Incentivizing Cybersecurity Compliance in the New Digital Age : Prevalence of Security Breaches Should Prompt Action by Congress and the Supreme Court

Incentivizing Cybersecurity Compliance in the New Digital Age : Prevalence of Security Breaches Should Prompt Action by Congress and the Supreme Court

Journal article

34 pages

0736-7694

This Note proposes a comprehensive scheme, whereby the legislature and judiciary collaborate to minimize security breaches. The scheme is intended to incentivize companies to sufficiently protect consumer data, while also considering that companies are often the victims of data breaches. It will first argue that, despite the aforementioned Clapper footnote, the Supreme Court should more definitively resolve the circuit court split by confining Clapper’s “certainly impending” standard to the national security context in which it arose. This would significantly increase the chance for plaintiffs to sue for an increased risk of future injury. Next, it will argue that Congress should adopt a federal statute requiring the implementation of cybersecurity policies and internal control as an integral part of companies’ compliance programs. The extent of the policies would vary according to the company’s net worth. Finally, it will argue that when plaintiffs sue for an increased risk of future harm alleging that a company negligently failed to implement reasonable security measures, the judiciary should evaluate the company’s compliance with the statute. If the court determines that the company has made a reasonable good faith effort to comply, the court should mitigate its damages accordingly.

Published in : Cardozo Arts & Entertainment Law, vol. 36, no. 1 (2018)

[New York City, New York] : Yeshiva University Benjamin N. Cardozo School of Law, 2018.

eng