Cybersecurity regulation of data buyers is not well understood. As a result, it is often overlooked, as are cyber risks, despite the attention that individual breaches receive in the press and the resulting litigation. This post is not a summary of the current state of cybersecurity law, which includes the recent SolarWinds decision on July 18th, 2024 in the Southern District of New York (in which the court dismissed many of the Securities and Exchange Commission’s claims against SolarWinds). Instead, Glacier reviews some of the ways in which cybersecurity risk is underestimated by the data community and several steps to address it.

Web scraping presents a perplexing set of risks that fluctuate with developments in software, law, and business norms. These risks shift as use of the web becomes more automated overall. The current trend in major markets does track the anticipated growth of web scraping as an almost conventional means of accessing data, checked by click-wrap legal terms and access controls such as CAPTCHA. But site operators and scrapers are deploying less well-known tools to fortify those walls and to profit from the data they protect.

Current Federal Trade Commission leadership has used US antitrust law to rein in big tech platforms. This overarching trend is now impacting domestic data collection in a significant way. The FTC has algorithmic pricing and automated decision making (including artificial intelligence) in its crosshairs – as affected sectors of the economy (such as housing) also overlap with the White House’s policy agenda. Private class action litigation against data businesses is on the rise as well. For some data vendors, data quality and even the existence of popular products are now at risk.

Many organizations evaluate data vendors based on information provided directly by those vendors - either in marketing materials, demos, or third-party marketplaces. As costs rise and business dependencies increase, however, that approach is not sufficient to create a durable data supply chain.

There is significant demand for data in 2024, fueled by the adoption of new technology, particularly artificial intelligence. At the same time, regulators and lawmakers in major markets including the United States, UK, EU, and China have stepped up privacy controls to limit the collection and sale of data. There is a clear conflict between the nascent data market and national interests in protecting citizens' data and geopolitically sensitive information.

Many data users are concerned that alternative data brings significant potential risk if it relates to a public company and might qualify as material, non-public information (or "MNPI") under US law. This risk is understandably difficult to assess; a complete analysis of these terms of art (and their application to a particular dataset) requires sophisticated legal counsel. We do, however, also see some common misunderstandings among buyers and sellers of data on this topic, which may serve as a starting point in understanding this complex risk.

Introducing The Flow Report, the source for data risk analysis and data market insights.

Glacier x The Alternative Data Podcast