ALASKA - Davis Wright Tremaine · Government Notice * Written notification to Alaska Attorney...

ALASKA Data Breach Notification Summary

This summary is for informational purposes only. It provides general information and not legal advice or opinions regarding specific facts. Additional requirements or conditions may apply to any or all provisions referenced herein. For more information about the state data breach notification laws or other data security matters, please seek the advice of counsel.

Copyright 2016 Davis Wright Tremaine LLP

www.dwt.com

Alaska Stat. § 45.48.010–.090

Quick Facts Breach Based on Harm Threshold

Deadline forConsumer Notice

Government Notification Required

YES Most expeditious time possible and without unreasonable delay YES*

More Details

Scope of this Summary Notification requirements applicable to persons doing business or with more than 10 employees, that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit or debit card number, in combination with any required security or access code, PIN or password that would permit access to a resident's financial account information; passwords, PINS or other access for financial accounts.

Form of Covered Info Electronic or Paper

Encryption Safe Harbor Statute does not apply to information that is encrypted or redacted, so long as the encryption key was not accessed or acquired.

Breach Defined Unauthorized acquisition, or reasonable belief of unauthorized acquisition, that compromises the security, confidentiality or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in the most expeditious time possible and without unreasonable delay consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Method: By written notice to most recent postal address, or electronic notice if it is the primary method of communication with resident or is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notice will interfere with a criminal investigation.

Harm Threshold Notification not required if, after appropriate investigation and after written notification to the Alaska Attorney General, covered entity determines that there is not a reasonable likelihood that harm to consumer has resulted or will result from the breach.

Government Notice * Written notification to Alaska Attorney General required only if you do not send notice because you have determined harm threshold is not reached.

Consumer Agency Notice If more than 1,000 residents notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice. Entities subject to Gramm-Leach-Bliley are exempt from this requirement.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach. Must cooperate by sharing relevant information about breach, but not disclosure of confidential business info or trade secrets.

Potential Penalties Violations may result in civil penalties. Last revised on July 11, 2016

ARIZONA Data Breach Notification Summary



www.dwt.com

Ariz. Rev. Stat. Ann. § 18-545*




YES Most expedient manner possible without unreasonable delay NO

More Details

Scope of this Summary Notification requirements applicable to persons or entities that conduct business in the state and own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit or debit card number, in combination with any required security or access code or password that would permit access to a resident's financial account.

Form of Covered Info Electronic Only

Encryption Safe Harbor Statute does not apply to information that is encrypted,redacted, or secured by any other means rendering the element unreadable or unusable so long as the encryption key was not accessed or acquired.

Breach Defined

Unauthorized access or acquisition that materially compromises the security or confidentiality of the covered info, and that causes or is reasonably likely to cause substantial economic loss to a resident, excluding certain good-faith acquisitions by employees or agents. Statute lists various factors that must be considered.

Consumer Notice

Timing: Must be made in the most expedient manner possible and without unreasonable delay consistent with any measures to determine the scope of the breach, to identify residents affected, or to restore the reasonable integrity of the system.

Method: By written notice, telephone notice, or electronic notice if it is the primary method of communication with resident or is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement advises that notice will impede a criminal investigation.

Harm Threshold Notification not required if, after a reasonable investigation, covered entity or a law enforcement agency determines a breach of the security of the system did not or is not reasonably likely to occur.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them without unreasonable delay following discovery of a breach. Must cooperate by sharing relevant information about breach.

Potential Penalties Violations may result in civil penalties. *Retitled statute not yet publicly available. Last revised on August 6, 2016

ARKANSAS Data Breach Notification Summary



www.dwt.com

Ark. Code Ann. §§ 4-110-101 to -108




YES Most expedient manner possible without unreasonable delay YES*

More Details

Scope of this Summary Notification requirements applicable to persons and businesses that acquire, own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit or debit card number, in combination with any required security or access code or password that would permit access to a resident's financial account; or medical information.



Breach Defined Unauthorized access or acquisition that compromises the security or confidentiality of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in the most expedient manner possible and without unreasonable delay consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Method: By written notice, or electronic notice if it is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notice will impede a criminal investigation.

Harm Threshold Notification not required if, after a reasonable investigation, covered entity determines that there is no reasonable likelihood of harm to customers.

Government Notice

* Ark. Admin. Code § 214.00.2-5010: Licensees subject to state Fair Mortgage Lending Act must notify state Securities Commissioner of a breach of a loan applicant’s or borrower’s financial information or Social Security number within two business days of discovery. Must use reasonable diligence to notify those affected within a reasonably time of the breach.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach.

Potential Penalties Violations may result in civil or criminal penalties. Last revised on July 11, 2016

CALIFORNIA Data Breach Notification Summary



www.dwt.com

Cal. Civ. Code § 1798.82




NO Most expedient time possible and without unreasonable delay

YES, if >500 residents notified

More Details

Scope of this Summary

Notification requirements applicable to persons or businesses that conduct business in the state and that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account , credit or debit card number, in combination with any required security or access code or password permitting access to a resident's financial account; medical or health insurance info; and info collected by automated license plate recognition systems

A user name or email address, in combination with a password or security question answer that would permit access to an online account.

Form of Covered Info Electronic only

Encryption Safe Harbor Statute does not apply to information that is encrypted, so long as the encryption key was not accessed or acquired.

Breach Defined Unauthorized acquisition that compromises the security, confidentiality, or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.

Content: Notice must be in "plain language," use at least 10-point font, and organized by clearly and conspicuously displayed title and headings. Notice must include, at a minimum: name and contact info of covered entity; types of covered info that were the subject of the breach; if available, the date, estimated date or date range of the breach; date of the notice; whether notice was delayed due to law enforcement; a general description of the breach; and toll-free numbers and addresses of the major CRAs if SSNs, drivers' license or state identification card numbers were exposed.

If Social Security, driver’s license or state identification card numbers are breached, and if the entity providing notice was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost for not less than 12 months, along with all information necessary to take advantage of the offer.

Method: By written notice, or electronic notice if it is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied. Additional rules apply to breaches involving user names or email addresses.


Government Notice If more than 500 state residents are notified as result of a single breach, must also electronically submit a sample copy of the notification to the California Attorney General.





www.dwt.com

CALIFORNIA Data Breach Notification Summary

Cal. Health & Safety Code § 1280.15


Deadline forConsumer Notice Government Notification Required

NO No later than 15 business days after detection

No later than 15 business days after detection

More Details

Scope of this Summary Notification requirements applicable to a clinic, health facility, home health agency, or hospice licensed pursuant to Cal. Health & Safety Code section 1204, 1250, 1725, or 1745.

Covered Info

Medical Information: Individually identifiable information regarding a patient’s medical history, mental or physical condition, or treatment. Information is identifiable if it includes any element of identifying information, such as name, address, e-mail address, telephone number, Social Security number, or other information that alone or in combination with other public information reveals the individual’s identity.


Breach Defined Unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information, excluding certain inadvertently misdirected paper records, e-mail, or facsimile within the same facility or health care system within the course of coordinating care or delivering services.

Consumer Notice

Timing: Notification to the affected patient or patient’s representative no later than 15 business days after the unlawful or unauthorized access, use, or disclosure is detected by the clinic, health facility, home health agency, or hospice.

Method: By written notice to the last known address. Notice can be provided by an alternative means or at an alternative location as specified by the patient or patient’s personal representative in writing purusant to 45 CFR § 164.522(b). Electronic notice by e-mail is permitted if the patient previously agreed in writing to receive electronic notice by e-mail.

Delayed Notice

Notification may be delayed if law enforcement provides a written or oral statement that notice will impede a related investigation, or a written declaration that notice will undermine a bona fide, ongoing, significant criminal investigation of serious wrongdoing related to the unlawful or unauthorized access, use, or disclosure. Additional timing and documentation requirements may apply.

Government Notice Notification must be made to the California Department of Public Health no later than 15 business days after the clinic, health facility, home health agency, or hospice detects the unlawful or unautorized access, use, or disclosure.


COLORADO Data Breach Notification Summary



www.dwt.com

Colo. Rev. Stat. § 6-1-716




YES Most expedient time possible and without unreasonable delay NO

More Details

Scope of this Summary Notification requirements applicable to individuals or commercial entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit card or debit card number, in combination with any required security or access code or password that would permit access to a resident's financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted, or secured by any other means rendering the name or element unreadable or unusable, so long as the encryption key was not accessed or acquired.


Consumer Notice


Method: By written notice, telephone notice, or electronic notice if it is the primary method of communication with resident or is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notice will impede a criminal investigation, and law enforcement notifies the covered entity not to send notice.

Harm Threshold Notification not required if, after prompt investigation, the covered entity determines that misuse of resident's covered info has not occurred and is not reasonably likely to occur.

Consumer Agency Notice If more than 1,000 residents notified, must notify all nationwide CRAs without unreasonable delay of anticipated date of notice and approximate number of residents to be notified. Entities subject to Gramm-Leach-Bliley are exempt from this requirement.

Third-Party Notice

If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach, if misuse of the covered info about a resident has occurred or is reasonably likely to occur. Must cooperate by sharing relevant information about breach, but not disclosure of confidential business info or trade secrets.


CONNECTICUT Data Breach Notification Summary



www.dwt.com

Conn. Gen. Stat. § 36a-701b*




YES Without unreasonable delay, but no later than 90 days after discovery of the breach YES

More Details

Scope of this Summary Notification requirements applicable to any persons who conduct business in the state and own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted or secured by other methods that renders them unreadable or unusable, so long as the encryption key was not accessed or acquired.

Breach Defined Unauthorized access or acquisition

Consumer Notice

Timing: Must be made without unreasonable delay but no later than 90 days after the discovery of the breach, unless a shorter time is required under federal law, subject to completion of an investigation to determine the nature and scope of the incident, to identify those affected, or to restore the reasonable integrity of the system.

Method: By written notice, telephone notice, or electronic notice if it is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Content: If Social Security Numbers are breached or reasonably believed to have been breached, an offer shall be made to provide residents with appropriate identity theft prevention and, if applicable, mitigation services at no cost for not less than 12 months, along with all information necessary to take advantage of the offer, including information on how to place a credit freeze on the resident’s credit file.

Delayed Notice Notification may be delayed if law enforcement determines that notice will impede a criminal investigation, and law enforcement requests notification be delayed.

Harm Threshold Notification not required if, after appropriate investigation and consultation with relevant federal, state, and local law enforcement, the covered entity reasonably determines the breach will not likely result in harm to residents affected.

Government Notice Covered entity must also provide notice to the Connecticut Attorney General no later than the time notice is provided to the resident.


Potential Penalties Violations may result in civil penalties. *Revised Connecticut General Statutes incorporating 2015 amendments not yet publicly available. Up-to-date text of statute available in 2016 Supplement (linked to above). Last revised on July 11, 2016

DELAWARE Data Breach Notification Summary



www.dwt.com

Del. Code Ann. tit. 6, §§ 12B-101 to -104





More Details

Scope of this Summary Notification requirements applicable to any individuals or commercial entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info




Breach Defined Unauthorized access or acquisition that compromises the security, confidentiality, or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice




Harm Threshold Notification not required if, after reasonable and prompt investigation, the covered entity determines that misuse of a resident's covered info has not occurred or is not reasonably likely to occur.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach. Must cooperate by sharing relevant information about breach.


WASHINGTON DC Data Breach Notification Summary



www.dwt.com

D.C. Code §§ 28-3851 to 28-3853




NO Most expedient time possible and without unreasonable delay NO

More Details

Scope of this Summary Notification requirements applicable to persons or entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name; or phone number; or address, plus: Social Security number; driver's license or District identification card number; credit or debit card number; any other number, code, or combination of numbers or codes, such as account number, security or access code or password that would permit access to a resident's financial or credit account.


Encryption Safe Harbor Statute does not apply to information that has been rendered secure, so as to be unusable to an unauthorized third party.


Consumer Notice


Method: By written notice, or by electronic notice if customer consented to receipt of electronic notice consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.


Consumer Agency Notice If more than 1,000 residents notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice. Persons or entities subject to Gramm-Leach-Bliley are exempt from this requirement.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them in the most expedient time possible following discovery of a breach.


FLORIDA Data Breach Notification Summary



www.dwt.com

Fla. Stat. § 501.171




YES As expeditiously as practicable and without unreasonable delay, but no later than 30 days.


More Details

Scope of this Summary Notification requirements applicable to commercial entities that acquire, maintain, store or use covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license, state identification card, passport, military identification, or other similar number to verify identity; financial account, credit, or debit card number in combination with any info that allows access to a resident's financial account; info regarding resident's medical history, mental/physical condition, medical treatment/diagnosis; or resident's health insurance policy or subscriber identification number and any unique identifier used by health insurer. A username or email address in combination with password or security question that would permit access to online account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, secured or modified to remove identifying elements or otherwise render it unusable, provided the encryption key was not accessed or acquired.

Breach Defined Unauthorized access, excluding certain good-faith access by employees or agents.

Consumer Notice

Timing: Must be made as expeditiously as practicable and without unreasonable delay but no later than 30 days after determination of breach, consistent with time necessary to determine scope of the breach, identify those affected, and restore the reasonable integrity of the system.

Content: Notice must include the date(s) of the breach, a description of the covered info that was or reasonably believed to have been accessed, and the covered entity's contact info.

Method: By written notice or by e-mail. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed for a specified period upon written request by law enforcement if law enforcement determines that notice will impede a criminal investigation.

Harm Threshold Notification not required if, after investigation and consultation with relevant federal, state, or local law enforcement, covered entity reasonably determines breach has not and will not likely result in identity theft or other financial harm. Must be documented in writing and retained for five years.

Government Notice

If 500 or more residents affected as result of a breach, must provide notice to Florida Dept. of Legal Affairs. Notice must be as expeditiously as practicable, but no later than 30 days after determination of breach. May receive 15 additional days if good cause for delay is provided in writing. Notice to Dept. must include: synopsis of events surrounding breach; number of residents affected/potentially affected; any services offered without charge and instructions on how to use; copy of thenotice to residents; and contact info. Must provide additional information to Department at any time.

Consumer Agency Notice If more than 1,000 residents notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as expeditiously as practicable, but no later than 10 days following determination of a breach. Must provide all info entity needs to comply with notice requirements.


GEORGIA Data Breach Notification Summary



www.dwt.com

Ga. Code Ann. §§ 10-1-910 to -912 Ga. Code Ann. § 46-5-214 (telephone records)





More Details

Scope of this Summary Notification requirements applicable to persons and commercial entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; account, credit or debit card number, if it can be used without additional identifying info, access codes or passwords; account passwords, PINs or other access codes; or any of the previous when not connected with the first name or first initial and last name if sufficient to perform or attempt identity theft.



Breach Defined Unauthorized acquisition that compromises the security, confidentiality, or integrity of the covered info, excluding certain good-faith access by employees or agents.

Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the system.


Delayed Notice Notification may be delayed if law enforcement determines that notice will compromise a criminal investigation.

Consumer Agency Notice If more than 10,000 residents notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them within 24 hours following discovery of a breach.


HAWAII Data Breach Notification Summary



www.dwt.com

Haw. Rev. Stat. §§ 487N-1 to 487N-3




YES Without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to commercial entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; or account, credit or debit card number, access code, or password that would permit access to an individual's financial account.



Breach Defined

Unauthorized access and acquisition where illegal use of the personal information has occurred, or is reasonably likely to occur, and creates risk of harm to the person, excluding certain good-faith access by employees or agents. Unauthorized access or acquisition of encrypted covered info with key is a breach.

Consumer Notice

Timing: Must be made without unreasonable delay consistent with any measures to determine contact info, the scope of the breach, and to restore the reasonable integrity, security, and confidentiality of the system.

Content: Notice must be clear and conspicuous and must describe: incident in general terms; type of covered info accessed or acquired; covered entity's acts to protect covered info from further access; telephone number, if there is one, individual can call for further information and assistance; advice for individual to remain vigilant.

Method: By written notice to last known address; by telephone notice if direct contact is made; or by e-mail if individual has consented and consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement informs covered entity that notice may impede a criminal investigation or jeopardize national security and requests delay. Request must be in writing or documented contemporaneously in writing by covered entity.

Harm Threshold Where illegal use of covered info has occurred or is reasonably likely to occur, and creates risk of harm to the person.

Government Notice If more than 1,000 individuals notified, must notify, in writing, the Hawaii Office of Consumer Protection without unreasonable delay of timing, distribution and content of the consumer notice.

Consumer Agency Notice If more than 1,000 individuals notified, must notify, in writing, all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.



IDAHO Data Breach Notification Summary



www.dwt.com

Idaho Code Ann. §§ 28-51-104 to -107





More Details


Covered Info First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; or account, credit card or debit card number in combination with any information that would permit access to a resident's financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, so long as encryption key was not accessed or acquired.

Breach Defined Illegal acquisition that compromises the security, confidentiality or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, identify the resident affected, and restore the reasonable integrity of the system.

Method: In writing to the most recent known address, by telephone, or by electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notification will impede a criminal investigation.

Harm Threshold Notification not required if, after reasonable and prompt investigation, the covered entity determines that misuse of a resident's covered info has not occurred or is not reasonably likely to occur.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach. Must cooperate by sharing relevant information about breach.


ILLINOIS Data Breach Notification Summary



www.dwt.com

815 Ill. Comp. Stat. §§ 530/1–530/40





More Details


Covered Info First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; or account, credit card or debit card number in combination with any information that would permit access to a resident's financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted or redacted, so long as encryption key was not accessed or acquired.

Breach Defined Unauthorized access or acquisition that compromises the security, confidentiality or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay, consistent with any measures to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the system.

Content: Notice must include the toll-free numbers and addresses for the CRAs; toll-free number, address and website address for the FTC; and a statement that the resident can obtain information from these sources about fraud alerts and security freezes. The notification may not include information concerning the number of Illinois residents affected by the breach.

Method: In writing or by electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines notification will impede a criminal investigation and provides a written request for the delay.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach and must cooperate in matters relating to the breach as specified in the statute.


INDIANA Data Breach Notification Summary



www.dwt.com

Ind. Code §§ 24-4.9-1 to -4.9-5





More Details

Scope of this Summary Notification requirements applicable to any persons that own or license covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: driver’s license or state identification card number; credit card number; or financial account number or debit card number in combination with a security code, access code or password that would permit access to the person's account. Includes Social Security number by itself.

Form of Covered Info Electronic or tangible medium (paper, microfilm, etc) if transferred from computerized data.



Consumer Notice

Timing: Must be made without unreasonable delay, consistent with necessary measures to restore the integrity of the system or necessary to discover the scope of the breach

Method: By mail, telephone, fax, or email. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement or the Attorney General requests delay because disclosure will impede a criminal or civil investigation or jeopardize national security.

Harm Threshold Notification not required if the breach has not resulted in and could not result in identity deception, identity theft or fraud.

Government Notice If you give notice to Indiana residents, must notify the Indiana Attorney General.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all CRAs with information necessary to assist the CRA to prevent fraud, including the types covered info affected by the breach.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them following discovery of a breach.


IOWA Data Breach Notification Summary



www.dwt.com

Iowa Code §§ 715C.1–2




YES Most expedient time possible and without unreasonable delay


More Details


Notification requirements applicable to persons or business entities that own, or license covered info that is used in the course of a business, vocation, occupation or volunteer activities. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or other unique identification number created or collected by a government body; financial account, credit card, or debit card number in combination with any required security or access code, or password that would permit access to a resident's financial account; unique electronic identifier or routing code, in combination with any required security or access code, or password that would permit access to a resident's financial account; and unique biometric data or other unique physical representation or digital representation of biometric data.

Form of Covered Info Electronic or Paper (if printed from a computerized form)

Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or otherwise altered by any method or technology in such a way that the it is unreadable, so long as the encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, sufficiently determine contact info for the residents affected, and restore the reasonable integrity of the system.

Content: Notice must include a description and approximate date of the breach, contact info for CRAs, and advise to the consumer to report suspected incidents of identity theft to local law enforcement or the Attorney General.

Method: In writing to the last known address, or by electronic notice if the entity's customary method of communication with the consumer is by electronic means or is consistent with Iowa Code ch 554D and E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notification will impede a criminal investigation and the agency makes a written request that the notification be delayed.

Harm Threshold Notification not required if, after appropriate investigation or consultation with relevant federal, state or local agencies, it is determined that there is no reasonable likelihood of financial harm to residents. Such determination must be documented in writing and retained for five years.

Government Notice If more than 500 Iowa residents are notified, must notify Attorney General's Director of the Consumer Protection Division within 5 business days after giving notice to any consumer.



KANSAS Data Breach Notification Summary



www.dwt.com

Kan. Stat. Ann. §§ 50-7a01 to -7a04





More Details

Scope of this Summary Notification requirements applicable to persons or businesses that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; or financial account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.




Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.



Harm Threshold Notification not required if, after reasonable and prompt investigation, misuse of covered info is not reasonably likely to occur.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the notices.



KENTUCKY Data Breach Notification Summary



www.dwt.com

Ky. Rev. Stat. Ann. § 365.732





More Details

Scope of this Summary Notification requirements applicable to persons or businesses entities that conduct business within the state. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info First name or first initial and last name, plus: Social Security number; driver's license number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.




Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.



Harm Threshold Notification not required if the covered entity reasonably believes that the breach has not and will not cause identity theft or fraud against any Kentucky resident.


Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as soon as possible after discovery of a breach.

Last revised on July 11, 2016

LOUISIANA Data Breach Notification Summary



www.dwt.com

La. Rev. Stat. Ann. §§ 51:3071 to 51:3077




YES Most expedient time possible and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to persons that conducts business in the state or that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.





Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the system.



Harm Threshold Notification not required if, after reasonable investigation, the covered entity determines that there is no reasonable likelihood of harm to consumers.

Government Notice

La. Admin. Code, tit. 16, pt. III, § 701: If notice is required, must provide written notice to the Consumer Protection Section of the Attorney General's office. Notice must include the names of all Louisiana citizens affected. It will be timely if received within 10 days of distribution of notice to the Louisiana citizens.



MAINE Data Breach Notification Summary



www.dwt.com

Me. Rev. Stat. tit. 10, §§ 1346–1349




YES* Most expedient time possible and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to commercial entities and "information brokers" (as defined) that maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver’s license or state ID card number; account, credit or debit card number if circumstances exist that such number could be used without additional identifying information, access codes or passwords; account passwords or personal identification numbers or other access codes; or any of the previous information not in connection with first name, or initial, and last name, if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity of the person whose information was compromised.




Consumer Notice

Timing: Must be made expeditiously as possible and without unreasonable delay, consistent measures necessary to determine the scope of the breach and restore reasonable integrity, security and confidentiality of the data.


Delayed Notice Notification may be delayed by law enforcement if they determine that it will compromise a criminal investigation. Notice must be given within 7 business after they determine that notification will not compromise the investigation.

Harm Threshold *Notification not required if, after a reasonable and prompt investigation conducted in good faith, the covered entity determines that there is no reasonable possibility that the covered info has been or will be misused. Harm threshold only applies to covered entities that are not information brokers.

Government Notice If notification required, must notify the appropriate state regulator within the Department of Professional and Financial Regulation or, if not regulated by the Department, the Attorney General.

Consumer Agency Notice

If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay. The notification must include the date of the breach, an estimate the number of individuals affected by the breach, if known, and the actual or anticipated date the individuals were or will be notified.



MARYLAND Data Breach Notification Summary



www.dwt.com

Md. Code Ann., Com. Law §§ 14-3501 to -3508


Deadline for Consumer Notice


YES As soon as reasonably practicable YES*

More Details

Scope of this Summary Notification requirements applicable to businesses that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info First name or first initial and last name, plus: Social Security or tax identification number; driver's license number; or financial account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or otherwise protected by another method that renders the info unreadable or unusable, so long as the encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made as soon as reasonably practicable after the investigation but after given notice to the Attorney General, consistent with measures to determine scope of the breach, identify those affected or restore the integrity of the systems.

Content: Notice must include, to the extent possible, a description, including specific elements, of the covered info breach; the covered entity's address, telephone number and toll-free number if one is maintained; the toll-free numbers and addresses for the major CRAs; toll-free telephone number, addresses and website addresses for the FTC and Maryland Attorney General; and a statement that a resident can obtain information from all three sources about steps to avoid identity theft.

Method: In writing to most recent address, by email to the most recent email address if they have expressly consented to receive notices primary through the Internet, or by telephone to the most recent telephone number. Substitute notice is available if certain criteria are satisfied.

* Code of Md. Regulations 10.25.18.08: Health information exchanges must notify health care consumers and other entities of a breach or non-HIPAA violations. Notice to health care consumers must meet certain content requirements.Additional consumer notification requirements apply.

Delayed Notice Notification may be delayed if law enforcement determines that notification will impede a criminal investigation or jeopardize national or homeland security.

Harm Threshold Notification not required if it is not likely that covered info has or will be misused as a result of the breach. Must record determination in writing and save for three years.

Government Notice

If notice is provided, must notify the Attorney General before providing consumer notice. *Code of Md. Regulations 10.25.18.07–.08: Health information exchanges must report breach to federal and state regulators consistent with applicable federal and state privacy and security laws.


Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as soon as practicable after discovery of a breach. Must also share information relative to the breach.


MASSACHUSETTS Data Breach Notification Summary



www.dwt.com

Mass. Gen. Laws ch. 93H, §§ 1–6




YES As soon as practicable and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to persons, including businesses, that own, license, maintain or store covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.




Consumer Notice

Timing: Must be made as soon as practicable and without unreasonable delay.

Content: Notice must include information about resident's right to obtain a police report, how a resident requests a security freeze as well as the necessary information to be provided when requesting the security freeze, and any fees required to be paid to any CRAs. Notification must not include the nature of the breach or the number of residents affected by the breach.

Method: In writing or electronic notice if consistent with E-SIGN and Mass. Gen Laws ch 110G. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines notice may impede a criminal investigation and notifies the Attorney General in writing. The entity must cooperate with law enforcement, including sharing information relevant to the incident.

Harm Threshold Notification not required if the breach does not create a substantial risk of identity theft or fraud against a resident.

Government Notice

Must notify the Attorney General, Director of the Office of Consumer Affairs and Business Regulation and any other CRAs or state agencies identified by the Director of OCABR, as soon as practicable and without unreasonable delay. Notice must include any steps the entity has taken or plans to take relating to the breach.

Consumer Agency Notice Must notify any relevant CRAs without as soon as practicable and without unreasonable delay.Must include the nature of the breach, the number of residents affected and any steps the entity takes or plans to take relating to the incident. Must notify other CRAs identified by the Director of OCABR.

Third-Party Notice

If you maintain covered info on behalf of another entity, you must notify them as soon as practicable and without unreasonable delay entity has reason to know of a breach. Must also cooperate and inform owner of unauthorized use, approximate date of such incident, nature of the breach, and any steps the entity has taken or plans to take relating to the incident. Does not include disclosure of confidential business info or trade secrets, or notice to affected residents.


MICHIGAN Data Breach Notification Summary



www.dwt.com

Mich. Comp. Laws §§ 445.61, 445.63, 445.72




YES Without unreasonable delay NO

More Details

Scope of this Summary Notification requirements applicable to persons or commercial entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted or redacted so long as encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made without unreasonable delay, consistent any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.

Content: Notice must be in a clear and conspicuous manner, and: include a description of the breach in general terms; describe the type of covered info that is subject to the breach; generally describe what the entity has done to protect data from further security breaches, if applicable; include a telephone number where the resident may obtain assistance or additional information; and remind the resident of the need to remain vigilant for incidents of fraud and identity theft.

Method: By written, electronic or telephone notice. The statute specifies requirements for each type of notice. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notification will impede a criminal investigation or jeopardize national or homeland security.

Harm Threshold Notification not required if entity determines that the breach has not and is not likely to cause substantial loss or injury to or result in identity theft with respect to one or more Michigan residents.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing and number of notices to Michigan residents.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them of a breach.


MINNESOTA Data Breach Notification Summary



www.dwt.com

Minn. Stat. §§ 325E.61, 325E.64





More Details

Scope of this Summary Notification requirements applicable to persons or businesses that conducts business in Minnesota and own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted or secured by any other method or technology that renders it unreadable or unusable, so long as the encryption key is not accessed or acquired.

Breach Defined Unauthorized access or acquisition that materially compromises the security, confidentiality or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, identify those affected, and restore the reasonable integrity of the system.

Method: By written notice to most recent address, or electronic notice if it is the entity's primary method of communication with the resident or if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines notice may impede a criminal investigation.

Consumer Agency Notice If more than 500 residents are notified, entity must notify all nationwide CRAs within 48 hours of consumer notice of the timing, distribution and content of the notices.



MISSISSIPPI Data Breach Notification Summary



www.dwt.com

Miss. Code Ann. § 75-24-29





More Details


Notification requirements applicable to persons that conducts business in Mississippi and who, in the ordinary course of business own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is secured by encryption or any other method or technology that renders the covered info unusable, so long as the encryption key was not accessed or acquired.

Breach Defined Unauthorized acquisition of covered info.

Consumer Notice

Timing: Must be made without unreasonable delay, subject to the completion of an investigation to determine the nature and scope of the breach or to restore the reasonable integrity of the system.

Method: By written notice, telephone notice, or electronic notice if the entity's primary means of communication with the resident or consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed for a reasonable period of time if law enforcement determines that notification will impede a criminal investigation or national security and agency has requested that the notification be delayed.

Harm Threshold Notification not required if, after an appropriate investigation, the covered entity determines that breach will not likely result in harm to residents.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as soon as practicable following discovery of a breach.


MISSOURI Data Breach Notification Summary



www.dwt.com

Mo. Rev. Stat. § 407.1500




YES Without unreasonable delay YES, if >1,000 residents notified

More Details


Covered Info

First name or first initial and last name, plus: Social Security number; driver’s license, or other unique identification number created or collected by a government body; financial account number, credit or debit card number in combination with any required security code, access code, or password that would permit access to an resident's financial account; unique electronic identifier or routing code, in combination with any required security code, access code, or password that would permit access to an resident's financial account; medical information; or health insurance information.

Form of Covered Info Electronic and the statute is ambiguous as whether it applies to non-electronic records

Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or otherwise alter in such a manner to make it unreadable, so long as the encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the system.

Content: Notice must include a description of the breach in general terms; the type of information obtained in the breach; a telephone number that consumers may call for further information and assistance, if one exists; contact information for CRAs; and advice to affected consumers to remain vigilant by reviewing account statements and monitoring free credit reports.

Method: By written notice, by telephone if contact is made directly with the affected residents, or electronic notice if entity has a valid email address, resident agreed to receive communications electronically and email notice is consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notification will impede a criminal investigation or jeopardize national or homeland security. The request must be in writing or documented by the covered entity contemporaneously and include the officer name and agency.

Harm Threshold Notification not required if, after consultation with relevant law enforcement, the covered entity determines that the risk of identity theft or other fraud to any Missouri resident is not reasonably likely to occur as a result of the breach. Must document determination and maintain for five years.

Government Notice If more than 1,000 residents are notified, must notify Attorney General's office without unreasonable delay of timing, distribution and content of the consumer notice.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.



MONTANA Data Breach Notification Summary



www.dwt.com

Mont. Code Ann. §§ 30-14-1701 to -1705





More Details


Notification requirements applicable to person or business, excluding insurance companies, that conduct business in Montana and that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security or tax identification number; driver's license, state identification card or tribal identification card number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account; medical record info as defined in Mont. Code § 33-19-104; or an identity protection personal identification number issued by the US Internal Revenue Service.




Consumer Notice

Timing: Must be made without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.

Method: By written notice or electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.


Harm Threshold Notification not required if the covered entity reasonably believes that breach has not and will not reasonably cause loss or injury to a Montana resident.

Government Notice

Must simultaneously submit electronic copy of notification sent to residents and statement providing the date and method of distributing the notice to the Attorney General’s consumer protection office. Copy submitted to the Attorney General must exclude any info that personally identifies those residents who are entitled to notification.

Consumer Agency Notice

If you provide notice to any resident and suggest, indicate or imply that the resident may obtain a copy of their consumer report from a CRA, the entity must coordinate with the CRA as to the timing, content and distribution of the notice. Coordination may not unreasonable delay the notice to affected residents.



NEBRASKA Data Breach Notification Summary



www.dwt.com

Neb. Rev. Stat. §§ 87-801 to -807




NO As soon as possible and without unreasonable delay YES

More Details


Notification requirements applicable to individuals or commercial entities that conduct business in the state and that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver’s license or state identification number; account number, credit or debit card number in combination with any information that allows access to a resident’s financial account; unique electronic identification number or routing code combined with any required security code, access code, or password; or unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation. A user name or email address, in combination with a password or security question answer that would permit access to an online account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or otherwise alter in such a manner to make it unreadable, so long as the encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made as soon as possible and without unreasonable delay, consistent with any measures necessary to determine the scope and restore the reasonable integrity of the system.

Method: By written notice to the postal address in the records, by telephone or electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.


Government Notice If any residents are notified, must also notify the Attorney General of the breach. Notice to the Attorney General must be given no later than the time when residents are notified.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify and cooperate with them after becoming aware of a breach. Cooperation includes, but is not limited to, sharing the information relevant to the breach, but does not include proprietary information.


NEVADA Data Breach Notification Summary



www.dwt.com

Nev. Rev. Stat. §§ 603A.010–.100, 603A.220, 603A.900–.920, 242.183





More Details

Scope of this Summary Notification requirements applicable to businesses that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license, driver authorization card or identification card number; account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account; medical or health insurance identification number; or a username, unique identifier or email address in combination with a password, access code or security question and answer that would permit access to an online account.




Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay, consistent with any measures to determine the scope of the breach and restore the reasonable integrity of the system.






NEW HAMPSHIRE Data Breach Notification Summary



www.dwt.com

N.H. Rev. Stat. Ann. §§ 359-C:19, -C:20, -C:21




YES As soon as possible YES*

More Details

Scope of this Summary Notification requirements applicable to persons that conduct businesses in the state or that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info First name or first initial and last name, plus: Social Security number; driver's license or government identification card number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.




Consumer Notice

Timing: Must be made as soon as possible.

Content: Notice must include a description of the incident in general terms, the approximate date of the breach, the type of covered info that was obtained as a result of the breach, and a telephone number for the covered entity.

Method: In writing, by electronic notice if it is the primary means of communication with those affected, or by telephone if a log of the notification is kept. Substitute notice is available if certain criteria are satisfied.

*N.H. Code Admin. R. Ins. § 3702: Licensees under state insurance regulations must provide notice in a clear and conspicous manner as soon as possible but not later than 30 days. Must include same required content in notice. Additional notice requirements apply.

Delayed Notice Notification may be delayed if law enforcement or national or homeland security agency determines that notification will impede a criminal investigation or jeopardize national or homeland security.

Harm Threshold Notification not required if entity determines that misuse of the covered info has not occurred and is reasonably unlikely to occur.

Government Notice

*Anyone engaged in trade or commerce subject to the jurisdiction of the bank commissioner, director of securities regulation, insurance commissioner, public utilities commission, the financial institutions and insurance regulators of other states, or federal banking or securities regulators must notify the primary regulator of such trade or commerce about the breach. All other persons must notify the state Attorney General's office of the breach. Such notice must contain the anticipated date of notice to consumers and the approximate number of New Hampshire residents who will be notified. *N.H. Code Admin. R. Ins. § 3702: Licensees under state insurance regulations must provide notice to the Insurance Department as soon as possible but no later than 30 days.

Consumer Agency Notice If more than 1,000 persons are notified, must notify all nationwide CRAs without unreasonable delay of the anticipated date of the notification, approximate number of consumers notified and the content of the notice. This does not apply to entities subject to Gramm-Leach-Bliley.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify and cooperate with them immediately following discovery of a breach. Cooperation includes sharing information relevant to the breach but not disclosure of confidential info or trade secrets.


NEW JERSEY Data Breach Notification Summary



www.dwt.com

N.J. Stat. Ann. §§ 56:8-161, -163, -165




YES Most expedient time possible and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to entities that conduct business in the state and that compile or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted or secured by any other method or technology that renders it unreadable or unusable, so long as the encryption key is not accessed or acquired.


Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay and consistent with any measures necessary to determine the scope of the breach and to restore the integrity of the system.


Delayed Notice Notification may be delayed if law enforcement determines and advises that notification will impede a criminal or civil investigation and request that notification be delayed.

Harm Threshold Notification not required if entity established that misuse of the covered info is not reasonably possible. Any determination must be documented in writing and retained for five years.

Government Notice In advance of any disclosure to the consumers, must report breach and any information pertaining to it to the Division of State Police in the Department of Law and Public Safety.




NEW YORK Data Breach Notification Summary



www.dwt.com

N.Y. Gen. Bus. Law § 899-aa




NO Most expedient time possible and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to persons or businesses that conduct business in the state and that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or non-driver identification card number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.



Breach Defined Unauthorized acquisition or acquisition without valid authorization that compromises the security, confidentiality or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents. The statute lists multiple factors that can be considered.

Consumer Notice


Content: Notice must include contact info for covered entity and a description of the categories of information that was reasonably believed to have been breached, including state which elements of covered info were acquired.

Method: In writing, by electronic notice or by telephone. Electronic notice may be made only to residents that have expressly consented to receiving notice in electronic form and a log of each notification must be kept. No one may require a resident to consent to receive notice electronically. If telephone notice is used a log must be kept. Substitute notice is available if certain criteria are satisfied.


Government Notice If NY residents are notified, must notify the AG, NY Department of State and New York State Police of the timing, content and distribution of the notices and the approximate number of affected persons.

Consumer Agency Notice If more than 5,000 residents are notified, must notify list of CRAs maintained by AG of timing, distribution, and content of the consumer notice, and the approximate number of affected persons. May not delay any other required notification in order to notify the CRAs.



NORTH CAROLINA Data Breach Notification Summary



www.dwt.com

N.C. Gen. Stat. §§ 75-61, 75-65




YES Without unreasonable delay YES* More Details

Scope of this Summary Notification requirements applicable to businesses that own or license covered info. Some types of businesses may be exempt from some or all of these requirements; non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security or employer taxpayer identification numbers; driver’s license, state identification card, or passport numbers; checking account, savings account, credit card or debit card numbers; personal identification (PIN) code; electronic identification numbers, email names or addresses, Internet account numbers, or Internet identification names, parent’s legal surname prior to marriage, or passwords if such information would permit access to a person’s financial account or resources; digital signatures; any other numbers or information that can be used to access a person’s financial resources; biometric data; or fingerprints.



Breach Defined Unauthorized access or acquisition of covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made without unreasonable delay taking any necessary measures to determine sufficient contact info, determine the scope of the breach and to restore the reasonably integrity, security and confidentiality of the system.

Content: Notice must be clear and conspicuous and include: a description of the incident in general terms; a description of the type of personal information involved; a description of the general acts of the covered entity to protect the information from further unauthorized access; a telephone number of the covered entity that the person can call for further information and assistance, if one exists; advice that directs them to remain vigilant by reviewing account statements and monitoring free credit reports; toll-free number and address for the major CRAs; and toll-free number, address, and website address for the FTC and the Attorney General's office, along with a statement that the person can obtain information from these sources about preventing identity theft.

Method: In writing, by electronic notice of residents with a valid email address and who have agreed to receive communications electronically if notice is consistent with E-SIGN, or telephone notice provide that contact is made directly with the affected residents. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that the notification will impede a criminal investigation or jeopardize homeland or national security and makes the request in writing or the covered entity documents the request contemporaneously in writing, including the name of the officer and agency.

Harm Threshold Notification not required if no illegal use has or is reasonably likely to occur and breach does not create a material risk of harm to any consumer.

Government Notice

If residents are notified, must notify the Consumer Protection Division of the AG's office without unreasonable delay and provide the nature of the breach, number of consumers affected, steps taken to investigate the breach, steps taken to prevent a similar breach in the future, and information regarding the timing, distribution and content of the consumer notices.

*N.C. Admin Code 3M.0402: Mortgage licensees must notify the Commissioner of the North Carolina Banking Commission within one business day of providing notice.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution, and content of the consumer notice. May not delay required notification in order to notify CRAs.

Third-Party Notice If you maintain covered info on behalf of another entity, must notify immediately following discovery of a breach.


NORTH DAKOTA Data Breach Notification Summary



www.dwt.com

N.D. Cent. Code §§ 51-30-01 to -07




NO Most expedient time possible and without unreasonable delay YES

More Details

Scope of this Summary Notification requirements applicable to persons that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; operator's license number assigned by the DOT; a non-driver color photo identification card number assigned by the DOT; financial account number, credit card or debit card number in combination with any required security or access code, or password that would permit access to a financial account; date of birth; maiden name of the resident's mother; medical information (as defined); health insurance information (as defined); an identification number assigned by the resident's employer in combination with any required security code, access code, or password; or digitized or other electronic signature.



Breach Defined Unauthorized access or acquisition of covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice




Government Notice Must notify the Attorney General via mail or email of any breach that affects more than 250 individuals.



OHIO Data Breach Notification Summary



www.dwt.com

Ohio Rev. Code Ann. §§ 1349.19, 1349.191, 1349.192




YES Most expedient time possible but no longer than 45 days NO

More Details


Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or altered in a manner that renders it unreadable, so long as the encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made in the most expedient time possible but not later than 45 days following its discovery of the breach consistent with any measures necessary to determine the scope of the breach, include which consumers' info was accessed or acquired, and to restore the reasonable integrity of the system.

Method: In writing, by telephone or electronic notice if it is the covered entity's primary method of communication with resident. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that the notification will impede a criminal investigation or jeopardize homeland or national security.

Harm Threshold Notification not required if the covered entity reasonably believes that the breach has not and will not cause a material risk of identity theft or other fraud to any Ohio resident.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution, and content of the consumer notice. May not delay any other required notification in order to notify the CRAs.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them in an expeditious manner following determination of a breach.


OKLAHOMA Data Breach Notification Summary



www.dwt.com

Okla. Stat. tit. 24, §§ 161–166




YES Most expedient time possible and without unreasonable delay YES*

More Details

Scope of this Summary Notification requirements applicable to individuals or entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info





Consumer Notice

Timing: Must be made in the most expedient time possible without unreasonable delay consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Method: By written notice to the postal address in the records, by telephone or electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines and advises that notification will impede a criminal or civil investigation or homeland or national security.

Harm Threshold Notification not required if covered entity reasonably believes that breach has not and will not cause identity theft or other fraud to any Oklahoma resident.

Government Notice * Okla. Admin. Code § 605:10-13-1: Entities subject to the state Real Estate Commission must also send notice to the Commission.



OREGON Data Breach Notification Summary



www.dwt.com

Or. Rev. Stat. §§ 646A.600–.604, 646A.624–.626




YES Most expeditious manner possible and without unreasonable delay YES, if >250 residents affected

More Details

Scope of this Summary Notification requirements applicable to persons that own or license covered info in the course of business, vocation, occupation or volunteer activities. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver license or state identification card number issued by the Department of Transportation; passport or other US issued identification number; financial account, credit or debit card number, in combination with any required security or access code or password that would permit access to the resident's financial account; data from automatic physical characteristics measurements used to authenticate identity in the course of a financial or other transaction (e.g. fingerprint, retina, etc.); health policy or health insurance identification number combined with any other unique identifier used by a health insurer to identify the resident; or medical history, mental or physical condition, or medical diagnosis or treatment information.

Covered information also includes any of the above data elements without the name, if that information would be sufficient to permit a person to commit identity theft.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or rendered unusable with other methods, so long as encryption key was not accessed or acquired.


Consumer Notice

Timing: Must be made in the most expeditious time possible and without unreasonable delay and consistent with any measures necessary to determine sufficient contract info, determine the scope of the breach, or restore the reasonable integrity, security and confidentiality of the data.

Content: Notice must include a description of the incident in general terms, the approximate date of the breach, the type of covered entity that was obtained as a result of the breach, contact info for the covered entity, contact info for the national CRAs, and advice to report suspected identity theft to law enforcement, including the Attorney General and the FTC.

Method: By written notice, electronic notice if it is the covered entity's customary method of communication with the affected resident or is consistent with E-SIGN, or by telephone contact made directly to the affected resident. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notice will impede criminal investigation and has made a written request that the notification be delayed.

Harm Threshold Notification not required if, after an appropriate investigation or after consultation with relevant federal, state or local law enforcement, the entity reasonably determines that affected Oregon residents are unlikely to suffer harm. The determination must be documented in writing and retained for five years.

Consumer Agency Notice If more than 1,000 residents are affected, must notify all nationwide CRAs without unreasonable delay of timing, distribution, content of the consumer notice and include a police number report, if available. Notification may not be delayed.

Government Notice Must notify the Attorney General via mail or email of any breach that affects more than 250 residents.



PENNSYLVANIA Data Breach Notification Summary



www.dwt.com

73 Pa. Cons. Stat. §§ 2301–2308, 2329





More Details

Scope of this Summary Notification requirements applicable to entities that maintain, store or manage covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info




Breach Defined Unauthorized access or acquisition that materially compromises the security or confidentiality of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made without unreasonable delay taking any necessary measures to determine the scope of the breach and to reasonably restore the integrity of the system.

Content: If notice is given by telephone, it must be clear and conspicuous, describe the incident in general terms, verify that covered info but does not require the consumer to provide the covered info to the entity, and provides a telephone number or Internet website to visit for further information or assistance.

Method: In writing to the last known home address, by telephone if the consumer can be reasonably expected to receive it, or by email if a prior business relationship exists and the entity has a valid email address. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines and advises the covered entity in writing that notification will impede a criminal or civil investigation.

Harm Threshold Notification not required if the covered entity reasonably believes that the breach has not and will not cause loss or injury to any Pennsylvania resident.




RHODE ISLAND Data Breach Notification Summary



www.dwt.com

R.I. Gen. Laws §§ 11-49.3-1 to 11-49.3-6




YES Most expedient time possible but no later than 45 days YES, if >500 residents notified

More Details

Scope of this Summary Notification requirements applicable to persons that store, own, collect, process, maintain, acquire, use or license covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license number or Rhode Island Identification card number; or account, credit or debit card number, in combination with any required security or access code, or password or personal identification number that would permit access to a resident's financial account; medical or health insurance information; or email address with any required security or access code, or password that would permit access to an individual’s personal, medical, insurance, or financial account.




Consumer Notice

Timing: Must be made in the most expedient time possible but no later than 45 days after confirmation of the breach and the ability to ascertain information that must be included in the consumer notice.

Content: Notice must include, to the extent known: the date(s) of the breach; the date the breach was discovered; a general and brief description of the incident, including how the breach occurred and the number of affected individuals; the covered info affected; and a clear and concise description of: (i) any remediation services offered, inclduing the toll-free numbers and websites of CRAs, remediation service providers, and the Attorney General, and (ii) information regarding the resident’s ability to file or obtain a police report, request a security freeze, and any fees that a CRA may require.


Delayed Notice Notification may be delayed if law enforcement determines and notifies the entity that notice will impede a criminal investigation.

Harm Threshold Notification not required if the breach or disclosure of personal information does not pose a significant risk of identity theft to any affected resident.

Government Notice

If more than 500 residents are notified, must notify the Attorney General of timing, distribution and content of the consumer notice and the number of affected individuals. * R.I. Admin. Code § 11-5-107:11: Entities subject to state insurance regulations must send notice of a breach to the state Department of Business in the most expedient time possible and without unreasonable delay.

Consumer Agency Notice If more than 500 residents are notified, must notify the major CRAs of timing, distribution and content of the consumer notice and the number of affected individuals.

Third-Party Notice [Notification requirement removed in 2016 Amendment]

Potential Penalties Reckless violations may result in civil penalties of not more than $100/record; knowing and willful violations may result in civil penalties of not more than $200/record.

Last revised on July 11, 2016

SOUTH CAROLINA Data Breach Notification Summary



www.dwt.com

S.C. Code Ann. § 39-1-90




YES Most expedient time possible and without unreasonable delay

YES, if >1,000 residents notified

More Details

Scope of this Summary Notification requirements applicable to persons conducting business in the state and that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit card or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial account; numbers or information which may be used to access a person's financial accounts; or numbers or information issued by a governmental or regulatory entity that uniquely identify a resident.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or rendered unusable with other methods, so long as encryption key was not accessed or acquired.


Consumer Notice


Method: By written notice, telephone notice, or electronic notice if it is the covered entity's primary method of communication with consumer or is consistent with E-SIGN and Chapter 6, Title 11 of the 1976 Code. Substitute notice is available if certain criteria are satisfied.


Harm Threshold Notification not required if you reasonably believe that illegal use has not and is not reasonably likely to occur and use of info does not create a material risk of harm to the resident.

Government Notice If more than 1,000 residents notified pursuant to this statute, must notify Consumer Protection Division of the South Carolina Department of Consumer Affairs without unreasonable delay of timing, distribution and content of the consumer notice.




TENNESSEE Data Breach Notification Summary



www.dwt.com

Tenn. Code Ann. § 47-18-2107




NO Immediately but no later than 45 days NO

More Details

Scope of this Summary Notification requirements applicable to persons or businesses that conduct business in the state that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

“First name or first initial and last name, in combination with any one(1) or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver's license number; or account, credit card or debit card number in combination with any required security or access code or password that would permit access to a resident's financial account.”


Encryption Safe Harbor Use of the word “unencrypted” was removed from parts of the statute in the 2016 amendments withthe stated legislative intent to remove the encryption safe harbor; however, use of the word “encrypted” remains a threshold in the definition of Personal Information (see “Covered Info” above).


Consumer Notice

Timing: Must be made immediately but no later than 45 days from discovery of the breach.




Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately but no later than 45 days following discovery of a breach.


TEXAS Data Breach Notification Summary



www.dwt.com

Tex. Bus. & Com. Code Ann. §§ 521.002, 521.053, 521.151




NO As quickly as possible NO

More Details


Notification requirements applicable to persons who conduct business in the state and that own, license or maintain covered info OR similar info on a resident from a state that does not have a breach notice requirement. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or government-issued identification number; account, credit or debit card number in combination with any required security or access code, or password that would permit access to an individual's financial account; or information that identifies an individual and relates to (a) their physical or mental health or condition; (b) the provision of health care to them, or (c) their payment for the provision of health care.




Consumer Notice

Timing: Must be made as quickly as possible, except as necessary to determine the scope of the breach and restore the reasonable integrity of the system.



Consumer Agency Notice If more than 10,000 persons are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.



UTAH Data Breach Notification Summary



www.dwt.com

Utah Code Ann. §§ 13-44-101 to -301





More Details

Scope of this Summary Notification requirements applicable to persons that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info



Encryption Safe Harbor Statute does not apply to information that is encrypted or protected by another method that renders the data unreadable or unusable, so long as the encryption key was not accessed or acquired.


Consumer Notice


Method: Written notice by first-class mail to the most recent known address, telephone notice, electronic notice if it is the primary method of communication with resident or consistent with E-SIGN, or publishing notice in a newspaper of general circulation and as consistent with Utah's public notice statute.


Harm Threshold Notification not required if, after reasonable and prompt investigation, the covered entity determines that identity theft or fraud has not occurred and is not reasonably likely to occur.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them immediately following discovery of a breach. Must cooperate by sharing info relevant to the breach with the owner. This notice may not be delayed based on law enforcement determination.


VERMONT Data Breach Notification Summary



www.dwt.com

Vt. Stat. Ann. tit. 9, §§ 2430–2435

Quick Facts

Breach Based on Harm Threshold



YES Most expedient time possible without unreasonable delay but no later than 45 days YES*

More Details


Covered Info

First name or first initial and last name, plus: Social Security number; motor vehicle operator’s license or nondriver identification card number; financial account, credit or debit card number, if circumstances exist in which the number could be used without additional identifying information, access codes, or passwords; or account passwords or personal identification numbers or other access codes for a financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or protected by another method that renders it unreadable or unusable by an unauthorized person, so long as the encryption key was not accessed or acquired.

Breach Defined Unauthorized access or acquisition that compromises the security, confidentiality or integrity of covered info, excluding certain good-faith acquisitions by employees/agents. Enumerated factors must be considered.

Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay but not later than 45 days after discovery and consistent with any measures to determine the scope of the breach and to restore the reasonable integrity, security and confidentiality of the system.

Content: Notice must be clear and conspicuous and include description of: incident in general terms; type of covered info subject to the breach; general acts covered entity is taking to protect the covered info from further security breaches; a telephone number that the consumer can call for information and assistance; advice that directs the consumer to remain vigilant by reviewing account statements and monitoring free credit reports; and the approximate date of the security breach. Additional requirements apply to electronic notice.

Method: Written notice mailed to residence, live telephone notice made directly to Vermont resident, or electronic notice if valid email address and consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement believes notice will impede law enforcement investigation, national or homeland security, or jeopardize public safety or national or homeland security interests. Covered entity must document request in writing, including name of officer and agency making the request.

Harm Threshold Notification not required if misuse is not reasonably possible, see "Government Notice" section.

Government Notice

Subject to a law enforcement delay, must provide initial notice to the Attorney General or Department of Financial Regulation (if licensed/registered by dept.) of the date of the breach, date of discovery, and a preliminary description of the breach within 14 business days of discovery or when the covered entity provides notice to Vermont residents, whichever is sooner. This requirement is subject to certain limitations. When notice is provided to Vermont residents, the covered entity must provide follow up notice to the Attorney General or Department. Such notice must include the number of Vermont residents affected, if known, and a copy of the consumer notice. * If determination that misuse of personal information is not readily possible, must notify Attorney General or Department of such determination and provide a detailed explanation.

Consumer Agency Notice If more than 1,000 residents are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice. Certain exceptions apply.



VIRGINIA Data Breach Notification Summary



www.dwt.com

Va. Code Ann. § 18.2-186.6 Va. Code Ann. § 32.1-127.1:05 (medical info)





More Details

Scope of this Summary Notification requirements applicable to individuals or entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification card number; financial account, credit card or debit card number, in combination with any required security or access code, or password that would permit access to a resident's financial account; or medical information (as defined).




Consumer Notice

Timing: Must be made without unreasonable delay consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Content: Notice must include description of incident in general terms, types of covered info subject to breach, the general acts covered entity has taken to protect covered info from further unauthorized access, a telephone number that person may call for information and assistance, and advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.

Method: Written notice to last known postal address, telephone notice or electronic notice. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement believes notice will impede law enforcement investigation, national or homeland security.

Harm Threshold Notification not required if covered entity reasonably believes that breach has not and will not cause identity theft or other fraud to any Virginia resident.

Government Notice Must notify Attorney General without unreasonable delay.


Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them without unreasonable delay.


WASHINGTON Data Breach Notification Summary



www.dwt.com

Wash. Rev. Code §§ 19.255.010–.020




YES Most expedient time possible without unreasonable delay, no more than 45 days

YES, if >500 residents are notified*

More Details

Scope of this Summary Notification requirements applicable to persons or businesses that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info





Consumer Notice

Timing: Must be made in the most expedient time possible without unreasonable delay but no more than 45 calendar days after the breach was discovered, consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Content: Notice must be written in plain language and include, at a minimum, the following: the name and contact info of the covered entity; a list of the types of covered info that were or reasonable believed to have been affected; and the toll-free phone numbers and addresses of the major credit reporting agencies if the breach exposed personal information


Delayed Notice Notification may be delayed if data owner or licensee contacts a law enforcement agency after discovery of a breach and the agency determines notification will impede a criminal investigation.

Harm Threshold Notification not required if the breach is not reasonably likely to subject consumers to a risk of harm.

Government Notice

If more than 500 residents notified pursuant to this statute, must provide an electronic copy of the notice to the state Attorney General and the number of state consumers affected by the breach. Notice to the AG must be in the most expedient time possible and without unreasonable delay, but no more than 45 calendar days after the breach was discovered. *Wash. Admin Code 284-04-625: Licensees subject to state insurance regulations must notify state Insurance Commissioner about the number of consumers affected and measures taken in writing within two business days of determining notice must be sent to consumers under breach notification statute or 45 C.F.R. § 164.402. Additional notice requirements apply for breaches of PHI.



WEST VIRGINIA Data Breach Notification Summary



www.dwt.com

W. Va. Code §§ 46A-2A-101 to -105





More Details


Covered Info





Consumer Notice

Timing: Must be made without unreasonable delay taking any necessary measures to determine the scope of the breach and to reasonably restore the integrity of the system.

Content: Notice must include (a) description of categories of info that was accessed or acquired, (b) telephone number or website address to contact the covered entity (or agent) to learn types of info maintained by entity and whether the entity maintained info on them, and (c) toll-free number and addresses for major CRAs and instruction on how to place a fraud alert or security freeze.

Method: By written notice to postal address in records, telephone notice, or electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines that notice will impede criminal or civil investigation or homeland or national security.

Harm Threshold Notification not required if covered entity reasonably believes that unauthorized access or acquisition has not and will not cause identity theft or other fraud to any West Virginia resident.

Consumer Agency Notice If more than 1,000 residents are notified under this statute, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice. This does not apply to entities subject to Gramm-Leach-Bliley.



WISCONSIN Data Breach Notification Summary



www.dwt.com

Wis. Stat. § 134.98




YES Within reasonable time not greater than 45 days NO

More Details


Notification requirements applicable to entities, other than individuals, that conduct business, license covered info, maintain deposit accounts or lend money in the state. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or state identification number; financial account, credit or debit card number, or any security or access code, or password that would permit access to the individual's financial account; DNA profile; or unique biometric data.


Encryption Safe Harbor Statute does not apply to information that is encrypted, redacted or altered in a manner that renders it unreadable, so long as the encryption key was not accessed or acquired.

Breach Defined Acquired by an unauthorized person, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made within a reasonable time not to exceed 45 days, subject to law enforcement delay.

Content: Upon written request from a notified individual, the covered entity must identify the covered info that was acquired.

Method: By mail or by a method the entity has previously used to communicate with the affected person. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification must be delayed if law enforcement determines necessary to protect an investigation or homeland security.

Harm Threshold Notification not required if acquisition of covered info does not create a material risk of identity theft or fraud to the affected person.

Consumer Agency Notice If more than 1,000 individuals are notified, must notify all nationwide CRAs without unreasonable delay of timing, distribution and content of the consumer notice.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as soon as practicable following determination of a breach.


WYOMING Data Breach Notification Summary



www.dwt.com

Wyo. Stat. Ann. §§ 40-12-501 to -502




YES Most expedient time possible without unreasonable delay NO

More Details


Notification requirements applicable to individuals and commercial entities that conduct business in the state and own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security or driver's license number; account, credit or debit card number in combination with any security code, access code or password that would allow access to a financial account of the person; tribal, or federal or state government issued identification card; shared login secrets or security tokens known to be used for data based authentication; username or email address, in combination with a required password or security question and answer; birth or marriage certificate; medical information (i.e. medical history, mental or physical condition, or medical treatment or diagnosis); health insurance info; unique biometric info; or a taxpayer identification number.


Encryption Safe Harbor Statute does not apply to information where data elements are redacted.

Breach Defined Unauthorized acquisition of covered info that materially compromises the security, confidentiality or integrity of the covered info.

Consumer Notice


Content: Notice must be clear and consistent and include at minimum: toll-free number for covered entity or its agent, and the toll-free number and address for the major credit reporting agencies; the types of covered info reasonably believed affected; a general description of the breach; the approximate date of the breach, if known; the covered entity’s general actions to guard against further breach; advice for resident to remain vigilant; and whether notice was delayed due to law enforcement.

Method: Written or e-mail notice. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines in writing that notification may seriously impeded a criminal investigation.

Harm Threshold Notification not required if acquisition of covered info does not cause or reasonably believed to cause loss or injury to a Wyoming resident.

Third-Party Notice If you maintain covered info on behalf of another entity, you must notify them as soon as practicable following determination of a breach.


GUAM Data Breach Notification Summary



www.dwt.com

9 Guam Code Ann. §§ 48.10–.80





More Details

Scope of this Summary Notification requirements applicable to persons and entities that own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license or Guam identification card number; financial account, credit card or debit card number, in combination with any required security or access code, or password that would permit access to a resident's financial account.


Encryption Safe Harbor Statute does not apply to information that is encrypted or redacted.

Breach Defined Unauthorized access and acquisition that compromises the security or confidentiality of the covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be without unreasonable delay consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system.

Method: By written notice to postal address in covered entity's records, telephone notice, or electronic notice. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines and advises that notification will impede a criminal or civil investigation, or homeland or national security.

Harm Threshold Notification not required if acquisition of covered info does not cause, or covered entity does not reasonably believe has caused or will cause, identity theft or other fraud to a Guam resident.



PUERTO RICO Data Breach Notification Summary



www.dwt.com

P.R. Laws Ann. tit. 10, § 4051–4055




NO As expeditiously as possible YES

More Details

Scope of this Summary Notification requirements applicable to entities that own or are custodians of covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.

Covered Info

First name or first initial and last name, plus: Social Security number; driver's license number, voter identification or other official identification; bank or financial account number of any type, with or without any password assigned or access code assigned; names of users and passwords or access codes to public or private info systems; medical info protected by HIPAA; tax info; work-related evaluations.


Encryption Safe Harbor Statute does not apply to information that needs a special cryptographic code to access.

Breach Defined Unauthorized access that compromises the security, confidentiality, or integrity of the covered info; or where authorized persons or entities accessed and violated professional confidentiality standards or obtained authorization under false representation with intent to make illegal use of covered info.

Consumer Notice

Timing: As expeditiously as possible consistent with any measures to restore the security of the system.

Content: Notice must be submitted in a clear and conspicuous manner, should describe the breach in general terms and the type of sensitive info compromised, and include a toll-free number and Internet site for people to obtain information or assistance.

Method: By written notice by mail or by authenticated electronic means according to the Digital Signatures Act. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement needs to secure possible crime scenes and evidence.

Government Notice Must notify the Department of Consumer Affairs within a non-extendable term of 10 days after discovery.

Third-Party Notice If you resell or provide access to digital data banks containing covered info, you must notify the proprietor, custodian, or holder of said covered info of any violation of the system's security.


VIRGIN ISLANDS Data Breach Notification Summary



www.dwt.com

V.I. Code Ann. tit. 14, §§ 2209–2212





More Details

Scope of this Summary Notification requirements applicable to persons and businesses that conduct business in the territory and own, license or maintain covered info. Some types of businesses may be exempt from some or all of these requirements and non-commercial entities may be subject to different requirements.



Encryption Safe Harbor Statute does not apply to information that is encrypted.

Breach Defined Unauthorized acquisition that compromises the security, confidentiality, or integrity of covered info, excluding certain good-faith acquisitions by employees or agents.

Consumer Notice

Timing: Must be made in the most expedient time possible and without unreasonable delay consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.

Method: By written notice, or electronic notice if consistent with E-SIGN. Substitute notice is available if certain criteria are satisfied.

Delayed Notice Notification may be delayed if law enforcement determines notification will impede a criminal investigation.



ALASKA - Davis Wright Tremaine · Government Notice * Written notification to Alaska Attorney...

Documents

Transcript of ALASKA - Davis Wright Tremaine · Government Notice * Written notification to Alaska Attorney...