Privacy Attorney Lisa Sotto says the Epsilon e-mail breach is a warning about the state of data security employed by some third-party service providers. Strong contracts related to security practices must be the norm, not the exception.
“These types of events provide warning signals to companies that use service providers such as Epsilon,” says Sotto, a managing partner of Hunton & Williams New York office, where her practice focuses on privacy, data security and information management issues. “Companies should be sure that have data-security measures in place,” and that the third parties with which they work rely on the same high-level security measures as well. “Make sure you have strong contractual obligations in place, to ensure that the third-parties are securing data in the same way you require,” she says.
The Epsilon breach is an interesting one, since e-mail addresses alone are not considered sensitive, Sotto says. As such, databases that house consumer e-mail files are typically never encrypted, nor are they protected with additional layers of security, such as dual-layer authentication, for access. For a company like Epsilon, e-mail addresses need to be readily accessible, but this breach could prove that ready accessibility may not be the most prudent route.
