&T was negligent in failing to protect its customers’ private data, and that it willfully disregarded unlawful transactions between AT&T employees and cyber thieves. Terpin claims that his digital currency was lost due to a “SIM swap fraud,” where the customer’s phone number is transferred to a SIM card operated by a hacker, who then resets the customer’s passwords and logs into their accounts in order to obtain confidential data and access to assets. Terpin believes that an AT&T employee cooperated in the swap that caused him to lose digital coins that would have been valued at $23.8 million in January of 2018, during a time where the value of the bitcoin was soaring, as previously reported by the BSCR financial services law blog. Because he has been publicly involved in cryptocurrency enterprises, Terpin was a prime target for cyber thieves.
AT&T has responded to the complaint publicly, stating, “We dispute these allegations and look forward to presenting our case in court.” Terpin, though, alleges that the telecommunications juggernaut has simply become “too big to care,” prioritizing expansion and acquisition over investing in hiring qualified professionals, providing ongoing training, or investing in systems that would better protect customer data.
While it remains to be seen what the outcome of this litigation will be, this lawsuit serves as a cautionary tale to any large institution that possesses sensitive online account data of its customers. These institutions would be well advised to look into their hiring and training procedures, as well as to consider implementing secure storage systems, in order to curtail future liability. BSCR will continue to monitor this litigation and will provide updates as milestones occur in the case.
An action filed in the United States District Court for the Western District of Missouri culminated after four years with a consent order that is catching attention due to its unusually small civil penalty, particularly in light of the severity of the conduct being penalized.
Richard Moseley Sr. and others, as well as a multitude of LLCs operating under his control (the “Defendants”), reached a consent judgment in the amount of $69,623,528, representing the amount of Defendants’ ill-gotten gains from their illegal payday lending scheme. But, in that same order, execution of the judgment was suspended upon certain conditions, including the following: (1) that Defendants agree not to participate in any further lending or financial services activities, (2) that they permit the CFPB to work with the Department of Justice to use funds from their bank accounts seized in a separate criminal action, and (3) that they each pay a civil penalty of just one dollar.
This anemic civil penalty was figured based upon affidavits and documents Defendants provided to the Bureau showing their lack of ability to pay the judgment amount, or apparently even a small fraction of it.
The consent order follows the recent criminal conviction of Moseley in the Southern District of New York for conspiracy, collection of unlawful debts, wire fraud, aggravated identity theft, and false disclosures under TILA. Among other things, Moseley and others charged illegally high interest rates, approaching 1,000 percent, on payday loans, took sensitive banking information of prospective customers who had not signed a contract for the loan and withdrew money from their accounts, and falsely reported that his businesses were based in other countries when they were actually operating in the Kansas City area.
About Financial Services Law Blog
The BSCR Financial Services Law Blog explores current events, litigation trends, regulations, and hot topics in the financial services industry. This blog will inform readers of issues affecting a wide range of financial services, including mortgage lending, auto finance, and credit card/retail transactions. Learn more about the editor, Megan Stumph, and our Financial Services practice.
The Financial Services Law Blog is made available by Baker Sterchi Cowden & Rice LLC for educational purposes only as well as to give you general information and a general understanding of the law, not to provide specific legal advice. Your use of this blog site alone creates no attorney client relationship between you and the firm.
Do not include confidential information in comments or other feedback or messages related to the Financial Services Law Blog, as these are neither confidential nor secure methods of communicating with attorneys. The Financial Services Law Blog should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.