Tech Focus: Cyberrisk — the legal landscape

Directors’ Duties: The Companies Act 2014 provides for indemnification from a director or officer to the company for loss arising from a breach of his/her fiduciary duty. This indemnification obligation may come into play if, for example, it is established that a cyberattack or its consequences are attributable to breach of a director’s duty.

Contracts: Contracts play an important role in regulating cyberrisks and in some cases it is mandatory to have a contract in place. For example, the DPA requires a contract to be put in place when a data controller appoints a data processor. Contractual security will typically (i) allocate responsibility between the parties for compliance with applicable law obligations in relation to security and data protection including risk in the form of caps on liability and indemnities; (ii) include provision for auditing compliance with those obligations and (iii) require notification and cooperation in the event of a cyberincident.

Criminal Law: There is a patchwork of criminal legislation relevant to cyber incidents. For example, it is an offence under the DPA to access or obtain and disclosure to another person personal data without the prior authority of the data controller or data processor. The Criminal Damage Act creates two basic computer crime offences: that of causing criminal damage to a computer; and that of unauthorised access. The unlawful operation of a computer with the intent of making gain is a criminal offence under the Criminal Justice (Theft and Fraud) Offences Act 2001.

 

advertisement

 

It may also be an offence to fail to report information in relation to certain cybercrimes to An Garda Siochana. The application of criminal law is not limited to those who perpetrate attacks — officers of a corporate body that has committed an offence under the DPA may also be guilty of that offence, if it is proved to have been committed with their awareness or as a result of their neglect.

There are two pieces of draft European legislation that are expected to have a significant impact on the area of cyberrisk across Europe and here in Ireland — the Draft Network and Information Security Directive and the Criminal Justice (Offences Relating to Information Systems) Bill.

While the precise wording of both is being finalised, it is clear there will be significant changes from the current EU regime, which will affect cyber security law including mandatory breach notification to data protection authorities and affected individuals and fines of up to 2.0% of worldwide turnover or €1 million. There will, however, be a two year lead in period after the text of both are finalised.

We understand that publication of the Criminal Justice (Offences Relating to Information Systems) Bill, which is intended to transpose the EU Cyber Crime Directive and enable ratification of the Council of Europe Convention on Cybercrime, is expected shortly.

With both developments pending, here in Ireland we can expect significant changes to legislation governing cyberrisk. But what should Irish business be doing today to reduce cyberrisk?

Legal preparedness – Best practice tips

1. From a technical perspective businesses are legally required to have “adequate security measures” in place. The applicable industry technical standards should be considered. Senior management need to be familiar with the steps that have been taken.
2. Appropriate levels of training should be provided to employees.
3. Businesses should at all times know where their business and confidential information (including all personal data) is held, and held by whom. If sensitive information is held this should be categorised separately. In the event of an attack it is imperative to be able to know immediately what information has been compromised.
4. Employees should find it easy to obtain guidance, in the form of a written cyber policy, on how to keep data safe and giving instructions on what to do in the event of a cyberattack.
5. Businesses need to ensure that policies for mobile devices (including bring-your-own-device) enhance, and not hinder, the safety of company data.
6. Ensure that general governance arrangements have explicit data security elements – eg reporting by IT department to an audit and risk committee. Cybersecurity should be a fixed agenda item and have a Board sponsor.
7. Consider contracts with suppliers who handle your data (such as couriers, records management companies, cloud providers), and ensure that they are aware of your security requirements. Regular audit or reporting should occur. Retain the right to step in and to manage communications and notifications in the event of an attack.
8. Clarify the responsibilities for running the investigation within the business. Everyone should know what to do in the event of a cyberattack.
9. It is important to keep a written record of the above and any other steps that you have taken to prepare the business for a cyberattack. This will be, amongst other things important for any subsequent regulatory investigations.

Claire Morrissey is a partner with the cyberrisk and data privacy team with A&L Goodbody