Joe Lazzarotti of Jackson Lewis writes:
It usually happens after a reported data breach. The organization experiencing the breach sends notifications to affected individuals, as well as federal and or state agencies where appropriate and perhaps other parties. Not long thereafter, the organization receives an inquiry from one or more government agencies. These inquiries typically seek more information about the breach and its incident response process, but also the nature and extent of the organization’s data security policies and procedures in place prior to the breach. Deficiencies in any of these areas could support getting “whacked”!
On December 16, Pennsylvania’s Attorney General and soon to be Governor, Josh Shapiro, announced a settlement with a company that experienced a data incident in April 2021 that exposed 30,295 Pennsylvania consumers’ payment card information. Following an investigation jointly conducted by Mr. Shapiro’s office and its counterpart in New York, it was determined that the company “failed to properly employ reasonable data security measures in protecting consumers’ payment card information.”
Read more at Workplace Privacy, Data Management & Security Report.