1 Autumn Edwards Project 2 BUS 206 Nanci Carr
2 Introduction The following is a report provided to the business owner of Mountain Top View regarding a recent data breach and whether the company has a legal and/or ethical obligation to report the breach to its customers. First and foremost, "ethics is the study and practice of decisions about what is good and right". (Kubasek, Browne, Herron, Dhooge, Barkacs, 2023, p. 23) It's what should be focused on in every situation in life and making the "right decisions". Business ethics "is the application of ethics to the special problems and opportunities experienced by businesspeople". (Kubasek, et al., 2023, p. 23) When looking at business ethics and business law, they go hand in hand, advising and evaluating each other. Ethics help guide the law and even shapes many business laws. This means that when owning and operating a business, the owner and employees must apply what is good and right for their business and customers. Businesses operate in a community setting, serving customers in that community. Those customers have expectations for these companies which would be deemed the social responsibility of business. Not only do they expect to be provided with goods and services, but they also expect that if they were to shop at a local business, that their information will be protected. Especially if the company website has a disclaimer committing them to keeping consumer information secure. Analysis There are ethical and legal issues involved in this situation that occurred at Mountain Top View. The company database was hacked, accessing customer names, addresses and phone numbers. This was discovered by the company's lead IT, Steve, who then promptly corrected the
3 code that allowed the hack and secured the database, but only after the customers from the first quarter of the years information was breached. He did not bring it to anyone's attention, and it was only discovered to have happened after Carlos, another employee, heard Steve talking about it in the break room. No matter how many customers were affected by this breach, it is still their right to know what has happened. Steve put the business's wellbeing before the customers, which is in clear violation of business ethics. By doing this, he has jeopardized your company's integrity. According to the FTC, once a breach has been determined, you must notify the proper authorities immediately. In the state of Texas, there is a data breach form to be filled out by the owner of the business within 30 days of the breach. Had Steve properly notified you, you could have filled this out in a timely manner to report the wrongdoing. The FTC also makes note that you must notify people that their personal information was accessed so they can quickly take the proper steps to ensure their information isn't misused. According to the Business and Commerce Code of the state of Texas "A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to