How to Interpret the SEC’s Latest Guidance on Data Breach Disclosure

On the heels of several headline-grabbing data breaches – and greater emphasis on the importance of disclosure in the lead-up to the May 25 General Data Protection Regulation (GDPR) deadline – the US Securities and Exchange Commission (SEC) recently issued a statement that puts more responsibility on executives for data breaches.

This updated guidance calls for public companies to provide investors with more information on all cybersecurity incidents – even just the existence of potential risks – with minimal delay. The statement goes a step farther in attempting to thwart the potential for the exchange of "insider" information, which was a major concern on the heels of the record-shattering Equifax data breach.

Specifically, corporate officers, directors and “other corporate insiders” are prohibited from trading shares if they have knowledge of any unpublicized security incident within the company.

While the overall intent of this latest statement is clear, the guidance is vague in key areas by design. For instance, the second section of the guidance emphasizes that companies must make "timely disclosure of any related material nonpublic information." It’s unclear what the SEC explicitly means by "timely disclosure," as the SEC doesn’t provide a specific time limit that companies must meet. This puts a lot of trust in corporate leaders to put speedy remediation and due diligence at the center of their security policy, which is a bit of a gamble given the track record of executive action during the fallout of the Equifax breach.

The GDPR, on the other hand, is much more prescriptive, giving organizations 72 hours to report an incident related to the personal data of EU citizenry. This isn’t to say that the European Commission has greater distrust for business leaders to make the right call than legislators in the United States, so much as it creates a clear and distinct timetable.

The guidance from the SEC is significant, however, in that it essentially tees up every executive board to make room for or delegate an in-house expert on cybersecurity best practices. It updates a comparably less hawkish stance on the part of the SEC in trying to minimize the occurrence of insiders acting poorly in the time between a major data breach and public disclosure.

Another reason for the vagueness surrounding the actual time limits for disclosure is that the SEC doesn’t want to force businesses to prematurely disclose information that might only publicize vulnerabilities to potential hackers. It’s a delicate balance, as teams want to make sure they are planning their defense thoughtfully before inciting more damage to the company’s data stores – not to mention brand perception.

As part of the GDPR guidance, many data-centric businesses will be required by law to employ a Data Protection Officer (DPO) that acts alongside the network administrators and security teams to enforce best practices and report potential incidents. While this isn’t mandatory for all businesses, companies that aren’t looking to employ cybersecurity experts are doing so at their own risk – especially given this new guidance from the SEC. The cost for not following through on best practices in the event of a breach can be far more significant than putting an in-house expert on the payroll.

While many may view the new SEC guidance and GDPR as onerous red tape, forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place. After all, having someone who is tasked with ensuring your organization is secure and protecting its data appropriately is something every organization should embrace.