Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

Five Things That Owners and Boards Need to Know About Privacy and Cybersecurity Compliance

Client Alert
August 21, 2020

Do you serve on a Board of Directors or serve in a similar advisory capacity for a company or organization? Do you own your own business? Here are five things you should know about privacy and cybersecurity compliance.

  1. Upholding Your Fiduciary Duties

As a fiduciary of an organization, you may already know that you have a duty of loyalty and duty of care, including the duty to keep investors and owners informed of the cybersecurity risks of the organization. You also have the duty to protect the organization from undue risk, balancing the organization’s ability to conduct its operations with appropriate levels of risk mitigation strategies.

  1. Basic Knowledge of Privacy and Cybersecurity Issues

To properly fulfill your fiduciary duties, you need to obtain and maintain a basic knowledge of cybersecurity and privacy issues and risks facing the organization. Lack of understanding is not an excuse, and it is expected that Boards familiarize themselves with the cybersecurity efforts in the organization, champion and drive the organization’s commitment to ensure adequate cybersecurity protections are established and maintained. Board members and owners are also strongly encouraged to engage in the organization’s training and awareness campaigns and gain additional awareness as it relates to advising organizations effectively.

  1. Maintain the Company’s Reputation and Public Perception

Privacy and cybersecurity compliance builds the foundation of trust and reinforces an organization’s reputation for honoring the privacy expectations of both customers and business partners. A company’s character and brand are driven by industry expectations, treatment of customer data, legal requirements and product development. Mishandling a security breach can have devastating effects on the organization’s reputation, financial, operational and other aspects of the business. Many companies do not recover from a data breach due to the lack of proper advance planning and proper oversight.

  1. Watchdogs

In the United States alone, there are several different government authorities that maintain varying levels and scopes of authority over organizations with respect to privacy and cybersecurity issues, including the Securities and Exchange Commission, Federal Trade Commission, Department of Justice, Federal Sentencing Commission, and State Attorneys General, to name a few. There are also non-governmental watchdogs, from privacy advocacy groups who lobby for stricter laws and regulations and plaintiffs’ attorneys who bring actions against organizations that fail to comply with laws and regulations as well as organizations’ own stated privacy practices.

  1. Board Personal Liability

Breaches of fiduciary duties can be a slippery slope: subjecting board members to personal liability if the failure to exercise a minimum level of care, such as ignoring cybersecurity risks of the organizations, delegating responsibility without oversight, and lack of proper skill or training to properly advise the organization in these matters. Penalties can range from debarment from eligibility to bid on future federal contracts, large fines and jail time for individuals.

What Owners and Board Members can Do Today:

  • Call your insurance provider:
    • Do you have a cyber insurance policy?
    • Understand what is covered and make sure that the coverage is appropriate for your business risks.
  • Meet with your technology experts to talk about current protections and risks that they are aware of. Understand where there may be gaps in current protections from a technology perspective and what recommendations the technology experts have to fill those gaps.
  • Consult with legal counsel to identify the laws and regulations that apply to your business related to privacy and cybersecurity compliance.
  • Assemble a cross-functional team of internal and external subject matter experts and professionals who handle critical data of the company to form a privacy steering committee. The Committee’s core responsible should be implementing and maintaining a compliance program that addresses the company’s privacy and cybersecurity risks.

Need conversation starters about privacy and cybersecurity for your board or organization? Contact Partner Allison Cole at aecole@bmdllc.com to discuss ways to address this important topic for your business.

CybersecurityPrivacy RuleComplianceCompliance ProgramCompliance Plancompliance plan guidanceownersboardsAllison Cole
Client Alert

DOT Non-Domiciled CDL Rule

March 11, 2026A new rule from the Federal Motor Carrier Safety Administration (FMCSA) will significantly narrow eligibility for non-domiciled Commercial Driver’s Licenses (CDLs) beginning March 16, 2026. The rule limits eligibility to holders of H-2A, H-2B, and E-2 visas and eliminates Employment Authorization Documents (EADs) as qualifying proof of work authorization. As a result, many lawfully present and work-authorized immigrants, including refugees, asylees, DACA recipients, and Temporary Protected Status holders, will no longer be able to obtain or renew a non-domiciled CDL. The change is expected to affect roughly 194,000 drivers nationwide and has prompted multiple legal challenges, including a pending emergency stay request before the United States Court of Appeals for the District of Columbia Circuit.Client Alert

FinCEN Residential Real Estate Reporting Rule Now in Effect

March 6, 2026FinCEN’s new Residential Real Estate Reporting Rule, effective March 1, 2026, requires certain real estate transfers to be reported to combat financial crimes. Transfers of residential property to entities or trusts without financing may require a Real Estate Report.Client Alert

Department of Education Proposes Redefinition of “Professional Degree,” Excluding Nursing and Limiting Graduate Loan Borrowing

February 20, 2026The U.S. Department of Education has issued a Notice of Proposed Rulemaking that would redefine “professional degree” programs under the One Big Beautiful Bill Act. The proposal excludes nursing from the recognized list and would impose new borrowing limits for graduate students while eliminating the Grad PLUS program. Public comments are due by March 2, 2026.Client Alert

First-of-Its-Kind Federal Ruling Finds Use of Consumer AI Tool May Destroy Attorney-Client Privilege

February 17, 2026On February 10, 2026, Judge Jed Rakoff of the U.S. District Court for the Southern District of New York issued a first-of-its-kind ruling finding that documents generated by a criminal defendant using a consumer AI platform were not protected by attorney-client privilege after being shared with counsel. The court treated the AI tool as a third party, concluding that entering sensitive information into a publicly available platform may waive confidentiality. The ruling also suggests that the work product doctrine may not apply where AI-generated materials are created independently by a client rather than at counsel’s direction. The decision signals that parties should exercise caution when using consumer AI tools in connection with legal matters.Client Alert

Your Golden Chance for H-1B Lottery Registration - March 2026

February 16, 2026USCIS H-1B registration opens March 4–19, 2026. U.S.-based employees on valid nonimmigrant status are exempt from the $100,000 fee for change of status petitions. The new weighted lottery favors higher-skilled and higher-paid employees, improving odds for advanced degree holders and Wage Level 3 or 4 workers.
Older posts