On January 10, 2023, a noteworthy precedent was set in the field of corporate cybersecurity responsibility as a corporate executive was held personally accountable for cybersecurity shortcomings within their firm. This case shows a significant shift in the way institutions are approaching accountability, with the US Federal Trade Commission (FTC) leading the charge.
The case in question involves online alcohol marketplace, Drizly, and its CEO, James Cory Rellas. Rellas and Drizly were found to be at fault for neglecting to establish sufficient security defenses. This lapse in security measures came to light following a data breach in 2020 that led to exposure of 2.5 million users’ personal informationBond, Schoeneck & King, PLLC.
As a part of the ruling, the FTC ordered Drizly to implement comprehensive data security measures. These measures include the minimization, deletion, and retention of personal information. This ruling illustrates FTC’s commitment to protecting consumers’ sensitive information and reinforces the urgency for companies to act responsibly when handling such data.
One point deserving proper emphasis is the fact that FTC’s order extends to any future employment of Rellas for the next decade. This signifies that the responsibility for the mishap wasn’t only attributed to the company, but it was the individual at its helm who was held personally accountable for the negligence.
With this, it is clear that in the corporate world, the stakes have been raised in terms of data protection. The verdict will undoubtedly send a ripple effect, prompting companies to reevaluate their data security strategies. For executives, the attention is now more than ever on their role in ensuring the security and safety of their companies’ customer information.
Whilst this is seen as something of a milestone, it’s just the tip of the iceberg when it comes to regulatory bodies globally striving to enhance the security of online platforms; companies are thus advised to prioritize strong cybersecurity measures to protect their customers and avoid any potential legal consequences due to lack of due diligence.