N.J. close to passing tougher regulation on data breaches

Enlarge Photo

Getty Images/iStockphoto

New Jersey is one step closer to expanding the types of data breaches that local businesses are required to disclose.

Lauren Hertzler

Staff Writer- Philadelphia Business Journal

Email  |  Twitter

New Jersey is one step closer to expanding the types of data breaches that local businesses are required to disclose.

Just last week, a state Assembly panel cleared a bill that says businesses and public entities must notify consumers of breaches involving usernames and email addresses, in combination with a password or security question-and-answer. The current law, similar to Pennsylvania's, says disclosure is only necessary if there's a breach involving consumers' first name or initial and last name, along with Social Security numbers or credit card numbers, in combination with any required security code, access code or password.

Lawyer Scott Vernick, head of Fox Rothschild's privacy and data-security practice in Philadelphia, said the proposed legislation is simply catching up to best practices in the industry.

"For the most part, all enterprises have already been doing this," Vernick said.

He added that the bill is attempting to address the current breach situation, where cyber criminals are looking for not just bank account information, but passwords, "because people have a tendency to use the same password for a number of accounts." Also, cyber criminals use email addresses for phishing scams.

For residents of New Jersey, Vernick said it's a good thing. But for businesses, "it may not be as welcomed…because this obviously extends the scope of what they need to do." Plus, it can be pricey.

"It just increases the cost of doing business," he added.

Either way, Vernick said, we should all get used to it.

"I think for the foreseeable future…the regulatory environment will be particularly intense," he said.

Lauren Hertzler covers technology, education and venture capital.