Data Security Case Study

The bank record theft was exposed April 28, 2005 when police in Hackensack, New Jersey charged nine people, including seven bank workers, in an alleged plot to steal financial records of thousands of bank customers. Bank of America and Wachovia Bank were the two biggest banks that were affected by this large banking breach in 2005. 670,000 customer account information was stolen by bank employees. In addition to confidential banking information, the thieves also obtained employment information for these same accounts. Customer account numbers and balances were allegedly sold to a middleman, then the information was sold to collection agencies. On a smaller scale, other banks were also affected by the theft such as, Commerce Bancorp and PNC Financial Services Group. Bank of America is constantly, having to communicate with their customers to reassure them that those that customer their accounts are not experiencing fraud or identity theft. Both Bank of America and Wachovia customers whose account information was stolen during this breach were to receive complimentary one-year credit monitoring service along with having each account directly monitored by the

1. The SEC is often called the “watchdog” of corporate America. How does it assist in preventing fraud?

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

Companies have an obligation to protect their customer’s information, which goes beyond that of complying with state and federal regulations. If the company loses the trust of their customers, they risk the chance of damaging

The Federal Trade Commission (FTC) was created in 1914 primarily as a way for the government to “trust bust” or apply regulations ensuring a free marketplace for U.S. consumers and business enterprises. In this regard, the FTC enforces antitrust viola- tions that could hamper consumer interests, as well as federal consumer protection laws against fraud, deception, and unfair business practices. The commission’s primary enforcement mechanism is the Bureau of Consumer Protection, which is divided into seven divisions: (1) enforcement, (2) advertising practices, (3) financial practices, (4) marketing practices, (5) planning and information, (6) consumer and business educa- tion programs, and (7) privacy and identity protection.21 As the federal

FTC first became involved with consumer privacy issues in 1995, when it promoted industry self-regulation. After determining that self-regulation was not effective, FTC began taking legal action under Section 5 of the FTC Act. Section 5 limits practices considered to be unfair to instances where, among other things, 1) the practice causes or is likely to cause substantial injury to consumers; (2) the substantial injury is not reasonably avoidable by consumers; and (3) the substantial injury is not outweighed by countervailing benefits to consumers or to competition. Since 2002, the FTC has brought over 50 cases against companies that have engaged in unfair or deceptive practices that put consumers’ personal data at unreasonable risk. Most of these cases resulted in settlements and did not provide judicial decisions addressing the FTC’s authority to regulate the data security practices of companies which have suffered a data breach.

Oligopolies have been around ever since there is trade. However, it has only recently gained grounds in this age of globalisation. Never before has oligopolistic competition been so fiercely contested across so many industries.

However with a recent act passed by the government maybe it doesn’t go far enough in preventing businesses and its practices from protecting consumers. But with implementation, it’s the ensurance of what businesses ultimately do o in the best interests of the American people.

6. In an era of global competition, what is the case for antitrust authorities to permit the formation of large domestic firms through mergers and acquisitions?

Scholars are divided on the fundamental question of the Federal Trade Commission’s (FTC) adjudicative capacity under the FTC Act. The FTC uses a reasonableness standard and considers each company’s data security practices on a case-by-case basis. For more than a decade, the FTC’s enforcement of data security actions invoked under §5 of the Federal Trade Commission Act (FTC Act) resulted in consent decrees and settlements, subsequently scrutinized by practitioners as carrying as much precedential value as judicial opinions.

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

All the consumers affected were also made vulnerable to subsequent identity theft given malicious attackers stole their personal data. Equifax was directly affected since its stock began to plunge immediately the news was made public. Additionally, the corporate governance of the company was tarnished given three Equifax executives sold shares worth around $2 million days after the breach discovery, and the “retiring” of the chief security information officers is questionable (Surane & Melin, 2017). Also, the company was exposed to litigations with some lobbyists and interest groups pushing regulators to hold Equifax accountable for the negligence and poor treatment of affected consumers. The proposed new data security laws will present a greater burden to other corporations. Two such laws are the Promoting Responsible Oversight of Transactions and Examinations of Credit Technology (PROTECT), and Freedom From Equifax Exploitation (FREE) will attract more government scrutiny and limit the type of personal data that companies can collect from customers (Alperan, Carter, & Sofio, 2017).

Data breaches happen daily, in too many places at once to keep count. But there is some huge breach versus a small one and we will take some examples from the biggest or most significant breaches of the 21st century to show how much risk or damage the breach caused for companies, insurers and users or account holders.

Individuals and corporations that are the victims of an organizations data theft may elect to sue the business for damages. As well as the legal costs involved, if the court rules in favor of the prosecution, then the business will be liable for the damages incurred. This has the potential to put the company out of business. Organizations will need to meet the compliance requirements of one or more Acts, depending upon their vertical industry. The requirement, which is broad-based, is to ensure customer privacy. This is essential to prevent personal details such as social security information, addresses, credit card information, and more, being divulged through data

The General Electric (GE) and Honeywell International (HI) case illustrates the complexities of structuring mergers and acquisitions when the combined firms are capable of exerting market influence that threatens the competitive landscape. While General Electric's CEO, Jack Welch, characterized the deal as, "This is the cleanest deal you'll ever see," European anti-trust regulators were not so inclined to view the transaction as harmless to competition (Elliot, 2001).