Data security: What the law requires of IT - Via InfoWorld | Analysis | 2008-08-18 | By Thomas J. Smedinghoff :

IT's legal duty to secure sensitive data is complex and continuously evolving. Here's how to avoid the legal ramifications of a data breach 

        
For most IT organizations, securing corporate data against compromise is priority No. 1. Girding the enterprise against breaches is a constant, thankless task requiring foresight, vigilance, and much in the way of IT expenditures. Keep up with the latest threats, or find your company in the headlines -- and your job on the line.

Such is the shift in attitude toward security in IT. In the Wild West, when Jesse James and Butch Cassidy robbed banks, we felt sorry for the banks and hunted down the outlaws. Today, when someone breaks into a company's computer system, our response is totally different: We blame the company for failing to provide adequate security.

Codifying this shift is a complex blend of laws and regulations enacted to protect the confidentiality and integrity of valuable personal data and the individuals who might be harmed by a breach. Not complying with these mandates can result in grave legal consequences should your organization suffer a breach.

Here you will find a framework for understanding these legal initiatives, which, when viewed as a group, impose two key legal obligations on your organization: the duty to implement reasonable security measures to protect data, and the duty to disclose breaches to those affected.

The duty to provide security
There is no single statute or regulation that governs all of your company's information security obligations. Instead, an ever-expanding patchwork of legal requirements is continuously evolving to impose a comprehensive duty to provide "reasonable" or "appropriate" security to protect your corporate data.

At the center of this patchwork are numerous state and federal regulations: privacy laws that require companies to protect personal data; e-transaction laws that govern the accessibility and integrity of electronic records; corporate governance legislation that requires appropriate controls to protect public companies and their shareholders, investors, and business partners; and unfair-business-practice laws now interpreted to include failure to provide adequate security as an unfair business practice.

(Read Original Article - Via InfoWorld | Analysis | 2008-08-18 | By Thomas J. Smedinghoff.)