Summary

In this episode of Chattinn Cyber, Marc Schein welcomes back Ken Rashbaum, a partner at Barton LLP and a professor at Fordham Law School. Ken, a well-respected privacy attorney, shares his journey from being a trial lawyer and prosecutor to becoming a leading figure in data protection and cybersecurity. He discusses how his early work in healthcare law, particularly with the introduction of HIPAA, paved the way for his focus on privacy and cybersecurity on a global scale.

Their chat shifts to the current landscape of data protection regulations in the U.S. Ken explains the fragmented nature of these laws, which primarily exist at the state level, with only limited federal regulations in healthcare and children’s information. He expresses skepticism about significant changes in federal regulation following the recent presidential election, highlighting the philosophical divide between the two major political parties regarding privacy legislation. Ken emphasizes that voters are increasingly concerned about the privacy and security of their personal information, which complicates the regulatory landscape.

Marc and Ken then delve into the importance of cybersecurity provisions in contracts, particularly for midsize businesses. Ken argues that simply stating compliance with applicable laws is insufficient due to the evolving nature of cybersecurity regulations. He advocates for more detailed cybersecurity requirements in contracts to provide clarity and certainty for all parties involved. Ken also addresses the challenges small and mid-sized businesses face when negotiating contracts with larger corporations, suggesting that they assess risks and consider mitigation strategies, such as implementing multi-factor authentication.

The discussion also touches on the implications of the General Data Protection Regulation (GDPR) for businesses that may not operate in Europe but have customers there. Ken advises that companies should be aware of their obligations under GDPR if they market to EU residents, as the global nature of the internet makes it difficult to avoid these regulations. He stresses the importance of transparency and understanding the data protection implications of using artificial intelligence in business agreements, given the rapid development of AI technology.

Finally, Ken highlights the need for continuous learning in the field of cybersecurity and data protection, urging professionals to stay updated on current changes and adapt to the evolving needs of businesses. He concludes by encouraging open communication and collaboration between legal advisors and businesses to ensure that contracts are tailored to meet the specific needs and risks of each party. The episode wraps up with Ken sharing his contact information and resources for listeners seeking further guidance on these critical issues.

Key Points

Fragmented Data Protection Regulations: Ken explains the current state of data protection laws in the U.S., highlighting the lack of comprehensive federal regulations outside of healthcare and children’s information. He notes that most regulations exist at the state level, leading to a complex and inconsistent legal landscape.
Importance of Detailed Cybersecurity Provisions in Contracts: The conversation emphasizes that simply stating compliance with applicable laws in contracts is insufficient. Ken advocates for including specific cybersecurity requirements to provide clarity and certainty for all parties involved, especially given the evolving nature of cybersecurity regulations.
Challenges for Midsize Businesses: Ken discusses the difficulties that small and midsize businesses face when negotiating contracts with larger corporations. He suggests that these businesses assess their risks and consider mitigation strategies, such as implementing cybersecurity measures like multi-factor authentication.
Implications of GDPR: The podcast addresses the relevance of the General Data Protection Regulation (GDPR) for businesses that may not operate in Europe but have customers there. Ken advises that companies should be aware of their obligations under GDPR if they market to EU residents, as the global nature of the internet makes compliance necessary.
Continuous Learning and Adaptation: Ken stresses the importance of continuous learning in the field of cybersecurity and data protection. He encourages professionals to stay updated on current changes and to maintain open communication with businesses to tailor contracts to their specific needs and risks.

Key Quotes

On the State of Data Protection Laws: “We only have national data protection law in the U.S. in healthcare, for public companies, and children’s information. Everything else is at the state level, and the states very much want to keep that prerogative.”
On Cybersecurity Provisions in Contracts: “When you say parties are going to meet applicable law, a good response to that question is, what does that even mean? The law is all over the place… it differs from state to state, from country to country, from industry to industry.”
On GDPR Compliance: “Generally speaking, they are subject to the GDPR if they are marketing to customers who are residents of the European Union… any time you throw up a website, you are basically marketing globally.”
On Continuous Learning in Cybersecurity: “Working in this space requires a dedication to continuous learning… too many advisors think that they are, you know, like Moses with tablets coming down from Mount Sinai. You really have to keep up with current changes.”

About Our Guest

Kenneth N. Rashbaum is a distinguished legal expert specializing in privacy, cybersecurity, and e-discovery, advising multinational corporations, financial services, and life sciences organizations on the complexities of electronic information management. With extensive experience in information governance, he ensures compliance with federal, state, and international laws while navigating the legal and regulatory challenges of e-commerce. Ken is adept at preparing and negotiating technology contracts, including service level and license agreements, and provides guidance on privacy and cyber liability insurance applications. He leads assessments and remediation initiatives for data breaches, develops social media compliance policies, and represents clients in federal and state investigations. An internationally recognized thought leader in electronic discovery, Ken has served as national e-discovery counsel for major pharmaceutical companies and has contributed to legislative efforts in New Jersey regarding privacy and cybersecurity laws. He is also an Adjunct Professor of Law at Fordham University School of Law and has previously taught at Hofstra University. Prior to joining Barton, Ken was a senior litigation partner at Sedgwick LLP, where he co-chaired the E-Discovery, Compliance, and Data Management Practice Groups.

Follow Our Guest

LinkedIn | Website

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Navigating Cybersecurity Contracts: Insights from Ken Rashbaum