DATA SECURITY BREACHES: THE VOLUNTARY DISCLOSURE DEBACLE FOR LISTED COMPANIES

How do listed companies err on the side of caution without treating every information leak a disclosure of price sensitive information…

With advancements in artificial intelligence, algorithmic analysis of seemingly unconnected segments of data is often able to yield inferences that are greater than the sum of its parts. This has resulted in some unique challenges when dealing with cyber security incidents relating to listed companies.

After a recent amendment to the Securities and Exchange Board of India (Prohibition of Insider Trading) Regulations, 2015 (PIT Regulations) every listed co mpany is required to formulate policies and procedures for inquiry in case of leak or suspected leak of UPSI. This shifts the onus onto the listed company to determine whether there has been a leak, suspected or real, of UPSI and report it to the Securities and Exchange Board of India (SEBI).

The second challenge arises from the fact that while leaked information about a listed company may not prima facie appear to be unpublished, price-sensitive information (UPSI), when algorithmically analyzed in conjunction with other information in the public domain, may yield inferences that would deem such information to be UPSI. With listed companies increasingly engaging with customers through official social media handles, any positive or negative response to a question about undisclosed quarterly results may be considered a leak of UPSI. The question then, is how listed companies may practically err on the side of caution, without escalating every information leak to be UPSI.