With the emergence of opportunities for storing and sharing data online, additional tools for securing it had to be included into the existing policies, with respective repercussions for the organizations and entities that have failed to meet these regulations. Currently, legal standards for breach notification law reinforcement vary significantly across the U.S. In Louisville, Kentucky, the standards for breach notifications have been recently updated to include both an e-mail notification and a written notice that must be issued within 72 hours (“Kentucky,” n.d.). Although the recent updates to the regulation can be considered an improvement, the current length of notification period raises concerns about the opportunity to restore and secure people’s personal data effectively.
The current standards for data breach liability in Louisville, Kentucky are rather rigid. Specifically, the entire responsibility for the safety of customers’ personal information resides on the organizations holding it (“Kentucky,” n.d.). According to the state law, even if the security issues have been caused by the problems in the data provider’s framework, it is the data owner to be held responsible (“Data breach notification laws in Kentucky,” 2015). Therefore, the regulations encourage companies to approach the issue of information security responsibly.
The key internal impacts of the law in question are rather impressive. Specifically, the instances of data breach have been identified much faster since the adoption of the law in 2014 (“Data breach notification laws in Kentucky,” 2015). For instance, in one of the more recent instances of data breach, the vulnerability was fixed immediately, and the affected parties were contacted via letter as soon as the concern was resolved (Cimpanu, 2021). The described impact can be attributed to severe penalties for the law violation, which range from $100 to $50,000 or more (“Data breach notification laws in Kentucky,” 2015).
Correspondingly, the effectiveness of the regulations in question has been moderately positive. Although data breaches still occur due to extraneous factors such as staff members’ unpreparedness to new threats or the emergence of an innovative malware, the process of notifying customers has been occurring smoothly and seamlessly in Kentucky. Although the current length of the notification period, namely, 72 hours, could be reduced for greater efficiency, the overall standard for handling the issue can be considered perfectly functional.
References
Cimpanu, C. (2021). University of Kentucky discovers data breach during scheduled pen-test. TheRecord.Media.
Data breach notification laws in Kentucky. (2015). ProHIPAA.
Kentucky. (n.d.). Perkinscoie.