Nevada passes first law requiring business to encrypt customer personal information during transmission

October 10, 2007

Significance of the Law

Nevada has enacted the first data security law that mandates encryption for the transmission of customer personal information. ( NRS 597.970) The law goes into effect on October 1, 2008. While there are several laws that direct organizations in certain industries to consider using encryption and laws that make encryption a factor in decisions regarding breach notifications, no law required the encryption of personal information prior to this Nevada law.

Summary of the Law

The law is brief and provides that:

“A business in this State shall not transfer any personal information[1] of a customer through an electronic transmission other than a facsimile to a person outside of the secure system of the business unless the business uses encryption[2] to ensure the security of electronic transmission.”

Scope of the Law Unclear

Unfortunately, the brevity of the law results in the need for clarification on several key points:

Is the law limited to customers resident in Nevada?

A “customer” is not defined in the law, nor is there a statement that the law only applies to the personal information of Nevada residents.
Accordingly, the law could be interpreted as applying to an organization’s transmission of “any personal information of a customer,” regardless of where the customer resides.

What constitutes doing business in Nevada?

The law does not define what nexus a company must have to Nevada to fall within the scope of the law as a “business in this State.”
Guidance from a decision of the Nevada Supreme Court in evaluating whether a company is “doing business” in Nevada may be helpful. In this case, the court applied a two-pronged standard:

(a) the nature of the company's business in the state; and

(b) the quantity of business conducted by the company in the state.[3]

What constitutes a “secure system” of the business?

The prohibition under the Nevada law is limited to transmission of personal information to a person “outside of the secure system of the business.”

What is a “secure system?”

What are the consequences of violating the law?

The law does not include any penalty provisions, making the consequences of failing to comply unclear.
While the new law falls under the Miscellaneous Trade Regulations and Prohibited Acts Chapter, the chapter also does not contain any generally applicable penalty provisions.

Bottom Line

Companies operating nationally should consider whether their existing policies and procedures regarding transmission of customer personal information comply with this new law. In October 2008 merely transmitting customer personal information in an unencrypted format may violate this Nevada data security law. If an organization is not doing business in Nevada, it should monitor the developments in other states where it operates. History of the enactment of the data breach statutes suggests that the other states may soon follow.

[1] Personal Informationis defined as “a natural person's first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted:

1. Social security number.

2. Driver's license number or identification card number.

3. Account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to the person's financial account. The term does not include the last four digits of a social security number or publicly available information that is lawfully made available to the general public.”

[2] Encryptionis defined as " the use of any protective or disruptive measure, including, without limitation, cryptography, enciphering, encoding or a computer contaminant, to:

1. Prevent, impede, delay or disrupt access to any data, information, image, program, signal or sound;

2. Cause or make any data, information, image, program, signal or sound unintelligible or unusable; or

3. Prevent, impede, delay or disrupt the normal operation or use of any component, device, equipment, system or network.”

[3] Executive Mgmt. Ltd. v. Ticor Title Ins. Co., 38 P. 3d 872 (Nev. 2002).

Iron Cove Solutions Partners with RPost to Bring Proof of Content, Delivery, and End-to-End E-mail Encryption to its Customers

03 Jul 2008

Iron Cove Solutions, a leader in secure data solutions, and RPost®, the leader in managed outbound messaging with its flagship Registered E-mail® service, today announced a partnership to offer RPost's Registered E-mail® services to Iron Cove customers. RPost offers an all inclusive, on-demand platform of e-mail services for high value outbound messages. These services now include end-to-end e-mail encryption in addition to RPost's core Legal Proof® services.

"RPost has tied together the best e-mail services in each category – to prove, sign, secure, record, and collaborate. For our customers, RPost's simple-to-use, low cost e-mail encryption service has been the lead-in. RPost's end-to-end encryption service is attractive as it can be purchased on a pay-as-you-go basis and is simple to use and administer," remarks Patrick Monahan, CEO of Iron Cove Solutions. "RPost offers e-mail privacy and security on an as-needed basis, with the click of one button, without complex training or installation. RPost's e-mail encryption service pushes the encrypted message directly to the recipient's inbox, eliminating need for any registrations, keys, click-throughs, downloads, or accounts. Further, RPost has the only service on the market that provides our customers with proof of delivery even if the recipient chooses to not decrypt the message."

Iron Cove makes RPost's services available to all clients. Unlike the common read receipt, RPost's core service provides legal and verifiable proof of delivery, content, and official time sent and received for any Registered E-mail message sent to any recipient anywhere in the world. The RPost service functions regardless of what system or software the recipient uses, regardless of their settings, and without requiring them to respond in any way. For the highest assurance of confidentiality, the RPost system does not retain a copy of the original e-mail, unlike alternative "store and forward" solutions, nor does it require e-mail recipients to download specialized software or click on links.

"Adding RPost's Registered E-mail services reduces paper, cost and time, and demonstrates that RPost, our customers, and our partners are doing their share to meet today's economic and environmental challenges. With RPost's Registered E-mail service, customers now obtain a higher level of proof and security as compared to traditional mail and courier products, while reducing paper use and without subjecting their firm to increasing 'fuel surcharges' that the courier companies continue to pile on," said Zafar Khan, CEO of RPost. "Further, Iron Cove Solutions users can now retain a detailed electronic trail of the message from sender to receiver, reducing not only litigation risk, but also the costs of trips to the post office, storage, e-mail records management and electronic discovery requests."

Intacct Launches Expanded Channel Partner Program

New Intacct Business Solution Provider Program to Significantly Extend Company's Reach and Provide New Opportunities for Partners

SAN JOSE, Calif. – March 3, 2008 – Intacct, a leader in on-demand accounting and financial management solutions, today announced the launch of the new Intacct Business Solution Provider partner program. This new component to Intacct's successful channel and alliances program establishes a network of partners that will provide value-added sales and integration services that are complementary to Intacct's applications. Intacct expects the new partner program to attract the top five to seven percent of the more than 10,000 companies that resell accounting, financial management, and enterprise resource planning (ERP) solution in North America.

Partners in the Intacct Business Solution Provider partner program will sell and implement Intacct financial management applications either standalone or in conjunction with other applications, such as Customer Relationship Management and Human Resources solutions, to small and mid-sized businesses. Many of the partners will have a focus on specific vertical industries not already served by Intacct. With this new program, Intacct expects its indirect channel to deliver more than 50 percent of the company's revenue by the end of 2009, and significantly expand its footprint in the financial applications market.

Intacct has designed a program that will enable partners to get up and running quickly selling and implementing Intacct solutions. The program features a low cost of entry, with no revenue minimums required. Partners are offered generous discounts on Intacct subscriptions that are tied to achievable annual revenue targets, and the partners own the relationship with the client throughout the lifetime of the subscription.

Additional benefits of the program include:

Deal registration process to ensure a non-competitive sales environment
Seasoned, channel-neutral direct sales team that is incented to support the partner selling process
Recurring revenue streams, with consistent discounts throughout the life of each client's subscription
In-person intensive product training and certification, with additional web-based advanced training
Dedicated sales support and full product support
Proven financial management applications that are pre-integrated with leading on-demand applications like salesforce.com, and feature open web services for additional integration
Access to Intacct's extended partner network of more than 100 best of breed software-as-a-service (SaaS) companies, implementation partners, outsourcers, and certified public accountants
Industry-leading Buy with Confidence_SM customer success program to help ensure client satisfaction and high renewal rates

"We launched this program as a vehicle to enable VARs and integrators to actively participate in the rapidly growing on-demand ecosystem," said Jerry Jalaba, vice president of channel sales for Intacct. "At a time when the on-demand financial applications market is exploding, the Intacct Business Solution Provider partner program helps resellers and systems integrators deliver solutions that meet a broad range of back-office financial system needs. This program will significantly expand our current partner base and create added reach and scale across the small to mid-sized business market."

Intacct is focused on developing a scalable, leveraged, and cost effective go-to-market selling ecosystem for the company's on-demand financial management applications. Intacct's partner programs have already attracted more than 100 partners, focusing on Business Process Outsourcers (firms that that use Intacct financial management applications to service their clients), CPA firms, Implementation Partners, and OEM partners that embed Intacct applications as part of their solutions. This new program will be the first time Intacct has actively sought out traditional software resellers and systems integrators.

In addition, the company has established strong alliances with complementary platform, application, and integration providers, including salesforce.com, IBM, CompuPay, LucidEra, Boomi, and Adaptive Planning among others.

Initial Intacct Business Solution Provider Partners Praise the New Program

Intacct has already signed several companies to join the new partner program, including a number of companies that have previously resold and implemented NetSuite. These companies all have broad experience and a keen understanding of the on-demand financial applications market.

Several of the initial participants praised the new program:

"Demand Solutions Group focuses exclusively on SaaS solutions, and many of our salesforce.com customers are looking for an on-demand financial management solution," said Todd Fitzwater, principal at Demand Solutions Group. "Intacct, with its seamless integration to salesforce.com, is a natural fit and provides the very solution our customers have been looking for. Now we can help our clients deploy financial applications that will preserve their salesforce.com investment. We look forward to participating in the Intacct Business Solution Provider program and working with the Intacct team to drive rewards for both our companies."

"Iron Cove Solutions is focused on SaaS solutions and we continue to see strong interest in the market for on-demand software solutions," said Patrick Monahan, president of Iron Cove Solutions. "We are excited about the Intacct Business Solution Provider program, and having the opportunity to work with Intacct's dynamic and cost effective SaaS offering. We believe our clients will benefit immensely not only from a great product for financial management, but also from the extensive and readily accessibly customer service."

"Xolved is thrilled to join the Intacct Business Solution Provider program," said Dean Dzurilla, managing partner at Xolved, Inc. "Intacct has a strong commitment to making its customers and partners successful. We think they are poised to do very well in the on-demand financial management applications space, and have put together a compelling program for partners. The addition of Intacct to our portfolio provides our clients with another powerful solution to further their business growth."

About Intacct

Intacct is a market and technology leader in on-demand accounting and financial management applications. The company's award-winning suite of solutions is used by thousands of small and midsized businesses, from startups to public companies, to manage and share financial, supply chain, and professional services information. Intacct automates key business processes from order entry through cash collection and procurement through vendor payment. The Intacct suite includes accounting, contract management, revenue recognition, inventory, purchasing, vendor management, project management, payroll, and financial reporting applications, all delivered over the Web via Software as a Service. Intacct is the only on-demand financial management suite seamlessly integrated with salesforce.com. As a company grows, Intacct's deep and mature applications, SAS 70 Type II certification, and documented processes support Sarbanes-Oxley compliance for public enterprises.