What Online Businesses Need to Know About Data Breaches and Liability

In the course of e-commerce, data breaches occur when sensitive, protected or confidential information is accessed or disclosed without proper authorization. This may include customer names, email addresses, passwords, credit card details, or even health data. Breaches can have varied causes, such as direct cyberattacks by hackers, inadvertent disclosure due to employee carelessness or vulnerabilities introduced through third-party vendors and service providers. The consequences of data breaches are often severe, leading not only to financial losses but also to legal and regulatory problems.

Online businesses are classified as data controllers or data processors under key regulatory frameworks, such as the General Data Protection Regulation (GDPR) in Europe or the California Consumer Privacy Act (CCPA) in the United States. This means they must safeguard personal data from unauthorized access, disclosure, or misuse. When breaches occur, data controllers/processors are obligated to notify affected individuals and relevant regulatory authorities within a specified timeframe (72 hours under GDPR, for example). Moreover, these companies must be able to demonstrate ongoing compliance with data protection standards, which involves keeping detailed records of their data handling practices.

The risks for failing to meet these obligations are substantial. Not only might a business face regulatory fines — which can reach up to 4 percent of global annual revenue under GDPR — but they may also be targeted by class-action lawsuits from affected customers. A business that suffers a breach also may face reputational damage and loss of consumer trust, from which it can be difficult to fully recover.

There are several data protection obligations that online businesses must be aware of: 

• Breach notification — In most jurisdictions, businesses are required to inform regulators and the individuals whose data was compromised, typically within a tight window after discovery.

• Data security — Companies must employ measures that are “reasonable” for their size and the nature of the data they handle. This could mean anything from basic security controls to advanced encryption and regular penetration testing. 

• Vendor management — Even if a data breach arises from a third-party provider, the originating business is often held liable unless it can show that it took reasonable steps to ensure its vendors complied with data protection obligations. 

• Consumer rights — Under laws like the CCPA, consumers are granted rights such as knowing what data is collected about them, requesting its deletion, and opting out of its sale. Any breach that infringes upon these rights can trigger additional regulatory enforcement.

Online businesses should adopt a comprehensive approach. This includes conducting regular security audits, encrypting sensitive information and training employees to recognize and avoid common threats like phishing. It is also advisable to create and regularly update an incident response plan for when a breach occur. It is equally important to routinely review and update privacy policies to align with evolving legal requirements. A skilled cybersecurity attorney can be invaluable in helping a business take proactive steps to minimize liability and establish effective response strategies. 

Andrew M. Jaffe, Attorney at Law can assist you in adopting cybersecurity and data privacy measures that are tailored to your organization and its operations. Please feel free to call me at 330-845-6027 or contact my office through email at [email protected] to arrange a free, no obligation consultation.