C CLE cheat sheet

Sources of law hierarchy in most common-law jurisdictions: constitution > statute > regulation > case law interpretation; a regulation cannot exceed the authority granted by its enabling statute.

Criminal law requires proof beyond a reasonable doubt; civil liability uses preponderance of the evidence (more likely than not), so the same incident can yield criminal acquittal and civil judgment.

Four privacy torts (US Restatement tradition): intrusion upon seclusion, public disclosure of private facts, false light, appropriation of name or likeness; each has distinct elements.

Contract formation elements: offer, acceptance, consideration, capacity, legality; a clickwrap assent is generally enforceable when the user had notice and an opportunity to review.

Negligence elements: duty, breach, causation (actual and proximate), damages; a standard of reasonable care is often informed by industry frameworks but frameworks are not statutes.

Data ownership is not a single legal right: statutes allocate control (consent, access, deletion) while contracts allocate use rights; 'owner' claims are usually imprecise.

Personal jurisdiction over a foreign attacker typically requires minimum contacts or effects intentionally directed at the forum; mere accessibility of a website is usually insufficient.

Statutes of limitations run from discovery in many breach cases (discovery rule), so delayed detection can extend exposure rather than extinguish it.

GDPR applies to processing of EU/EEA data subjects' personal data by controllers/processors, regardless of where the entity is established, when offering goods/services or monitoring behavior in the EU.

GDPR breach notification to the supervisory authority: without undue delay and where feasible within 72 hours of awareness, unless unlikely to result in risk; notify data subjects when high risk.

NIS2 (EU) covers essential and important entities across sectors, imposes risk-management and 24-hour early-warning / 72-hour incident notification duties to CSIRTs, with size thresholds and member-state implementation.

HIPAA Security Rule requires administrative, physical, and technical safeguards for ePHI; the Breach Notification Rule requires notice without unreasonable delay and no later than 60 days from discovery.

PCI DSS is a contractual standard, not a law: it governs cardholder data environment scope, and compliance is enforced via acquirer/network contracts rather than statute.

ISO/IEC 27001 certifies a management system (ISMS), not a product; certification covers the scope defined in the statement of applicability, not all company systems.

SOC 2 reports address the trust services criteria (security, availability, processing integrity, confidentiality, privacy) and come in Type I (design at a point in time) and Type II (operating effectiveness over a period).

Records-retention and legal-hold obligations override routine deletion schedules: once litigation is reasonably anticipated, preservation duties attach to relevant data.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident activity; notification decisions are made in parallel, not after full recovery.

Definition of 'breach' varies: GDPR uses accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data; many US laws key on unauthorized acquisition of unencrypted personal information.

Safe harbors commonly exist for encrypted data where the key was not compromised and the encryption was not rendered ineffective; the burden of proof usually falls on the breached entity.

Notification deadlines differ by jurisdiction and often start at 'discovery' rather than confirmation of scope; some US state laws require notice within 30 days, others use 'without unreasonable delay'.

Sectoral US notification: HIPAA (60 days), GLBA Safeguards Rule (30 days for covered financial institutions to FTC for events affecting 500+ consumers), SEC rules (material cybersecurity incident on Form 8-K generally within four business days of materiality determination).

Regulators may require content elements: nature of incident, categories and approximate number of data subjects, contact point, likely consequences, and measures taken or proposed.

Processor obligations typically require notifying the controller without undue delay; the controller, not the processor, generally bears the duty to notify regulators and individuals.

Privilege protection for incident reports requires counsel direction, a defined purpose, and careful handling; routine business reports and third-party forensic drafts may be discoverable.

Computer-crime statutes commonly criminalize unauthorized access, access exceeding authorization, interference with data or systems, and interception; authorization scope is defined by the owner's expressed or implied permission.

The Budapest Convention on Cybercrime harmonizes offenses and provides 24/7 network points of contact and mutual legal assistance for cross-border preservation and collection.

Chain of custody requires documented, unbroken control of evidence from seizure to presentation: who handled it, when, where, and what was done at each transfer.

Forensic soundness rests on validated tools and repeatable process; hash values (e.g., SHA-256) computed at acquisition and re-verified later support integrity claims.

Volatile data (memory, running processes, network connections) is lost on shutdown; order of volatility guides collection priority before powering down.

Legal process types: subpoena (documents/testimony), court order (e.g., stored-content access under US ECPA), and warrant (supported by probable cause, for certain content and premises).

Best-evidence and authentication rules generally require showing how electronic records were created and maintained; business-records exceptions frequently admit routine system logs.

Anti-forensics (timestomping, log wiping, encryption) can undermine reliability; investigators document anomalies and corroborate with independent sources such as network or third-party logs.