DATA BREACH CHARTS (Current as of December 31, 2015)

Transcription

1 DATA BREACH CHARTS (Current as of December 31, 2015) The charts below provide summary information about data breach notification statutes across the country. California adopted the first data breach notification statute in 2003, and, as of the writing of this introduction, 46 states have followed with similar statutes. Currently, the only states without data breach notification statutes are Alabama, New Mexico and South Dakota. There are many common features in the majority of statutes. These include provisions addressing a definition of personal information, a definition of covered entities that must provide a notification, a definition of security breach, the persons to whom notification must be provided, the timing for the notification, and a prescribed method for notification. There are, however, significant differences between several of the statutes. Some states require providing notice to a state attorney general or a state agency. Other states require providing notice to credit reporting agencies. Some states specify the contents of the notice that must be provided to affected individuals, such as a general description of the nature of the breach. Other states expressly prohibit revealing the nature of the breach. The bottom line is that one size does not fit all. Unless or until the federal government adopts a uniform scheme, entities that experience a data breach must carefully evaluate the requirements for every state in which any affected person resides. The following summary was last updated in December 2015 and is for informational purposes only. It does not constitute legal advice. As data breach notification laws change rapidly, no reference summary should be consulted as a substitute for reviewing statutory language and consulting with an attorney. It is also important to recognize that the charts below summarize only data breach notification statutes: many states have enacted additional statutes and provisions related to information security. Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire New Jersey New Mexico New York North Carolina North Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island South Carolina South Dakota Tennessee Texas Utah Vermont Virginia Washington West Virginia Wisconsin Wyoming

2 State Encryption Safe Harbor Risk Of Harm Analysis DATA BREACH SUMMARY CHART Specific Content Requirements for Notices to Consumers Specific Timing Requirements for Notices to Consumers Notice to State Regulator Required Notice to Consumer Reporting Agencies Required Specific Provisions for Monetary Penalties Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire Private Cause Of Action Data Breach Charts current as of December 31, 2015 Page 2

3 State Encryption Safe Harbor Risk Of Harm Analysis Specific Content Requirements for Notices to Consumers Specific Timing Requirements for Notices to Consumers Notice to State Regulator Required Notice to Consumer Reporting Agencies Required Specific Provisions for Monetary Penalties New Jersey New Mexico New York North Carolina North Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island South Carolina South Dakota Tennessee Texas Utah Vermont Virginia Washington West Virginia Wisconsin Wyoming Private Cause Of Action Data Breach Charts current as of December 31, 2015 Page 3

4 ALABAMA No legislation. Back to top Data Breach Charts current as of December 31, 2015 Page 4

5 ALASKA: Alaska Stat et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any person doing business, governmental agency, or person with more than 10 employees that owns or licenses personal information, in any form, which includes personal information of an Alaskan resident. Judicial branch agencies are not covered. Means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector; "acquisition" includes acquisition by photocopying, facsimile, or other paper-based method; a device, including a computer, that can read, write, or store information that is represented in numerical form; or a method not identified above. Means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of an individual s name; in this subparagraph, "individual s name" means a combination of an individual s o first name or first initial; and o last name; and one or more of the following information elements: o the individual s social security number; o the individual s driver s license number or state identification card number; o the individual s account number, credit card number, or debit card number; o passwords, personal identification numbers, or other access codes for financial accounts. The statute only applies to personal information that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired. If a covered person owns or licenses personal information in any form that includes personal information on an Alaska resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each Alaska resident whose personal information was subject to the breach. The disclosure shall be made in the most expeditious time possible and without unreasonable delay. Disclosure is not required if, after an appropriate investigation and after written notification to the attorney general, the covered person determines that there is not a reasonable likelihood that harm to the consumers has resulted or will result from the breach. The determination shall be documented in writing and maintained for five years. Notification may be delayed if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation or as necessary to determine the scope of the breach and restore the reasonable integrity of the information system. Notification must be made after the law enforcement agency determines that disclosure of the breach will no longer interfere with the investigation. Notice may be provided by any of the following methods: Written notice Electronic notice if the information collector s primary method of communication with the resident is by electronic means or if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C et seq. Data Breach Charts current as of December 31, 2015 Page 5

6 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If the cost of providing notice would exceed $150,000, or the affected class of residents to be notified exceeds 300,000, or the information collector does not have sufficient contact information to provide notice, substitute notice shall consistent of: electronic mail if the information collector has an electronic mail address for the state resident; conspicuously posting the disclosure on the Internet website of the information collector if the information collector maintains an Internet website; and Notification to major statewide media. If more 1,000 state residents are affected, consumer credit reporting agencies shall also be notified of the security breach. Governmental agencies are liable to the state for a civil penalty up to $500 for each state resident who was not notified, not to exceed $50,000. The Department of Administration may enforce this section against a governmental agency. For Non-governmental information collectors who violate AS , the violation is an unfair or deceptive act or practice under AS However, the information collector is not subject to the civil penalties imposed under AS but is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS , except that the total civil penalty may not exceed $50,000; and damages that may be awarded against the information collector under AS are limited to actual economic damages that do not exceed $500. A waiver of the notification requirement is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 6

7 ARIZONA: Ariz. Rev. Stat Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice A person that conducts business in Arizona and that owns or licenses or unencrypted computerized data or that includes personal information of Arizona residents; a person that maintains computerized data that includes personal information about Arizona residents that the individual or the commercial entity does not own or license. Means an unauthorized acquisition of and access to unencrypted or unredacted computerized data that materially compromises the security or confidentiality of personal information maintained by a person as part of a database of personal information regarding multiple individuals and that causes or is reasonably likely to cause substantial economic loss to an individual. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when the data element is not encrypted, redacted or secured by any other method rendering the element unreadable or unusable: The individual s social security number. The individual s number on a driver license or identification license. The individual s financial account number or credit or debit card number in combination with any required security code, access code or password that would permit access to the individual s financial account. The statute only applies to computerized data containing personal information that is not encrypted or redacted. When a person becomes aware of an incident of unauthorized acquisition and access to unencrypted or unredacted computerized data that includes an individual s personal information, the person shall conduct a reasonable investigation to promptly determine if there has been a breach of the security system. If the investigation results in a determination that there has been a breach in the security system, the person shall notify the individuals affected. The notice shall be made in the most expedient manner possible and without unreasonable delay subject to the needs of law enforcement and any measures necessary to determine the nature and scope of the breach, to identify the individuals affected or to restore the reasonable integrity of the data system. A person that maintains unencrypted computerized data that includes personal information that the person does not own shall notify and cooperate with the owner or the licensee of the information of any breach of the security of the system following discovery of the breach without unreasonable delay. Cooperation shall include sharing information relevant to the breach of the security of the system with the owner or licensee. The person that owns or licenses the computerized data shall provide notice to the individual. The person that maintained the data under an agreement with the owner or licensee is not required to provide notice to the individual unless the agreement stipulates otherwise. Notification is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers. The notification may be delayed if a law enforcement agency advises the person that the notification will impede a criminal investigation. The person shall make the notification after the law enforcement agency determines that it will not compromise the investigation. The disclosure shall be provided by one of the following methods: Written notice Electronic notice if the person s primary method of communication with the individual is by electronic means or is consistent with the provisions regarding electronic records and signatures set forth in P.L ; 114 Stat. 464; 15 United States Code Section 7001 Telephonic notice Data Breach Charts current as of December 31, 2015 Page 7

8 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If the person can demonstrate that the cost of providing notice would exceed $50,000 or that the affected class of subject individuals to be notified exceeds 100,000 persons, or the person does not have sufficient contact information. Substitute notice shall consist of all of the following: Electronic mail notice if the person has electronic mail addresses for the individuals subject to the notice; Conspicuous posting of the notice on the web site of the person if the person maintains one; and Notification to major statewide media. A person who maintains the person s own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person notifies subject individuals in accordance with the person s policies if a breach of the security system occurs. A person that complies with the notification requirements or security breach procedures pursuant to the rules, regulations, procedures, guidance or guidelines established by the person s primary or functional federal regulator is deemed to be in compliance. Only the attorney general may bring an action to obtain actual damages for a wilful and knowing violation of this section and a civil penalty not to exceed $10,000 per breach of the security of the system or series of breaches of a similar nature that are discovered in a single investigation. Back to top Data Breach Charts current as of December 31, 2015 Page 8

9 ARKANSAS: Ark. Code et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person or business that acquires, owns, or licenses computerized data containing personal information about an Arkansas resident. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business. Means an individual s first name or first initial and his or her last name in combination with any one or more of the following data elements when either the name or the data element is not encrypted or redacted: Social security number; Driver s license number or Arkansas identification card number; Account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual s financial account; and Medical information. The statute only applies to computerized data containing personal information that is not encrypted. Any person or business shall disclose any breach of the security of the system following discovery or notification of the breach to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay. Notification is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers. Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice may be provided by one of the following methods: Written notice Electronic mail notice if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. 7001, as it existed on January 1, 2005 Substitute notice may be given if the person or business can demonstrate that: The cost of providing notice would exceed $250,000; The affected class of persons to be notified exceeds 500,000; or The person or business does not have sufficient contact information. Substitute notice shall consist of all of the following: Electronic mail notice when the person or business has an electronic mail address for the subject persons; Conspicuous posting of the notice on the website of the person or business if the person or business maintains a website; and Notification by statewide media. Data Breach Charts current as of December 31, 2015 Page 9

10 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver A person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies affected persons in accordance with its policies in the event of a breach of the security of the system. The provisions of this chapter do not apply to a person or business that is regulated by a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breaches of the security of personal information than that provided by this chapter. Compliance with the state or federal law shall be deemed compliance with this chapter with regard to the subjects covered by this chapter. Any violation of this chapter is punishable by action of the Attorney General under the provisions of et seq. Any waiver of a provision of the statute is contrary to public policy, void, and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 10

11 CALIFORNIA: Cal. Civ. Code , et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Content Requirements Any person or business that conducts business in California or any state agency and owns, licenses or maintains computerized data that includes personal information about a California resident. A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Means either of the following: An individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: o Social security number. o o Driver s license number or California identification card number. Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. o Medical information. o Health insurance information. o Information or data collected through the use or operation of an automated license plate recognition system. A user name or address, in combination with a password or security question and answer that would permit access to an online account. The statute only applies to computerized data containing personal information that is not encrypted. Encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security. A person or business shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. General: The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the following information: The name and contact information of the reporting person or business. A list of the types of personal information that were or are reasonably believed to have been the subject of a breach. If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice. Whether notification was delayed as a result of a law enforcement investigation, if Data Breach Charts current as of December 31, 2015 Page 11

12 that information is possible to determine at the time the notice is provided. A general description of the breach incident, if that information is possible to determine at the time the notice is provided. The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a driver s license or California identification card number. Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information, specifically an individual s social security number, driver s license number or California identification card number. The information described above must be presented under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. The format of the notice shall be designed to call attention to the nature and significance of the information it contains. The title and headings in the notice shall be clearly and conspicuously displayed. And the text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type. Use of a model security breach notification form set forth in the statute or use of the headings and information described above, written in plain language, will be deemed to be in compliance. Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice" may be provided by one of the following methods: 1. Written notice 2. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code 3. Breach involving personal information for online account and no other personal information: The person or business may provide the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or address and password or security question or answer. 4. Breach involving login credentials of an account: The person or business shall not provide the security breach notification to that address, but may, instead, comply with this section by providing notice by another method described by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account. Substitute notice is permissible if the Entity demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when the Entity has an address for the subject persons. Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web Data Breach Charts current as of December 31, 2015 Page 12

13 Compliance with Notification Requirements site page of the person or business, if the person or business maintains one. Conspicuous posting on the person s or business s Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link. Notification to major statewide media. An Entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements shall be deemed to be in compliance with the notification requirements if it notifies subject persons in accordance with its policies in the event of a breach of security of the system. A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). Notice to Consumer Reporting Agencies Notice to Attorney General Any agency that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. Violations Any customer injured by a violation may institute a civil action to recover damages. Also, any business that violates or proposes to violate may be enjoined. Waiver Back to top Any waiver of a provision of the statute is contrary to public policy and is void and unenforceable. Data Breach Charts current as of December 31, 2015 Page 13

14 COLORADO: Colo. Rev. Stat Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice An individual or a commercial entity that conducts business in Colorado and that owns or licenses computerized data that includes personal information about a resident of Colorado; an individual or a commercial entity that maintains computerized data that includes personal information about a resident of Colorado that the individual or the commercial entity does not own or license. Means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or commercial entity. Means a Colorado resident s first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable: Social security number; Driver s license number or identification card number; Account number or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to a resident s financial account. The statute only applies to computerized data containing personal information that is not encrypted. An individual or a commercial entity shall, when it becomes aware of a breach of the security of the system, conduct in good faith a prompt investigation to determine the likelihood that personal information has been or will be misused. The individual or the commercial entity shall give notice as soon as possible to the affected Colorado residents. Notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system immediately following discovery of a breach, if misuse of personal information about a Colorado resident occurred or is likely to occur. Cooperation includes sharing with the owner or licensee information relevant to the breach; except that such cooperation shall not be deemed to require the disclosure of confidential business information or trade secrets. Notification is not required if the investigation determines that the misuse of information about a Colorado resident has not occurred and is not reasonably likely to occur. Notice may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation and the law enforcement agency has notified the individual or commercial entity that conducts business in Colorado not to send notice. Notice shall be made in good faith, without unreasonable delay, and as soon as possible after the law enforcement agency determines that notification will no longer impede the investigation and has notified the individual or commercial entity that conducts business in Colorado that it is appropriate to send the notice. Notice may be made by: Written notice Telephonic notice Electronic notice, if a primary means of communication by the individual or commercial entity with a Colorado resident is by electronic means or the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. sec et seq. Data Breach Charts current as of December 31, 2015 Page 14

15 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If the entity can demonstrate that the cost of providing notice will exceed $250,000, the affected class of persons to be notified exceeds 250,000 Colorado residents, or the individual or the commercial entity does not have sufficient contact information to provide notice. Substitute notice consists of all of the following: notice if the individual or the commercial entity has addresses for the members of the affected class of Colorado residents; Conspicuous posting of the notice on the web site page of the individual or the commercial entity if the individual or the commercial entity maintains one; and Notification to major statewide media. An individual or commercial entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information and whose procedures are otherwise consistent with the timing requirements shall be deemed to be in compliance with the notice requirements if the individual or commercial entity notifies affected Colorado customers in accordance with its policies in the event of a breach of security of the system. An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance. If an individual or commercial entity is required to notify more than one thousand Colorado residents of a breach of the security of the system, the individual or commercial entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. sec. 1681a (p), of the anticipated date of the notification to the residents and the approximate number of residents who are to be notified. The attorney general may bring an action in law or equity to address violations and for other relief that may be appropriate to ensure compliance or to recover direct economic damages resulting from a violation, or both. The provisions are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law. Back to top Data Breach Charts current as of December 31, 2015 Page 15

16 CONNECTICUT: Conn. Gen Stat. 36a-701b Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Content Requirements Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person who conducts business in Connecticut, and who, in the ordinary course of such person s business, owns, licenses or maintains computerized data that includes personal information. Means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Means an individual s first name or first initial and last name in combination with any one, or more, of the following data: Social Security number; driver s license number or state identification card number; or account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual s financial account. The statute only applies to electronic files, media, databases or computerized data containing personal information that has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Notification of any breach of security is required following the discovery of the breach to any resident of the state whose personal information was breached or is reasonably believed to have been breached. Such notice shall be made without unreasonable delay but not later than ninety days after the discovery of such breach, unless a shorter time is required under federal law. Each resident whose personal information was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services. Such service or services shall be provided at no cost to such resident for a period of not less than twelve months. Such person shall provide all information necessary for such resident to enroll in such service or services and shall include information on how such resident can place a credit freeze on such resident's credit file. Such notification shall not be required if, after an appropriate investigation and consultation with relevant federal, state and local agencies responsible for law enforcement, the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired and accessed. Any notification shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after such law enforcement agency determines that notification will not compromise the criminal investigation and so notifies the person of such determination. Notice of the breach of security may be provided by one of the following methods: Written notice; Telephone notice; or Electronic notice, provided such notice is consistent with the provisions regarding electronic records and signatures set forth in 15 USC Substitute notice may be provided if a person demonstrates that the cost of providing notice would $250,000, that the affected class of subject persons to be notified exceeds 500,000 persons or that the person does not have sufficient contact information. Substitute notice shall consist of the following: Electronic mail notice when the person has an electronic mail address for the affected persons; conspicuous posting of the notice on the web site of the person if the person maintains one; and Data Breach Charts current as of December 31, 2015 Page 16

17 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver notification to major state-wide media, including newspapers, radio and television. Any person that maintains such person s own security breach procedures as part of an information security policy for the treatment of personal information and otherwise complies with the timing requirements, shall be deemed to be in compliance with the security breach notification requirements, provided such person notifies, as applicable, residents of this state, owners and licensees in accordance with such person s policies in the event of a breach of security and in the case of notice to a resident, such person also notifies the Attorney General not later than the time when notice is provided to the resident. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements, provided (1) such person notifies, as applicable, such residents of CT, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of CT and also notifies the Attorney General not later than the time when notice is provided to the resident. Notice of the breach of security shall be provided to the Attorney General not later than the time when notice is provided to the resident. Failure to comply with the requirements of the statute shall constitute an unfair trade practice for purposes of Section b and shall be enforced by the Attorney General. Back to top Data Breach Charts current as of December 31, 2015 Page 17

18 DELAWARE: Del. Code tit. 6, 12B-101 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice An individual or a commercial entity that conducts business in Delaware and that owns or licenses computerized data that includes personal information about a resident of Delaware; an individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license. Means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or a commercial entity. Means a Delaware resident s first name or first initial and last name in combination with any 1 or more of the following data elements that relate to the resident, when either the name or the data elements are not encrypted: Social Security number; Driver s license number or Delaware Identification Card number; or Account number, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident s financial account. The statute only applies to computerized data containing personal information that is not encrypted. When an individual or commercial entity becomes aware of a breach of the security of the system, it shall give notice as soon as possible to the affected Delaware resident. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system immediately following discovery of a breach, if misuse of personal information about a Delaware resident occurred or is reasonably likely to occur. Cooperation includes sharing with the owner or licensee information relevant to the breach Notification is not required if a good faith, reasonable and prompt investigation determines that there no reasonable likelihood that personal information has been or will be misused. Notice required may be delayed if a law-enforcement agency determines that the notice will impede a criminal investigation. Notice must be made in good faith, without unreasonable delay and as soon as possible after the law-enforcement agency determines that notification will no longer impede the investigation. Notice may be made by the following methods: Written notice; Telephonic notice; or Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 7001 of Title 15 of the United States Code. Substitute notice may be given if the individual or the commercial entity demonstrates that the cost of providing notice will exceed $75,000, or that the affected class of Delaware residents to be notified exceeds 100,000 residents, or that the individual or the commercial entity does not have sufficient contact information to provide notice. Substitute notice consists of all of the following: notice if the individual or the commercial entity has addresses for the members of the affected class of Delaware residents; and Conspicuous posting of the notice on the web site page of the individual or the commercial entity if the individual or the commercial entity maintains one; and Data Breach Charts current as of December 31, 2015 Page 18

19 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Notice to major statewide media. An individual or a commercial entity that maintains its own notice procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements is deemed to be in compliance with the notice requirements if the individual or the commercial entity notifies affected Delaware residents in accordance with its policies in the event of a breach of security of the system. An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance if the individual or the commercial entity notifies affected Delaware residents in accordance with the maintained procedures when a breach occurs. The Attorney General may bring an action in law or equity to address violations and for other relief that may be appropriate to ensure proper compliance or to recover direct economic damages resulting from a violation, or both. The provisions are not exclusive and do not relieve an individual or a commercial entity from compliance with all other applicable provisions of law. Back to top Data Breach Charts current as of December 31, 2015 Page 19

20 FLORIDA: Florida Information Protection Act of 2014 (FIPA), Fla. Stat Persons Covered Definition of Security Breach Definition of Customer Records Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Covered entity means a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information. For purposes of the notice requirements, the term includes a governmental entity. Means unauthorized access of data in electronic form containing personal information. Data in electronic form means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices. Means any material, regardless of the physical form, on which personal information is recorded or preserved by any means, including, but not limited to, written or spoken words, graphically depicted, printed, or electromagnetically transmitted that are provided by an individual in this state to a covered entity for the purpose of purchasing or leasing a product or obtaining a service. Means either of the following: An individual s first name or first initial and last name in combination with any one or more of the following data elements for that individual: o o o o o social security number; driver license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity; financial account number or credit or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual s financial account; any information regarding an individual s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or an individual s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual. A user name or address, in combination with a password or security question and answer that would permit access to an online account. A covered entity shall give notice to each individual in Florida whose personal information was, or the covered entity reasonably believes to have been, accessed as a result of the breach. Notice to individuals shall be made as expeditiously as practicable and without unreasonable delay, taking into account the time necessary to allow the covered entity to determine the scope of the breach of security, to identify individuals affected by the breach, and to restore the reasonable integrity of the data system that was breached, but no later than 30 days after the determination of a breach or reason to believe a breach occurred unless. In the event of a breach of security of a system maintained by a third-party agent, such third-party agent shall notify the covered entity of the breach of security as expeditiously as practicable, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred. Upon receiving notice from a third-party agent, a covered entity shall provide required notice. A third-party agent shall provide a covered entity with all information that the covered entity needs to comply with its notice requirements. An agent may provide the required notice on behalf of the covered entity; however, an agent s failure to provide proper notice shall be deemed a violation of this section against the covered entity. Data Breach Charts current as of December 31, 2015 Page 20

21 Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Notice to the affected individuals is not required if, after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm to the individuals whose personal information has been accessed. Such a determination must be documented in writing and maintained for at least 5 years. The covered entity shall provide the written determination to the Department of Legal Affairs within 30 days after the determination. If a federal, state, or local law enforcement agency determines that notice to individuals would interfere with a criminal investigation, the notice shall be delayed upon the written request of the law enforcement agency for a specified period that the law enforcement agency determines is reasonably necessary. A law enforcement agency may, by a subsequent written request, revoke such delay as of a specified date or extend the period set forth in the original request to a specified date if further delay is necessary. The notice to an affected individual shall be by one of the following methods: Written notice sent to the mailing address of the individual in the records of the covered entity; or notice sent to the address of the individual in the records of the covered entity. The notice to an individual with respect to a breach of security shall include, at a minimum: The date, estimated date, or estimated date range of the breach of security. A description of the personal information that was accessed or reasonably believed to have been accessed as a part of the breach of security. Substitute notice in lieu of direct notice may be used if such direct notice is not feasible because the cost of providing notice would exceed $250,000, because the affected individuals exceed 500,000 persons, or because the covered entity does not have an address or mailing address for the affected individuals. Such substitute notice shall include the following: A conspicuous notice on the Internet website of the covered entity if the covered entity maintains a website; and Notice in print and to broadcast media, including major media in urban and rural areas where the affected individuals reside. Notice provided pursuant to rules, regulations, procedures, or guidelines established by the covered entity s primary or functional federal regulator is deemed to be in compliance with the notice requirement if the covered entity notifies affected individuals in accordance with the rules, regulations, procedures, or guidelines established by the primary or functional federal regulator in the event of a breach of security. A covered entity that timely provides a copy of such notice to the Department of Legal Affairs is deemed to be in compliance with the notice requirement. If a covered entity is required to provide notice to more than 1,000 individuals at a single time, the covered entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notices. A violation shall be treated as an unfair or deceptive trade practice in any action brought by the Department of Legal Affairs under against a covered entity or third-party agent. Additionally, a covered entity that violates the notice requirements shall be liable for a civil penalty not to exceed $500,000, as follows: In the amount of $1,000 for each day up to the first 30 days following any violation of the notice requirements and, thereafter, $50,000 for each subsequent 30-day period or portion thereof for up to 180 days. Data Breach Charts current as of December 31, 2015 Page 21

22 Waiver Other: Requirements For Data Security Notice to Dept. of Legal Affairs Annual Report If the violation continues for more than 180 days, in an amount not to exceed $500,000. The civil penalties for failure to notify apply per breach and not per individual affected by the breach. All penalties collected pursuant to this subsection shall be deposited into the General Revenue Fund. There is no private cause of action. Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information. A covered entity shall provide notice to the department of any breach of security affecting 500 or more individuals in Florida. Such notice must be provided to the department as expeditiously as practicable, but no later than 30 days after the determination of the breach or reason to believe a breach occurred. A covered entity may receive 15 additional days to provide notice to affected individuals if good cause for delay is provided in writing to the department within 30 days after determination of the breach or reason to believe a breach occurred. The written notice to the department must include: A synopsis of the events surrounding the breach at the time notice is provided. The number of individuals in this state who were or potentially have been affected by the breach. Any services related to the breach being offered or scheduled to be offered, without charge, by the covered entity to individuals, and instructions as to how to use such services. A copy of the notice required under subsection (4) or an explanation of the other actions taken pursuant to subsection (4). The name, address, telephone number, and address of the employee or agent of the covered entity from whom additional information may be obtained about the breach. The covered entity must provide the following information to the department upon its request: A police report, incident report, or computer forensics report. A copy of the policies in place regarding breaches. Steps that have been taken to rectify the breach. A covered entity may provide the department with supplemental information regarding a breach at any time. For a covered entity that is the judicial branch, the Executive Office of the Governor, the Department of Financial Services, or the Department of Agriculture and Consumer Services, in lieu of providing the written notice to the department, the covered entity may post the required notice information on an agency-managed website. By February 1 of each year, the Department of Legal Affairs shall submit a report to the President of the Senate and the Speaker of the House of Representatives describing the nature of any reported breaches of security by governmental entities or third-party agents of governmental entities in the preceding calendar year along with recommendations for security improvements. The report shall identify any governmental entity that has violated any of the applicable notice requirements in the preceding calendar year. Back to top Data Breach Charts current as of December 31, 2015 Page 22

23 GEORGIA: Ga. Code Persons Covered Definition of Security Breach Definition of Personal Information Definition of Data Collector Definition of Information Broker Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Any information broker or data collector that maintains computerized data that includes personal information of Georgia residents; any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of Georgia residents that the person or business does not own. Means unauthorized acquisition of an individual s electronic data that compromises the security, confidentiality, or integrity of personal information of such individual maintained by an information broker or data collector. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: Social security number; Driver s license number or state identification card number; Account number, credit card number, or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes, or passwords; Account passwords or personal identification numbers or other access codes; or Any of the items listed above when not in connection with the individual s first name or first initial and last name, if the information compromised would be sufficient to perform or attempt to perform identity theft against the person whose information was compromised. Means any state or local agency or subdivision thereof including any department, bureau, authority, public university or college, academy, commission, or other government entity; provided, however, that the term data collector shall not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes or for purposes of providing public access to court records or to real or personal property information. Means any person or entity who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring, or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated third parties, but does not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes. The statute only applies to computerized data containing personal information that is not encrypted. Notice shall be made of any breach of the security of the system following discovery or notification of the breach in the security of the data to any Georgia resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of individuals that the person or business does not own shall notify the information broker or data collector of any breach of the security of the system within 24 hours following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The notification may be delayed if a law enforcement agency determines that the notification will compromise a criminal investigation. The notification required by this Code section shall be made after the law enforcement agency determines that it will not compromise the investigation. Data Breach Charts current as of December 31, 2015 Page 23

24 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Notice may be made by the following methods: Written notice; Telephone notice; or Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code. Substitute notice may be given if the information broker or data collector demonstrates that the cost of providing notice would exceed $50,000.00, that the affected class of individuals to be notified exceeds 100,000, or that the information broker or data collector does not have sufficient contact information to provide written or electronic notice to such individuals. Substitute notice shall consist of all of the following: notice, if the information broker or data collector has an address for the individuals to be notified; Conspicuous posting of the notice on the information broker s or data collector s website page, if the information broker or data collector maintains one; and Notification to major state-wide media. An information broker or data collector that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute shall be deemed to be in compliance with the notification requirements if it notifies the individuals who are the subjects of the notice in accordance with its policies in the event of a breach of the security of the system. In the event that an information broker or data collector discovers circumstances requiring notification of more than 10,000 residents of Georgia at one time, the information broker or data collector shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nation-wide basis, as defined by 15 U.S.C. Section 1681a, of the timing, distribution, and content of the notices. Back to top Data Breach Charts current as of December 31, 2015 Page 24

25 HAWAII: Haw. Rev. Stat. 487N-1 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Any business that owns or licenses personal information of residents of Hawaii; any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise); or any government agency that collects personal information for specific government purposes; any business located in Hawaii or any business that conducts business in Hawaii that maintains or possesses records or data containing personal information of residents of Hawaii that the business does not own or license, or any government agency that maintains or possesses records or data containing personal information of residents of Hawaii. Means an incident of unauthorized access to and acquisition of unencrypted or unredacted records or data containing personal information where illegal use of the personal information has occurred, or is reasonably likely to occur and that creates a risk of harm to a person. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key constitutes a security breach. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: Social security number; Driver s license number or Hawaii identification card number; or Account number, credit or debit card number, access code, or password that would permit access to an individual s financial account. The statute only applies to disclosure of personal information, in any form, that is not encrypted or redacted. A business or agency shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach. The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system. Any business located in Hawaii or any business that conducts business in Hawaii that maintains or possesses records or data containing personal information of residents of Hawaii that the business does not own or license, or any government agency that maintains or possesses records or data containing personal information of residents of Hawaii shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement. Notification is not required if the business or agency determines that there has been no illegal use of personal information, nor is it reasonably likely to occur. The notice shall be delayed if a law enforcement agency informs the business or government agency that notification may impede a criminal investigation or jeopardize national security and requests a delay; provided that such request is made in writing, or the business or government agency documents the request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer s law enforcement agency engaged in the investigation. The notice shall be provided without unreasonable delay after the law enforcement agency communicates to the business or government agency its determination that notice will no longer impede the investigation or jeopardize national security. Data Breach Charts current as of December 31, 2015 Page 25

26 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General The notice shall be clear and conspicuous. The notice shall include a description of the following: The incident in general terms; The type of personal information that was subject to the unauthorized access and acquisition; The general acts of the business or government agency to protect the personal information from further unauthorized access; A telephone number that the person may call for further information and assistance, if one exists; and Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports. Notice to affected persons may be provided by one of the following methods: Written notice to the last available address the business or government agency has on record; Electronic mail notice, for those persons for whom a business or government agency has a valid electronic mail address and who have agreed to receive communications electronically if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing set forth in 15 U.S.C. Section 7001; or Telephonic notice, provided that contact is made directly with the affected persons. Substitute notice may be given if the business or government agency demonstrates that the cost of providing notice would exceed $100,000 or that the affected class of subject persons to be notified exceeds 200,000, or if the business or government agency does not have sufficient contact information or consent, for only those affected persons without sufficient contact information or consent, or if the business or government agency is unable to identify particular affected persons, for only those unidentifiable affected persons. Substitute notice shall consist of all the following: Electronic mail notice when the business or government agency has an electronic mail address for the subject persons; Conspicuous posting of the notice on the website page of the business or government agency, if one is maintained; and Notification to major statewide media. The following businesses shall be deemed to be in compliance with this section: A financial institution that is subject to the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice published in the Federal Register on March 29, 2005, by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision, or subject to 12 C.F.R. Part 748, and any revisions, additions, or substitutions relating to the interagency guidance; and Any health plan or healthcare provider that is subject to and in compliance with the standards for privacy or individually identifiable health information and the security standards for the protection of electronic health information of the Health Insurance Portability and Accountability Act of In the event a business provides notice to more than 1,000 persons at one time pursuant to this section, the business shall notify in writing, without unreasonable delay, the State of Hawaii s office of consumer protection and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice. Data Breach Charts current as of December 31, 2015 Page 26

27 Violations Waiver Any business that violates any provision of the statute shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency. Additionally, any business that violates any provision of the statute shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court may award reasonable attorneys fees to the prevailing party. No such action may be brought against a government agency. The penalties shall be cumulative to the remedies or penalties available under all other laws of the State of Hawaii. Any waiver of the provisions is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 27

28 IDAHO: Idaho Stat to -107 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice A city, county or state agency, individual or a commercial entity that conducts business in Idaho and that owns or licenses computerized data that includes personal information about a resident of Idaho; an agency, individual or a commercial entity that maintains computerized data that includes personal information that the agency, individual or the commercial entity does not own or license. Means the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information for one or more persons maintained by an agency, individual or a commercial entity. Means an Idaho resident s first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident, when either the name or the data elements are not encrypted: Social security number; Driver s license number or Idaho identification card number; or Account number, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident s financial account. The statute only applies to unencrypted computerized data containing personal information. If an investigation determines that the misuse of information about an Idaho resident has occurred or is reasonably likely to occur, the agency, individual or commercial entity shall give notice as soon as possible to the affected Idaho resident. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach, to identify the individuals affected, and to restore the reasonable integrity of the computerized data system. An agency, individual or a commercial entity that maintains computerized data that includes personal information that the agency, individual or the commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system immediately following discovery of a breach, if misuse of personal information about an Idaho resident occurred or is reasonably likely to occur. Cooperation includes sharing with the owner or licensee information relevant to the breach. Notification is required, if after a good faith, reasonable and prompt investigation, the entity determines that the breach has materially compromised the security, confidentiality, or integrity of the personal information of one or more Idaho residents and misuse of the information has occurred or is reasonably likely to occur. Notice may be delayed if a law enforcement agency advises the agency, individual or commercial entity that the notice will impede a criminal investigation. Notice must be made in good faith, without unreasonable delay and as soon as possible after the law enforcement agency advises the agency, individual or commercial entity that notification will no longer impede the investigation. Notice may be made by the following methods: Written notice to the most recent address the agency, individual or commercial entity has in its records; Telephonic notice; or Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C Data Breach Charts current as of December 31, 2015 Page 28

29 Substitute Notice Compliance with Notification Requirements Substitute notice made be given if the agency, individual or the commercial entity required to provide notice demonstrates that the cost of providing notice will exceed $25,000, or that the number of Idaho residents to be notified exceeds 50,000, or that the agency, individual or the commercial entity does not have sufficient contact information to provide notice. Substitute notice consists of all of the following: notice if the agency, individual or the commercial entity has addresses for the affected Idaho residents; and Conspicuous posting of the notice on the website page of the agency, individual or the commercial entity if the agency, individual or the commercial entity maintains one; and Notice to major statewide media. An agency, individual or a commercial entity that maintains its own notice procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of Section , Idaho Code, is deemed to be in compliance with the notice requirements of Section , Idaho Code, if the agency, individual or the commercial entity notifies affected Idaho residents in accordance with its policies in the event of a breach of security of the system. An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with Section , Idaho Code, if the individual or the commercial entity complies with the maintained procedures when a breach of the security of the system occurs. Notice to Consumer Reporting Agencies Notice to Attorney General When an agency becomes aware of a breach of the security of the system, it shall, within 24 hours of such discovery, notify the office of the Idaho attorney general. A state agency must also report a security breach to the office of the chief information officer within the department of administration, pursuant to the information technology resource management council policies. Violations Any governmental employee that intentionally discloses personal information not subject to disclosure otherwise allowed by law, is guilty of a misdemeanor and, upon conviction thereof, shall be punished by a fine of not more than $2,000, or by imprisonment in the county jail for a period of not more than one year, or both. Waiver Back to top In any case in which an agency s, commercial entity s or individual s primary regulator has reason to believe that an agency, individual or commercial entity has failed to give notice, the primary regulator may bring a civil action to enforce compliance and enjoin that agency, individual or commercial entity from further violations. Any agency, individual or commercial entity that intentionally fails to give notice shall be subject to a fine of not more than $25,000 per breach of the security of the system. Data Breach Charts current as of December 31, 2015 Page 29

30 ILLINOIS: 815 ILCS 530/1 to 530/25 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: Social Security number. Driver s license number or State identification card number. Account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to computerized data containing personal information that is not encrypted or redacted. Notification shall be made following the discovery or notification of the breach. The disclosure notification shall be made in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Any data collector that maintains or stores, but does not own or license, computerized data that includes personal information that the data collector does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. In addition to providing such notification to the owner or licensee, the data collector shall cooperate with the owner or licensee in matters relating to the breach. That cooperation shall include, but need not be limited to: informing the owner or licensee of the breach, including giving notice of the date or approximate date of the breach and the nature of the breach, and informing the owner or licensee of any steps the data collector has taken or plans to take relating to the breach. The notification to an Illinois resident may be delayed if an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the data collector with a written request for the delay. However, the data collector must notify the Illinois resident as soon as notification will no longer interfere with the investigation. The disclosure notification to an Illinois resident shall include, but need not be limited to: the toll-free numbers and addresses for consumer reporting agencies, the toll-free number, address, and website address for the Federal Trade Commission, and a statement that the individual can obtain information from these sources about fraud alerts and security freezes. Notice to consumers may be provided by one of the following methods: written notice; electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing as set forth in Section 7001 of Title 15 of the United States Code. Data Breach Charts current as of December 31, 2015 Page 30

31 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Other: Notice to General Assembly & Annual Reporting Substitute notice may be used if the data collector demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds 500,000, or the data collector does not have sufficient contact information. Substitute notice shall consist of all of the following: notice if the data collector has an address for the subject persons; conspicuous posting of the notice on the data collector s web site page if the data collector maintains one; and notification to major statewide media. A data collector that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute, shall be deemed in compliance with the notification requirements if the data collector notifies subject persons in accordance with its policies in the event of a breach of the security of the system data. If a State agency is required to notify more than 1,000 persons of a breach of security, the State agency shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notices. A violation of the statute constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Any person who violates the statute is subject to a civil penalty of not more than $100 for each individual with respect to whom personal information is disposed of in violation of the statute. A civil penalty may not exceed $50,000 for each instance of improper disposal of materials containing personal information. The Attorney General may impose a civil penalty after notice to the person accused of violating the statute and an opportunity for that person to be heard in the matter. The Attorney General may file a civil action in the circuit court to recover any penalty imposed. The Attorney General may also bring an action in the circuit court to remedy a violation of the statute, seeking any appropriate relief. Any waiver of the provisions of the statute is contrary to public policy and is void and unenforceable. Any State agency that collects personal data and has had a breach of security of the system data or written material shall submit a report within 5 business days of the discovery or notification of the breach to the General Assembly listing the breaches and outlining any corrective measures that have been taken to prevent future breaches of the security of the system data or written material. Any State agency that has submitted a report shall submit an annual report listing all breaches of security of the system data or written materials and the corrective measures that have been taken to prevent future breaches. Back to top Data Breach Charts current as of December 31, 2015 Page 31

32 INDIANA: Ind. Code et seq., et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Any person, business or state agency that owns or licenses computerized data that includes personal information of an Indiana resident. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person. The term includes the unauthorized acquisition of computerized data that have been transferred to another medium, including paper, microfilm, or a similar medium, even if the transferred data are no longer in a computerized format. For State Agencies: Personal Information means: (1) an individual s: first name and last name; or first initial and last name; and (2) at least one of the following data elements: Social Security number Driver s license number or identification card number Account number, credit card number, debit card number, security code, access code, or password of an individual s financial account. For Persons/Businesses: Personal Information means: (1) a Social Security number that is not encrypted or redacted; or (2) an individual s first and last names, or first initial and last name, and one or more of the following data elements that are not encrypted or redacted: A driver s license number. A state identification card number. A credit card number. A financial account number or debit card number in combination with a security code, password, or access code that would permit access to the person s account. The statute only applies to computerized data, containing personal information that is not encrypted, redacted or secured by another method that renders the data unreadable or unusable. The statute also applies to computerized data that has been transferred to another medium, including paper, microfilm, or a similar medium, even if the transferred data are no longer in a computerized format. For State Agencies: Any state agency shall disclose a breach of the security of the system following discovery or notification of the breach to any state resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. The disclosure of a breach of the security of the system shall be made without unreasonable delay; and consistent with the legitimate needs of law enforcement, and any measures necessary to determine the scope of the breach, and restore the reasonable integrity of the data system. For Persons/Businesses: After discovering or being notified of a breach of the security of data, the data base owner shall disclose the breach to an affected Indiana resident, if the data base owner knows, should know, or should have known that the unauthorized acquisition constituting the breach has resulted in or could result in identity deception, identity theft, or fraud affecting the Indiana resident. A person that maintains computerized data but that is not a data base owner shall notify the data base owner if the person discovers that personal information was or may have been acquired by an unauthorized person. Notification is required if the data base owner knows, should know, or should have known that the unauthorized acquisition constituting the breach has resulted in or could result in identity deception (as defined in IC ), identity theft, or fraud affecting the Indiana resident. Data Breach Charts current as of December 31, 2015 Page 32

33 Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Attorney General Notice to Consumer Reporting Agencies Violations Waiver For State Agencies: The notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation; and the notice shall be made after the law enforcement agency determines that it will not compromise the investigation. For Persons/Businesses: The notification may be delayed if the attorney general or a law enforcement agency determines that the notification will impede a criminal or civil investigation or jeopardize national security, to restore the integrity of the computer system, or to discover the scope of the breach. Notification shall be made after the attorney general or law enforcement agency determines that it will not compromise the investigation or jeopardize national security. For State Agencies: A state agency may provide the notice: in writing; or electronic mail, if the individual has provided the state agency with the individual s electronic mail address. For Persons/Businesses: A data base owner required to make a disclosure shall make the disclosure using one of the following methods: Mail; Telephone; Facsimile; or Electronic mail, if the data base owner has the electronic mail address of the affected Indiana resident. A data base owner or state agency that demonstrates that it is required to make the disclosure to more than 500,000 Indiana residents, or that the cost of the disclosure will be more than $250,000, may elect to make the disclosure by using both of the following methods: Conspicuous posting of the notice on the web site of the data base owner or state agency, if the data base owner or state agency maintains a web site; and Notice to major news reporting media in the geographic area where Indiana residents affected by the breach of the security of a system reside. For Persons/Businesses: A data base owner that maintains its own disclosure procedures as part of an information privacy policy or a security policy is not required to make a separate disclosure if the data base owner s information privacy policy or security policy is at least as stringent as the disclosure requirements described in the statute. If a data base owner makes a disclosure, the data base owner shall also disclose the breach to the attorney general. If a state agency is required to provide notice to more than 1,000 individuals, the state agency shall notify without unreasonable delay all consumer reporting agencies (as defined in 15 U.S.C. 1681a) of the distribution and content of the notice. A person that knowingly or intentionally fails to comply with any provision of the statute commits a deceptive act that is actionable only by the attorney general. The attorney general may bring an action to obtain any or all of the following: An injunction to enjoin future violations of IC A civil penalty of not more than $150,000 per deceptive act. The attorney general s reasonable costs in the investigation of the deceptive act and maintaining the action. Back to top Data Breach Charts current as of December 31, 2015 Page 33

34 IOWA: Iowa Code 715C.1, 715C.2 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice An individual; corporation; business trust; estate; trust; partnership; limited liability company; association; joint venture; government; governmental subdivision, agency, or instrumentality; public corporation; or any other legal or commercial entity that maintains computerized data of an Iowa resident. Means unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information Means an individual s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable: Social security number. Driver s license number or other unique identification number created or collected by a government body. Financial account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual s financial account. Unique electronic identifier or routing code, in combination with any required security code, access code, or password that would permit access to an individual s financial account. Unique biometric data, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data. The statute only applies to computerized data elements containing personal information that is not encrypted or redacted data or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable. A person shall give notice of the breach of security following discovery of such breach of security, or receipt of notification, to any consumer whose personal information was included in the information that was breached. The consumer notification shall be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, and consistent with any measures necessary to sufficiently determine contact information for the affected consumers, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data. Any person who maintains or otherwise possesses personal information on behalf of another person shall notify the owner or licensor of the information of any breach of security immediately following discovery of such breach of security if a consumer s personal information was included in the information that was breached. Notification is not required if, after an appropriate investigation or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determined that no reasonable likelihood of financial harm to the consumers whose personal information has been acquired has resulted or will result from the breach. Such a determination must be documented in writing and the documentation must be maintained for five years. The consumer notification requirements may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation and the agency has made a written request that the notification be delayed. The notification shall be made after the law enforcement agency determines that the notification will not compromise the investigation and notifies the person required to give notice in writing. Notification to the consumer may be provided by one of the following methods: Written notice to the last available address the person has in the person s records. Electronic notice if the person s customary method of communication with the consumer is by electronic means or is consistent with the provisions regarding Data Breach Charts current as of December 31, 2015 Page 34

35 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver electronic records and signatures set forth in chapter 554D and the federal Electronic Signatures in Global and National Commerce Act, 15 U.S.C Substitute notice, if the person demonstrates that the cost of providing notice would exceed $250,000, that the affected class of consumers to be notified exceeds 350,000 persons, or if the person does not have sufficient contact information to provide notice. Substitute notice shall consist of the following: Electronic mail notice when the person has an electronic mail address for the affected consumers. Conspicuous posting of the notice or a link to the notice on the internet site of the person if the person maintains an internet site. Notification to major statewide media. Substitute notice shall include, at a minimum, all of the following: A description of the breach of security. The approximate date of the breach of security. The type of personal information obtained as a result of the breach of security. Contact information for consumer reporting agencies. Advice to the consumer to report suspected incidents of identity theft to local law enforcement or the attorney general. The statute does not apply to a person who complies with notification requirements or breach of security procedures that provide greater protection to personal information and at least as thorough disclosure requirements than that provided by the statute pursuant to the rules, regulations, procedures, guidance, or guidelines established by the person s primary or functional federal regulator. The statute does not apply a person who complies with a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breach of security or personal information than that provided by this section. A violation of this chapter is an unlawful practice pursuant to Section and, in addition to the remedies provided to the attorney general pursuant to Section , subsection 7, the attorney general may seek and obtain an order that a party held to violate the statute pay damages to the attorney general on behalf of a person injured by the violation. The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under the law. Back to top Data Breach Charts current as of December 31, 2015 Page 35

36 KANSAS: Kan. Stat. 50-7a01 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any individual, partnership, corporation, trust, estate, cooperative, association, government, or governmental subdivision or agency or other entity that conducts business in Kansas that owns, licenses, or maintains computerized data that includes personal information of a Kansas resident. Means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or a commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer. Means a consumer s first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted: Social security number; driver s license number or state identification card number; or financial account number, or credit or debit card number, alone or in combination with any required security code, access code or password that would permit access to a consumer s financial account. The statute only applies to the disclosure of unencrypted or unredacted records or data that compromises or the agency or nonaffiliated third party reasonably believes may compromise the security, confidentiality, or integrity of personal information and result in the likelihood of harm to one or more individuals. When an individual or a commercial entity becomes aware of any breach of the security of the system, it shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused. If the investigation determines that the misuse of information has occurred or is reasonably likely to occur, the person shall give notice as soon as possible to the affected Kansas resident. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the data following discovery of a breach, if the personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person. If the investigation determines that the misuse of personal information has not occurred and is not likely to occur, notice is not required, but the person shall maintain records that reflect the basis for the decision for a retention period set by the State Archives and Records Commission. The agency shall notify the appropriate entities that the misuse of personal information has not occurred. Notice may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation. Notice shall be made in good faith, without unreasonable delay and as soon as possible after the law enforcement agency determines that notification will no longer impede the investigation. Notice means: Written notice; or electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C Data Breach Charts current as of December 31, 2015 Page 36

37 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Substitute notice may be given if the individual or the commercial entity demonstrates that the cost of providing notice will exceed $100,000, or that the affected class of consumers to be notified exceeds 5,000, or that the individual or the commercial entity does not have sufficient contact information to provide notice. Substitute notice" means: notice if the individual or the commercial entity has addresses for the affected class of consumers; conspicuous posting of the notice on the web site page of the individual or the commercial entity if the individual or the commercial entity maintains a web site; and notification to major statewide media. An individual or a commercial entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of the statute, is deemed to be in compliance with the notice requirements if the individual or the commercial entity notifies affected consumers in accordance with its policies in the event of a breach of security of the system. An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with the statute. In the event that a person discovers circumstances requiring notification pursuant to this section of more than 1,000 consumers at one time, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. 1681a(p), of the timing, distribution and content of the notices. The insurance commissioner shall have the sole authority to enforce the provisions of the statute for violations by an insurance company licensed to do business in Kansas. Back to top Data Breach Charts current as of December 31, 2015 Page 37

38 KENTUCKY: KRS , KRS Persons Covered Definition of Security Breach Definition of Personal Information Notice Procedures/Timing Encryption Safe Harbor Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any agency, person or business entity that conducts business in the Commonwealth of Kentucky. General Breach: Means unauthorized acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of personally identifiable information maintained by the information holder as part of a database regarding multiple individuals that actually causes, or leads the information holder to reasonably believe has caused or will cause, identity theft or fraud against any resident of the Commonwealth of Kentucky. Agency Breach: The unauthorized acquisition, distribution, disclosure, destruction, manipulation, or release of unencrypted or unredacted records or data that compromises or the agency or nonaffiliated third party reasonably believes may compromise the security, confidentiality, or integrity of personal information and result in the likelihood of harm to one or more individuals; or The unauthorized acquisition, distribution, disclosure, destruction, manipulation, or release of encrypted records or data containing personal information along with the confidential process or key to unencrypt the records or data that compromises or the agency or nonaffiliated third party reasonably believes may compromise the security, confidentiality, or integrity of personal information and result in the likelihood of harm to one or more individuals. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when the name or data element is not redacted: Social Security number; Driver s license number; or Account number, credit or debit card number, in combination with any required security code, access code, or password permit access to an individual s financial account. Any information holder shall disclose any breach of the security of the system, following discovery or notification of the breach in the security of the data, to any resident of Kentucky whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any information holder that maintains computerized data that includes personally identifiable information that the information holder does not own shall notify the owner or licensee of the information of any breach of the security of the data as soon as reasonably practicable following discovery, if the personally identifiable information was, or is reasonably believed to have been, acquired by an unauthorized person. The statute only applies to personal information that is neither unencrypted nor redacted. Statute only applies if the breach actually causes, or leads the information holder to reasonably believe it has caused or will cause, identity theft or fraud against any resident of the Commonwealth of Kentucky. The notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification shall be made promptly after the law enforcement agency determines that it will not compromise the investigation. Notice may be provided by one of the following methods: Written notice Data Breach Charts current as of December 31, 2015 Page 38

39 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. sec Substitute notice may be used if the information holder demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the information holder does not have sufficient contact information. Substitute notice shall consist of all of the following: notice, when the information holder has an address for the subject persons; Conspicuous posting of the notice on the information holder s Internet Web site page, if the information holder maintains a Web site page; and Notification to major statewide media. An information holder that maintains its own notification procedures as part of an information security policy for the treatment of personally identifiable information, and is otherwise consistent with the timing requirements of the statute, shall be deemed to be in compliance with the notification requirements, if it notifies subject persons in accordance with its policies in the event of a breach of security of the system. Any agency that determines or is notified of a security breach shall as soon as possible, but within 72 hours of determination or notification of the security breach: Notify the Commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General. In addition, an agency shall notify the Secretary of the Finance and Administration Cabinet or his or her designee if an agency is an organizational unit of the executive branch of state government; notify the Commissioner of the Department for Local Government; notify the Commissioner of the Kentucky Department of Education if the agency is a public school district; and notify the President of the Council on Postsecondary Education if the agency is a public postsecondary educational entity. Notification shall be in writing on a form developed by the Commonwealth Office of Technology. Back to top Data Breach Charts current as of December 31, 2015 Page 39

40 LOUISIANA: La. Rev. Stat. 51:3071 et seq.; La. Admin. Code tit. 16, pt. III, 701 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person that conducts business in Louisiana or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information of a Louisiana resident. Means the compromise of the security, confidentiality, or integrity of computerized data that results in, or there is a reasonable basis to conclude has resulted in, the unauthorized acquisition of and access to personal information maintained by an agency or person. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted: Social security number. Driver s license number. Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to personal information that is neither unencrypted nor redacted. A person or agency shall, following discovery of a breach in the security of the system containing such data, notify any resident of Louisiana whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Any agency or person that maintains computerized data that includes personal information that the agency or person does not own shall notify the owner or licensee of the information if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person through a breach of security of the system containing such data, following discovery by the agency or person of a breach of security of the system. Notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system. Notification is not required if after a reasonable investigation the person or business determines that there is no reasonable likelihood of harm to customers. If a law enforcement agency determines that the notification would impede a criminal investigation, such notification may be delayed until such law enforcement agency determines that the notification will no longer compromise such investigation. Notification may be provided by one of the following methods: Written notification Electronic notification, if the notification provided is consistent with the provisions regarding electronic records and signatures set forth in 15 USC 7001 Substitute notification may be used if an agency or person demonstrates that the cost of providing notification would exceed $250,000, or that the affected class of persons to be notified exceeds 500,000, or the agency or person does not have sufficient contact information. Substitute notification shall consist of all of the following: notification when the agency or person has an address for the subject persons; Conspicuous posting of the notification on the Internet site of the agency or person, if an Internet site is maintained; and Notification to major statewide media. Data Breach Charts current as of December 31, 2015 Page 40

41 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver An agency or person that maintains a notification procedure as part of its information security policy for the treatment of personal information which is otherwise consistent with the timing requirements the statute shall be deemed to be in compliance with the notification requirements if the agency or person notifies subject persons in accordance with the policy and procedure in the event of a breach of security of the system. When notice to Louisiana citizens is required, the person or agency shall provide written notice detailing the breach of the security of the system to the Consumer Protection Section of the Attorney General s Office. Notice shall include the names of all Louisiana citizens affected by the breach. Notice to the attorney general shall be timely if received within 10 days of distribution of notice to Louisiana citizens. A civil action may be instituted to recover actual damages resulting from the failure to disclose in a timely manner to a person that there has been a breach of the security system resulting in the disclosure of a person s personal information. Failure to provide timely notice to the Attorney General s Office may be punishable by a fine not to exceed $5,000 per violation. Each day notice is not received by the attorney general shall be deemed a separate violation. Back to top Data Breach Charts current as of December 31, 2015 Page 41

42 MAINE: Me. Rev. Stat. tit et seq. Persons Covered Definition of Security Breach Definition of Personal Information Definition of Information Broker Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Information Brokers and persons who maintain computerized personal information of Maine residents. Means unauthorized acquisition, release or use of an individual s computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person. Means an individual s first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: Social security number Driver s license number or state identification card number; Account number, credit card number or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes or passwords; Account passwords or personal identification numbers or other access codes; or Any of the data elements above when not in connection with the individual s first name, or first initial, and last name, if the information if compromised would be sufficient to permit a person to fraudulently assume or attempt to assume the identity of the person whose information was compromised. Means a person who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated 3rd parties. "Information broker" does not include a governmental agency whose records are maintained primarily for traffic safety, law enforcement or licensing purposes. The statute only applies to personal information that is neither unencrypted nor redacted. If an information broker that maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the information broker shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State whose personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur. Notice must be made as expediently as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with measures necessary to determine the scope of the security breach and restore the reasonable integrity, security and confidentiality of the data in the system. Notice is not required if the investigation determined that there is no reasonable likelihood that the personal information has been or will be misused. Notification may be delayed for no longer than 7 business days after a law enforcement agency determines that the notification will not compromise a criminal investigation. "Notice" means: Written notice Electronic notice, if the notice provided is consistent with the provisions regarding Data Breach Charts current as of December 31, 2015 Page 42

43 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to State Regulators/Attorney General Violations Waiver electronic records and signatures set forth in 15 United States Code, Section 7001 Substitute notice may be used, if the person maintaining personal information demonstrates that the cost of providing notice would exceed $5,000, that the affected class of individuals to be notified exceeds 1,000 or that the person maintaining personal information does not have sufficient contact information to provide written or electronic notice to those individuals. Substitute notice must consist of all of the following: notice, if the person has addresses for the individuals to be notified; Conspicuous posting of the notice on the person s publicly accessible website, if the person maintains one; and Notification to major statewide media. A person that complies with the security breach notification requirements of rules, regulations, procedures or guidelines established pursuant to federal law or the law of this State is deemed to be in compliance with the requirements of Section 1348 as long as the law, rules, regulations or guidelines provide for notification procedures at least as protective as the notification requirements of Section If a person discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the person shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code, Section 1681a(p). Notification must include the date of the breach, an estimate of the number of persons affected by the breach, if known, and the actual or anticipated date that persons were or will be notified of the breach. When notice of a breach of the security of the system is required, the person shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the person is not regulated by the department, the Attorney General. It is a violation of the statute for an unauthorized person to release or use an individual s personal information acquired through a security breach. Enforcement. The appropriate state regulators within the Department of Professional and Financial Regulation shall enforce this chapter for any person that is licensed or regulated by those regulators. The Attorney General shall enforce this chapter for all other persons. Civil violation. A person that violates this chapter commits a civil violation and is subject to one or more of the following: A fine of not more than $500 per violation, up to a maximum of $2,500 for each day the person is in violation of this chapter, except that this paragraph does not apply to State Government, the University of Maine System, the Maine Community College System or Maine Maritime Academy; Equitable relief; or Enjoinment from further violations of this chapter. Cumulative effect. The rights and remedies available under this section are cumulative and do not affect or prevent rights and remedies available under federal or state law. Back to top Data Breach Charts current as of December 31, 2015 Page 43

44 MARYLAND: Md. Code Com. Law et seq., Md. State Govt. Code to Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis A business that owns or licenses personal information of a Maryland resident. A unit - An executive agency, or a department, a board, a commission, an authority, a public institution of higher education, a unit or an instrumentality of the State of Maryland or a county, municipality, bi-county, regional, or multicounty agency, county board of education, public corporation or authority, or any other political subdivision of the State that collects or maintains personal information of a Maryland resident. Does not apply to the Legislative or Judicial Branch of State government. Means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the personal information maintained by a business or unit. For businesses: Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data elements are not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable: A Social Security number; A driver s license number; A financial account number, including a credit card number or debit card number, that in combination with any required security code, access code, or password, would permit access to an individual s financial account; or An Individual Taxpayer Identification Number For state agencies: Personal information" means an individual s first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more of the following data elements: a Social Security number; a driver s license number, state identification card number, or other individual identification number issued by a unit; a passport number or other identification number issued by the United States government; an Individual Taxpayer Identification Number; or a financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual s account. The statute only applies to personal information that is neither unencrypted nor redacted, or otherwise protected by another method that renders the information unreadable or unusable. When a business or unit discovers or is notified of a breach of the security of a system, it shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information of the individual has been or will be misused as a result of the breach. A business that maintains computerized data that includes personal information that the business does not own or license shall notify the owner or licensee of the personal information of a breach of the security of a system if it is likely that the breach has resulted or will result in the misuse of personal information of an individual residing in the State. The notice shall be given as soon as reasonably practicable after the business conducts the investigation. If the business or unit determines that misuse of the individual s personal information has not occurred nor is reasonably likely to occur as a result of a breach of the security of a system, then notification of the breach is not required. If the business or unit determines that notification is not required, the business shall maintain records that reflect its determination for 3 years after the determination is made. Data Breach Charts current as of December 31, 2015 Page 44

45 Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security; or to determine the scope of the breach of the security of a system, identify the individuals affected, or restore the integrity of the system. Notification shall be given as soon as reasonably practicable after the law enforcement agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security. Notice may be given: By written notice sent to the most recent address of the individual in the records of the business or unit; By electronic mail to the most recent electronic mail address of the individual in the records of the business or unit, if : o The individual has expressly consented to receive electronic notice; or o The business or unit conducts its business primarily through Internet account transactions or the Internet; By telephonic notice, to the most recent telephone number of the individual in the records of the business or unit. Notice shall include: To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personal information were, or are reasonably believed to have been, acquired; Contact information for the business or unit making the notification, including the business address, telephone number, and toll-free telephone number if one is maintained; The toll-free telephone numbers and addresses for the major consumer reporting agencies; and The toll-free telephone numbers, addresses, and Web site addresses for: o the Federal Trade Commission, and o the Office of the Attorney General; and o a statement that an individual can obtain information from these sources about steps the individual can take to avoid identity theft. Substitute notice may be given if the business or unit demonstrates that the cost of providing notice would exceed $100,000; or that the affected class of individuals to be notified exceeds 175,000; or the business or unit does not have sufficient contact information to give notice. Substitute notice shall consist of: Electronically mailing the notice to an individual entitled to notification, if the business or unit has an electronic mail address for the individual to be notified; Conspicuous posting of the notice on the Web site of the business or unit, if the business or unit maintains a Web site; and Notification to statewide media. A business that complies with the requirements for notification procedures, the protection or security of personal information, or the destruction of personal information under the rules, regulations, procedures, or guidelines established by the primary or functional federal or State regulator of the business shall be deemed to be in compliance with this subtitle. A unit or nonaffiliated third party that complies with 501(b) of the federal Gramm-Leach- Bliley Act; 15 U.S.C. 6801, 216 of the federal Fair and Accurate Credit Transactions Act; 15 U.S.C. 1681W Disposal of Records; the federal Interagency Guidelines Establishing Information Security Standards; and the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice; and any revisions, additions, or substitutions of those enactments, shall be deemed to be in compliance with this subtitle. Data Breach Charts current as of December 31, 2015 Page 45

46 Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If a business or unit is required to give notice of a breach of the security of a system to 1,000 or more individuals, the business or unit also shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined by 15 U.S.C. 1681a(p), of the timing, distribution, and content of the notices. Prior to giving the notification, a business or unit shall provide notice of a breach of the security of a system to the Office of the Attorney General. A unit shall also provide notice of a breach of security to the Department of Information Technology. A violation is an unfair or deceptive trade practice and is subject to the enforcement and penalty provisions contained in Title 13. A waiver of any provision is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 46

47 MASSACHUSETTS: Mass. Gen. Laws 93H-1 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification A person or agency that owns, licenses, maintains or stores data that includes personal information about a resident of Massachusetts. Means the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information, maintained by a person or agency that creates a substantial risk of identity theft or fraud against a Massachusetts resident. Means a resident s first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: Social Security number; driver s license number or state-issued identification card number; or financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident s financial account. The statute only applies to the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information. A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth shall provide notice to such resident. The notice should be provided as soon as practicable and without unreasonable delay, when such person or agency (1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information was acquired or used by an unauthorized person or used for an unauthorized purpose. The notice to be provided to the resident shall include, but not be limited to, the consumer s right to obtain a police report, how a consumer requests a security freeze and the necessary information to be provided when requesting the security freeze, and any fees required to be paid to any of the consumer reporting agencies, provided however, that said notification shall not include the nature of the breach or unauthorized acquisition or use or the number of residents of the commonwealth affected by said breach or unauthorized access or use. A person or agency that maintains or stores, but does not own or license data that includes personal information about a resident of the commonwealth, shall provide notice to and cooperate with the owner or licensor of the data. Such cooperation shall include, but not be limited to, informing the owner or licensor of the breach of security or unauthorized acquisition or use, the date or approximate date of such incident and the nature thereof, and any steps the person or agency has taken or plans to take relating to the incident, except that such cooperation shall not be deemed to require the disclosure of confidential business information or trade secrets, or to provide notice to a resident that may have been affected by the breach of security or unauthorized acquisition or use. Notice is not required unless the breach creates a substantial risk of identity theft or fraud against a Massachusetts resident or when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose. Notice may be delayed if a law enforcement agency determines that provision of such notice may impede a criminal investigation and has notified the attorney general, in writing, thereof and informs the person or agency of such determination. If notice is delayed due to such determination and as soon as the law enforcement agency determines and informs the person or agency that notification no longer poses a risk of impeding an investigation, notice shall be provided, as soon as practicable and without unreasonable delay. The person or agency shall cooperate with law enforcement in its investigation of any breach of security or unauthorized acquisition or use, which shall include the sharing of information relevant to Data Breach Charts current as of December 31, 2015 Page 47

48 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Credit Reporting Agencies Notice to Attorney General and Others Violations Waiver the incident; provided however, that such disclosure shall not require the disclosure of confidential business information or trade secrets. Notice shall include: written notice electronic notice, if notice provided is consistent with the provisions regarding electronic records and signatures set forth in 7001 (c) of Title 15 of the United States Code; and chapter 110G Substitute notice may be used, if the person or agency required to provide notice demonstrates that the cost of providing written notice will exceed $250,000, or that the affected class of Massachusetts residents to be notified exceeds 500,000 residents, or that the person or agency does not have sufficient contact information to provide notice Substitute notice shall consist of all of the following: electronic mail notice, if the person or agency has electronic mail addresses for the members of the affected class of Massachusetts residents; clear and conspicuous posting of the notice on the home page of the person or agency if the person or agency maintains a website; and publication in or broadcast through media or medium that provides notice throughout the commonwealth. If notification is required, it shall be provided, as soon as practicable and without unreasonable delay, to the attorney general and the director of consumer affairs and business regulation. The notice to be provided to the attorney general and said director, and consumer reporting agencies or state agencies if any, shall include, but not be limited to, the nature of the breach of security or unauthorized acquisition or use, the number of residents of the commonwealth affected by such incident at the time of notification, and any steps the person or agency has taken or plans to take relating to the incident. Upon receipt of this notice, the director of consumer affairs and business regulation shall identify any relevant consumer reporting agency or state agency, as deemed appropriate by said director, and forward the names of the identified consumer reporting agencies and state agencies to the notifying person or agency. Such person or agency shall, as soon as practicable and without unreasonable delay, also provide notice, to the consumer reporting agencies and state agencies identified by the director of consumer affairs and business regulation. If an agency is within the executive department, it shall provide written notification of the nature and circumstances of the breach or unauthorized acquisition or use to the information technology division and the division of public records as soon as practicable and without unreasonable delay following the discovery of a breach of security or unauthorized acquisition or use, and shall comply with all policies and procedures adopted by that division pertaining to the reporting and investigation of such an incident. The attorney general may bring an action pursuant to Section 4 of Chapter 93A against a person or otherwise to remedy violations of this chapter and for other relief that may be appropriate. Back to top Data Breach Charts current as of December 31, 2015 Page 48

49 MICHIGAN: Mich. Comp. Laws , Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification A person or agency that owns, licenses, maintains data including personal information of a Michigan resident. Means the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals. Means the first name or first initial and last name linked to one or more of the following data elements of a Michigan resident: Social security number. Driver license number or state personal identification card number. Demand deposit or other financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to any of the resident s financial accounts. The statute only applies to computerized personal information that is neither unencrypted nor redacted. A person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach shall provide a notice of the security breach, without unreasonable delay, to each resident of this state who meets one or more of the following: That resident s unencrypted and unredacted personal information was accessed and acquired by an unauthorized person. That resident s personal information was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key. A person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database shall provide a notice, without unreasonable delay, to the owner or licensor of the information of the security breach. Notice not required if the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to one or more residents of Michigan. In determining whether a security breach is not likely to cause substantial loss or injury to, or result in identity theft with respect to one or more residents of this state, a person or agency shall act with the care an ordinarily prudent person or agency in like position would exercise under similar circumstances. Notice may be delayed if law enforcement determines and advises the agency or person that providing a notice will impede a criminal or civil investigation or jeopardize homeland or national security or in order for the person or agency to take any measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database. However, the agency or person shall provide notice without unreasonable delay after the law enforcement agency determines that providing the notice will no longer impede the investigation or jeopardize homeland or national security or after the person or agency completes the measures necessary to determine the scope of the security breach and restore the reasonable integrity of the database. Data Breach Charts current as of December 31, 2015 Page 49

50 Methods of Notice Substitute Notice Compliance with Notification Requirements An agency or person shall provide any notice required under this section by providing one or more of the following to the recipient: Written notice sent to the recipient at the recipient s postal address in the records of the agency or person. Written notice sent electronically to the recipient if any of the following are met: o The recipient has expressly consented to receive electronic notice. o The person or agency has an existing business relationship with the recipient that includes periodic electronic mail communications and based on those communications the person or agency reasonably believes that it has the recipient s current electronic mail address. o The person or agency conducts its business primarily through internet account transactions or on the internet. If not otherwise prohibited by state or federal law, notice given by telephone by an individual who represents the person or agency if all of the following are met: o The notice is not given in whole or in part by use of a recorded message. o The recipient has expressly consented to receive notice by telephone, or if the recipient has not expressly consented to receive notice by telephone, the person or agency also provides written notice if the notice by telephone does not result in a live conversation between the individual representing the person or agency and the recipient within 3 business days after the initial attempt to provide telephonic notice. A written or telephonic notice must contain: Describe the security breach in general terms. Describe the type of personal information that is the subject of the unauthorized access or use. If applicable, generally describe what the agency or person providing the notice has done to protect data from further security breaches. Include a telephone number where a notice recipient may obtain assistance or additional information. Remind notice recipients of the need to remain vigilant for incidents of fraud and identity theft. Substitute notice may be used, if the person or agency demonstrates that the cost of providing notice will exceed $250, or that the person or agency has to provide notice to more than 500,000 residents of Michigan. A person or agency provides substitute notice under this subdivision by doing all of the following: If the person or agency has electronic mail addresses for any of the residents of this state who are entitled to receive the notice, providing electronic notice to those residents; If the person or agency maintains a website, conspicuously posting the notice on that website; and Notifying major statewide media. A notification under this subparagraph shall include a telephone number or a website address that a person may use to obtain additional assistance and information. Financial Institutions: A financial institution that is subject to, and has notification procedures in place that are subject to examination by the financial institution s appropriate regulator for compliance with, the interagency guidance on response programs for unauthorized access to customer information and customer notice prescribed by the board of governors of the federal reserve system and the other federal bank and thrift regulatory agencies, or similar guidance prescribed and adopted by the national credit union administration, and its affiliates, is considered to be in compliance with the statute. Data Breach Charts current as of December 31, 2015 Page 50

51 Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver HIPPA: A person or agency that is subject to and complies with the health insurance portability and accountability act of 1996, Public Law , and with regulations promulgated under that act, 45 CFR parts 160 and 164, for the prevention of unauthorized access to customer information and customer notice is considered to be in compliance with the statute. Public Utilities: A public utility that sends monthly billing or account statements to the postal address of its customers may provide written notice of a security breach to its customers, or alternatively by providing all of the following: As applicable, electronic written notice; Notification to the media reasonably calculated to inform the customers of the public utility of the security breach; Conspicuous posting of the notice of the security breach on the website of the public utility; and Written notice sent in conjunction with the monthly billing or account statement to the customer at the customer s postal address in the records of the public utility. If a person or agency is required to give notice of a breach of the security of a system to 1,000 or more individuals, the person or agency shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in 15 USC 1681a(p) of the security breach. A notification under this subsection shall include the number of notices that the person or agency provided to residents of this state and the timing of those notices. A person that provides notice of a security breach in the manner described in this section when a security breach has not occurred, with the intent to defraud, is guilty of a misdemeanor punishable as follows: (a) Except as otherwise provided under subdivisions (b) and (c), by imprisonment for not more than 93 days or a fine of not more than $ for each violation, or both. (b) For a second violation, by imprisonment for not more than 93 days or a fine of not more than $ for each violation, or both. (c) For a third or subsequent violation, by imprisonment for not more than 93 days or a fine of not more than $ for each violation, or both. A person that knowingly fails to provide any notice of a security breach required under this section may be ordered to pay a civil fine of not more than $ for each failure to provide notice. The attorney general or a prosecuting attorney may bring an action to recover a civil fine under this section. The aggregate liability of a person for civil fines for multiple violations for knowingly failing to provide notice of a security breach that arise from the same security breach shall not exceed $750, The provisions above do not affect the availability of any civil remedy for a violation of state or federal law. Back to top Data Breach Charts current as of December 31, 2015 Page 51

52 MINNESOTA: Minn. Stat. 325E.61, 325E.64 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person or business that conducts business in Minnesota, and that owns or licenses data that includes personal information, or maintains data that includes personal information that the person or business does not own of Minnesota resident. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when the data element is not secured by encryption or another method of technology that makes electronic data unreadable or unusable, or was secured and the encryption key, password, or other means necessary for reading or using the data was also acquired: Social Security number; driver s license number or Minnesota identification card number; or account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to personal information that is neither unencrypted nor redacted nor secured another method of technology that makes electronic data unreadable or unusable. Any person or business shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system. Any person or business that maintains data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The notification may be delayed to a date certain if a law enforcement agency affirmatively determines that the notification will impede a criminal investigation. "Notice" may be provided by one of the following methods: written notice to the most recent available address the person or business has in its records electronic notice, if the person s primary method of communication with the individual is by electronic means, or if the notice provided is consistent with the provisions regarding electronic records and signatures in United States Code, Title 15, Section 7001 Substitute notice may be given, if the person or business demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice must consist of all of the following: notice when the person or business has an address for the subject persons; conspicuous posting of the notice on the Web site page of the person or business, if the person or business maintains one; and (iii) notification to major statewide media. Data Breach Charts current as of December 31, 2015 Page 52

53 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver A person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute, shall be deemed to be in compliance with the notification requirements of the statute, if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system. If a person discovers circumstances requiring notification to more than 500 persons at one time, the person shall also notify, within 48 hours, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by United States Code, Title 15, Section 1681a, of the timing, distribution, and content of the notices. The attorney general shall enforce this section and Section , subdivision 6, under Section Any waiver of the provisions is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 53

54 MISSISSIPPI: Miss. Code Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person who conducts business in this state and who, in the ordinary course of the person s business functions, owns, licenses or maintains personal information of any resident of this state. Means unauthorized acquisition of electronic files, media, databases or computerized data containing personal information of any resident of this state when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements: Social security number; Driver s license number or state identification card number; or An account number or credit or debit card number in combination with any required security code, access code or password that would permit access to an individual s financial account The statute only applies to personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Upon completion of an investigation by the person to determine the nature and scope of the incident, to identify the affected individuals, or to restore the reasonable integrity of the data system, a person shall disclose, without unreasonable delay, any breach of security to all affected individuals. Any person who conducts business in this state that maintains computerized data which includes personal information that the person does not own or license shall notify the owner or licensee of the information of any breach of the security of the data as soon as practicable following its discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person for fraudulent purposes. Notification shall not be required if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the affected individuals. Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation or national security and the law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after the law enforcement agency determines that notification will not compromise the criminal investigation or national security and so notifies the person of that determination. Any notice required by the provisions of this section may be provided by one of the following methods: written notice telephone notice electronic notice, if the person s primary means of communication with the affected individuals is by electronic means or if the notice is consistent with the provisions regarding electronic records and signatures set forth in 15 USCS 7001 Substitute notice may be provided if the person demonstrates that the cost of providing notice would exceed $ 5,000; that the affected class of subject persons to be notified exceeds 5,000 individuals or the person does not have sufficient contact information. Substitute notice shall consist of the following: electronic mail notice when the person has an electronic mail address for the affected individuals; conspicuous posting of the notice on the Web site of the person if the person maintains one; and Data Breach Charts current as of December 31, 2015 Page 54

55 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver notification to major statewide media, including newspapers, radio and television. Any person who conducts business in this state that maintains its own security breach procedures as part of an information security policy for the treatment of personal information, and otherwise complies with the timing requirements of the statute, shall be deemed to be in compliance with the security breach notification requirements if the person notifies affected individuals in accordance with the person s policies in the event of a breach of security. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or federal functional regulator, as defined in 15 USCS 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided the person notifies affected individuals in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or federal functional regulator in the event of a breach of security of the system. Failure to comply with the requirements of this section shall constitute an unfair trade practice and shall be enforced by the Attorney General; however, nothing in this section may be construed to create a private right of action. Back to top Data Breach Charts current as of December 31, 2015 Page 55

56 MISSOURI: Mo. Rev. Stat Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Any person that owns or licenses personal information of residents of Missouri or any person that conducts business in Missouri that owns or licenses personal information in any form of a resident of Missouri. Means the unauthorized access to and unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or unusable: Social Security number; Driver s license number or other unique identification number created or collected by a government body; Financial account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual s financial account; Unique electronic identifier or routing code, in combination with any required security code, access code, or password that would permit access to an individual s financial account; Medical information; or Health insurance information. The statute only applies to computerized data containing personal information that is not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or unusable. A person shall provide notice to the affected consumer that there has been a breach of security following discovery or notification of the breach. The disclosure notification shall be made without unreasonable delay and consistent with the legitimate needs of law enforcement, or as necessary to determine sufficient contact information and to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Any person that maintains or possesses records or data containing personal information of residents of Missouri that the person does not own or license, or any person that conducts business in Missouri that maintains or possesses records or data containing personal information of a resident of Missouri that the person does not own or license, shall notify the owner or licensee of the information of any breach of security immediately following discovery of the breach, consistent with the legitimate needs of law enforcement. Notification is not required if, after an appropriate investigation by the person or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determines that a risk of identity theft or other fraud to any consumer is not reasonably likely to occur as a result of the breach. Such a determination shall be documented in writing and the documentation shall be maintained for five years. The notice may be delayed if a law enforcement agency informs the person that notification may impede a criminal investigation or jeopardize national or homeland security, provided that such request by law enforcement is made in writing or the person documents such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer s law enforcement agency engaged in the investigation. The notice shall be provided without unreasonable delay after the law enforcement agency communicates to the person its determination that notice will no longer impede the investigation or jeopardize national or homeland security. Data Breach Charts current as of December 31, 2015 Page 56

57 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to affected consumers shall be provided by one of the following methods: Written notice Electronic notice for those consumers for whom the person has a valid address and who have agreed to receive communications electronically, if the notice provided is consistent with the provisions of 15 U.S.C. Section 7001 regarding electronic records and signatures for notices legally required to be in writing Telephonic notice, if such contact is made directly with the affected consumers The notice shall at minimum include a description of the following: The incident in general terms; The type of personal information that was obtained as a result of the breach of security; A telephone number that the affected consumer may call for further information and assistance, if one exists; Contact information for consumer reporting agencies; Advice that directs the affected consumer to remain vigilant by reviewing account statements and monitoring free credit reports. Substitute notice may be used, if the person demonstrates that the cost of providing notice would exceed $100,000; the class of affected consumers to be notified exceeds 150,000; or the person does not have sufficient contact information or consent, for only those affected consumers without sufficient contact information or consent; or the person is unable to identify particular affected consumers, for only those unidentifiable consumers. Substitute notice shall consist of all the following: notice when the person has an electronic mail address for the affected consumer; Conspicuous posting of the notice or a link to the notice on the internet website of the person if the person maintains an internet website; and Notification to major statewide media. A person that maintains its own notice procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of the statute, is deemed to be in compliance with the notice requirements of the statute if the person notifies affected consumers in accordance with its policies in the event of a breach of security of the system. A person that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with the statute if the person notifies affected consumers in accordance with the maintained procedures when a breach occurs. A financial institution that is: (a) Subject to and in compliance with the Federal Interagency Guidance Response Programs for Unauthorized Access to Customer Information and Customer Notice, issued on March 29, 2005, by the board of governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision, and any revisions, additions, or substitutions relating to said interagency guidance; or (b) Subject to and in compliance with the National Credit Union Administration regulations in 12 CFR Part 748; or (c) Subject to and in compliance with the provisions of Title V of the Gramm-Leach- Bliley Financial Modernization Act of 1999, 15 U.S.C. Sections 6801 to 6809; shall be deemed to be in compliance with this section. Data Breach Charts current as of December 31, 2015 Page 57

58 Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver In the event a person provides notice to more than 1,000 consumers at one time, the person shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice. In the event a person provides notice to more than 1,000 consumers at one time, the person shall notify, without unreasonable delay, the attorney general s office of the timing, distribution, and content of the notice. The attorney general shall have exclusive authority to bring an action to obtain actual damages for a willful and knowing violation of this section and may seek a civil penalty not to exceed one hundred fifty thousand dollars per breach of the security of the system or series of breaches of a similar nature that are discovered in a single investigation. Back to top Data Breach Charts current as of December 31, 2015 Page 58

59 MONTANA: Mont. Code , , et seq.; HB 74 (Eff. Oct. 1, 2015) Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing A state agency that maintains computerized data containing personal information; Any person or business that conducts business in Montana and that owns, licenses or maintains computerized data that includes personal information. Means unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the person or business and causes or is reasonably believed to cause loss or injury to a Montana resident. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver s license number, state identification card number, or tribal identification number or enrollment number; account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. Medical record information that o o relates to an individual's physical or mental condition, medical history, medical claims history, or medical treatment; and is obtained from a medical professional or medical care institution, from the individual, or from the individual's spouse, parent, or legal guardian a taxpayer identification number; or an identity protection personal identification number issued by the United States internal revenue service The statute only applies to personal information that is neither unencrypted nor redacted. State Agencies: A state agency shall make reasonable efforts to notify any person whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. The notification must be made without unreasonable delay, consistent with the legitimate needs of law enforcement or with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. A third party that receives personal information from a state agency and maintains that information in a computerized data system shall: notify the state agency immediately following discovery of the breach of the security of a data system if the personal information is reasonably believed to have been acquired by an unauthorized person; and make reasonable efforts upon discovery or notification of a breach of the security of a data system to notify any person whose unencrypted personal information is reasonably believed to have been acquired by an unauthorized person as part of the breach of the security of a data system. General breach: A person or business shall disclose any breach of the security of the data system following discovery or notification of the breach to any resident of Montana whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. The disclosure must be made without unreasonable delay, consistent with the legitimate needs of law enforcement, or consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any person or business that maintains computerized data that includes personal information Data Breach Charts current as of December 31, 2015 Page 59

60 Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Notice to Insurance Commissioner Violations that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data system immediately following discovery if the personal information was or is reasonably believed to have been acquired by an unauthorized person. Notification is only required if the unauthorized acquisition of computerized data materially compromises the security, confidentiality, or integrity of personal information and causes or is reasonably believed to cause loss or injury to a Montana resident. The notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation and requests a delay of notification. The notification must be made after the law enforcement agency determines that the notification will not compromise the investigation. Notice may be provided by one of the following methods: written notice; electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. 7001; or telephonic notice Substitute notice may be used if the person or business demonstrates that the cost of providing notice would exceed $250,000; the affected class of subject persons to be notified exceeds 500,000; or the person or business does not have sufficient contact information. Substitute notice must consist of the following: an electronic mail notice when the person or business has an electronic mail address for the subject persons; and conspicuous posting of the notice on the website page of the person or business if the person or business maintains one; and notification to applicable local or statewide media. A person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and that does not unreasonably delay notice is considered to be in compliance with the notification requirements the statute if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the data system. If a business discloses a security breach to any individual and gives a notice to the individual that suggests, indicates, or implies to the individual that the individual may obtain a copy of the file on the individual from a consumer credit reporting agency, the business shall coordinate with the consumer reporting agency as to the timing, content, and distribution of the notice to the individual. The coordination may not unreasonably delay the notice to the affected individuals. A person, business or state agency that is required to issue a notification shall simultaneously submit an electronic copy of the notification and a statement providing the date and method of distribution of the notification to the attorney general's consumer protection office, excluding any information that personally identifies any individual who is entitled to receive notification. If a notification is made to more than one individual, a single copy of the notification must be submitted that indicates the number of individuals in the state who received notification. Any licensee or insurance-support organization that is required to issue a notification shall simultaneously submit an electronic copy of the notification and a statement providing the date and method of distribution of the notification to the commissioner, excluding any information that personally identifies any individual who is entitled to receive notification. If a notification is made to more than one individual, a single copy of the notification must be submitted that indicates the number of individuals in the state who received notification. Whenever the department has reason to believe that a person has violated this part and that proceeding would be in the public interest, the department may bring an action in the name of the state against the person to restrain by temporary or permanent injunction or Data Breach Charts current as of December 31, 2015 Page 60

61 Waiver temporary restraining order the use of the unlawful method, act, or practice upon giving appropriate notice to that person pursuant to (2). A violation is an unfair or deceptive act or practice, and the penalties for a violation of this part are as provided in Back to top Data Breach Charts current as of December 31, 2015 Page 61

62 NEBRASKA: Neb. Rev. Stat , -802, -803, -804, -805, -806, -807 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice An individual or a commercial entity that conducts business in Nebraska and that owns or licenses computerized data that includes personal information about a resident of Nebraska. Means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or a commercial entity. Means a Nebraska resident s first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident if either the name or the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable: Social security number; Motor vehicle operator s license number or state identification card number; Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident s financial account; Unique electronic identification number or routing code, in combination with any required security code, access code, or password; or Unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation. The statute only applies to personal information that is neither unencrypted nor redacted or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable. An individual or a commercial entity shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose. If the investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur, the individual or commercial entity shall give notice to the affected Nebraska resident. Notice shall be made as soon as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. An individual or a commercial entity that maintains computerized data that includes personal information that the individual or commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system when it becomes aware of a breach if use of personal information about a Nebraska resident for an unauthorized purpose occurred or is reasonably likely to occur. Cooperation includes, but is not limited to, sharing with the owner or licensee information relevant to the breach, not including information proprietary to the individual or commercial entity. Notification is only required if the investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur. Notice may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation. Notice shall be made in good faith, without unreasonable delay, and as soon as possible after the law enforcement agency determines that notification will no longer impede the investigation. Notice means: Written notice Telephonic notice Data Breach Charts current as of December 31, 2015 Page 62

63 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. 7001, as such section existed on January 1, 2006 Substitute notice may be used, if the individual or commercial entity demonstrates that the cost of providing notice will exceed $75,000, that the affected class of Nebraska residents to be notified exceeds 100,000 residents, or that the individual or commercial entity does not have sufficient contact information to provide notice. Substitute notice under this subdivision requires all of the following: Electronic mail notice if the individual or commercial entity has electronic mail addresses for the members of the affected class of Nebraska residents; Conspicuous posting of the notice on the web site of the individual or commercial entity if the individual or commercial entity maintains a web site; and Notice to major statewide media outlets; or Substitute notice may be used, if the individual or commercial entity required to provide notice has 10 employees or fewer and demonstrates that the cost of providing notice will exceed $10,000. In which case, substitute notice requires all of the following: Electronic mail notice if the individual or commercial entity has electronic mail addresses for the members of the affected class of Nebraska residents; Notification by a paid advertisement in a local newspaper that is distributed in the geographic area in which the individual or commercial entity is located, which advertisement shall be of sufficient size that it covers at least one-quarter of a page in the newspaper and shall be published in the newspaper at least once a week for three consecutive weeks; Conspicuous posting of the notice on the web site of the individual or commercial entity if the individual or commercial entity maintains a web site; and Notification to major media outlets in the geographic area in which the individual or commercial entity is located; An individual or a commercial entity that maintains its own notice procedures which are part of an information security policy for the treatment of personal information and which are otherwise consistent with the timing requirements of Section , is deemed to be in compliance with the notice requirements of Section if the individual or the commercial entity notifies affected Nebraska residents in accordance with its notice procedures in the event of a breach of the security of the system. An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with Section if the individual or commercial entity notifies affected Nebraska residents in accordance with the maintained procedures in the event of a breach of the security of the system. For purposes of the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006, the Attorney General may issue subpoenas and seek and recover direct economic damages for each affected Nebraska resident injured by a violation of the act. Any waiver of the provisions of the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 63

64 NEVADA: Nev. Rev. Stat. 603A.010 et seq., Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Any governmental agency, institution of higher education, corporation, financial institution or retail operator or any other type of business entity or association ( data collector ) that, for any purpose, whether by automated collection or otherwise, handles, collects, disseminates or otherwise deals with nonpublic personal information. Means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information maintained by the data collector. Means a natural person s first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted: Social security number. Driver s license number or identification card number. Account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to the person s financial account. The statute only applies to personal information that is not encrypted. General Breach: A data collector shall disclose any breach of the security of the system data following discovery or notification of the breach to any resident of this State whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system data. Any data collector that maintains computerized data which includes personal information that the data collector does not own shall notify the owner or licensee of the information of any breach of the security of the system data immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. State Agencies: The Chief of the Office of Information Security shall investigate and resolve any breach of an information system of a state agency or elected officer that uses the equipment or services of the Division or an application of such an information system or unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of such an information system. The Administrator or Chief of the Office of Information Security, at his or her discretion, may inform members of the Technological Crime Advisory Board, the Nevada Commission on Homeland Security and the Information Technology Advisory Board of any breach of an information system of a state agency or elected officer or application of such an information system or unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of such an information system. General Breach: Notification is only required if a resident s unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. State Agencies: Notification is may be given at the discretion of the Administrator or Chief of the Office of Information Security if the unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of such an information system. The notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification must be made after the law enforcement agency determines that the notification will not compromise the investigation. Data Breach Charts current as of December 31, 2015 Page 64

65 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Notification may be provided by one of the following methods: Written notification Electronic notification, if the notification provided is consistent with the provisions of the Electronic Signatures in Global and National Commerce Act, 15 U.S.C et seq. Substitute notification may be given, if the data collector demonstrates that the cost of providing notification would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the data collector does not have sufficient contact information. Substitute notification must consist of all the following: Notification by electronic mail when the data collector has electronic mail addresses for the subject persons; Conspicuous posting of the notification on the Internet website of the data collector, if the data collector maintains an Internet website; and Notification to major statewide media. A data collector which maintains its own notification policies and procedures as part of an information security policy for the treatment of personal information that is otherwise consistent with the timing requirements of the statute shall be deemed to be in compliance with the notification requirements if the data collector notifies subject persons in accordance with its policies and procedures in the event of a breach of the security of the system data. A data collector which is subject to and complies with the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C et seq., shall be deemed to be in compliance with the notification requirements of this section. If a data collector determines that notification is required to be given to more than 1,000 persons at any one time, the data collector shall also notify, without unreasonable delay, any consumer reporting agency, as that term is defined in 15 U.S.C. 1681a(p), that compiles and maintains files on consumers on a nationwide basis, of the time the notification is distributed and the content of the notification. NRS 603A.900 Civil action. A data collector that provides the notification required pursuant to NRS 603A.220 may commence an action for damages against a person that unlawfully obtained or benefited from personal information obtained from records maintained by the data collector. A data collector that prevails in such an action may be awarded damages which may include, without limitation, the reasonable costs of notification, reasonable attorney s fees and costs and punitive damages when appropriate. The costs of notification include, without limitation, labor, materials, postage and any other costs reasonably related to providing the notification. NRS 603A.910 Restitution. In addition to any other penalty provided by law for the breach of the security of the system data maintained by a data collector, the court may order a person who is convicted of unlawfully obtaining or benefiting from personal information obtained as a result of such breach to pay restitution to the data collector for the reasonable costs incurred by the data collector in providing the notification required pursuant to NRS 603A.220, including, without limitation, labor, materials, postage and any other costs reasonably related to providing such notification. NRS 603A.920 Injunction. If the Attorney General or a district attorney of any county has reason to believe that any person is violating, proposes to violate or has violated the provisions of this chapter, the Attorney General or district attorney may bring an action against that person to obtain a temporary or permanent injunction against the violation. Any waiver of the provisions of this chapter is contrary to public policy, void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 65

66 NEW HAMPSHIRE: N.H. Rev. Stat. 359-C:19, -C:20, -C:21 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person doing business in New Hampshire who owns, licenses, or maintains computerized data that includes personal information. Means unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in this state. Means an individual s first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: Social security number. Driver s license number or other government identification number. Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to computerized data containing personal information that is not encrypted. A person shall, when it becomes aware of a security breach, promptly determine the likelihood that the information has been or will be misused. If the determination is that misuse of the information has occurred or is reasonably likely to occur, or if a determination cannot be made, the person shall notify the affected individuals as soon as possible as required under this subdivision. The disclosure shall be made to affected individuals as quickly as possible. Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify and cooperate with the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was acquired by an unauthorized person. Cooperation includes sharing with the owner or licensee information relevant to the breach; except that such cooperation shall not be deemed to require the disclosure of confidential or business information or trade secrets. Notification is only required if the investigation determines that misuse of the information has occurred or is reasonably likely to occur, or if a determination cannot be made. Notification may be delayed if a law enforcement agency, or national or homeland security agency determines that the notification will impede a criminal investigation or jeopardize national or homeland security. Notice shall be provided by one of the following methods: Written notice. Electronic notice, if the agency or business primary means of communication with affected individuals is by electronic means. Telephonic notice, provided that a log of each such notification is kept by the person or business who notifies affected persons. Notice shall include at a minimum: A description of the incident in general terms. The approximate date of breach. The type of personal information obtained as a result of the security breach. The telephonic contact information of the person subject to this section. Substitute notice may be used, if the person demonstrates that the cost of providing notice would exceed $5,000; that the affected class of subject individuals to be notified exceeds 1,000; or the person does not have sufficient contact information or consent. Substitute notice shall consist of all of the following: notice when the person has an address for the affected individuals; Conspicuous posting of the notice on the person s business website, if the person Data Breach Charts current as of December 31, 2015 Page 66

67 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Regulators and Attorney General Violations Waiver maintains one; and Notification to major statewide media. Notice pursuant to the person s internal notification procedures maintained as part of an information security policy for the treatment of personal information. Notice under this section shall include at a minimum: A description of the incident in general terms; The approximate date of breach; The type of personal information obtained as a result of the security breach; and The telephonic contact information of the person subject to this section. Any person engaged in trade or commerce that is subject to RSA 358-A:3, I which maintains procedures for security breach notification pursuant to the laws, rules, regulations, guidances, or guidelines issued by a state or federal regulator shall be deemed to be in compliance with the statute if it acts in accordance with such laws, rules, regulations, guidances, or guidelines. If a person is required to notify more than 1,000 consumers of a breach of security, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. Section 1681a(p), of the anticipated date of the notification to the consumers, the approximate number of consumers who will be notified, and the content of the notice. Any person engaged in trade or commerce that is subject to RSA 358-A:3, shall also notify the regulator which has primary regulatory authority over such trade or commerce. All other persons shall notify the New Hampshire attorney general s office. The notice shall include the anticipated date of the notice to the individuals and the approximate number of individuals in this state who will be notified. Any person injured by any violation under the statute may bring an action for damages and for such equitable relief, including an injunction, as the court deems necessary and proper. If the court finds for the plaintiff, recovery shall be in the amount of actual damages. If the court finds that the act or practice was a willful or knowing violation, it shall award as much as 3 times, but not less than 2 times, such amount. In addition, a prevailing plaintiff shall be awarded the costs of the suit and reasonable attorney s fees, as determined by the court. Injunctive relief shall be available to private individuals under this chapter without bond, subject to the discretion of the court. The New Hampshire attorney general s office shall enforce the provisions of this subdivision pursuant to RSA 358-A:4. The burden shall be on the person responsible for the determination under RSA 359-C:20, to demonstrate compliance with this subdivision. Any attempted waiver of the right to the damages under the statute shall be void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 67

68 NEW JERSEY: N.J. Stat. 56:8-161, et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any business that conducts business in New Jersey, or any public entity that compiles or maintains computerized records that include personal information. Means unauthorized access to electronic files, media or data containing personal information that compromises the security, confidentiality or integrity of personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Means an individual s first name or first initial and last name linked with any one or more of the following data elements: Social Security number; driver s license number or State identification card number; or account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. Dissociated data that, if linked, would constitute personal information is personal information if the means to link the dissociated data were accessed in connection with access to the dissociated data. The statute only applies to computerized records that include personal information that have not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. A business or entity shall disclose any breach of security of those computerized records following discovery or notification of the breach to any customer whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person. The disclosure to a customer shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any business or public entity that compiles or maintains computerized records that include personal information on behalf of another business or public entity shall notify that business or public entity, who shall notify its New Jersey customers of any breach of security of the computerized records immediately following discovery, if the personal information was, or is reasonably believed to have been, accessed by an unauthorized person. Disclosure of a breach of security to a customer shall not be required if the business or public entity establishes that misuse of the information is not reasonably possible. Any determination shall be documented in writing and retained for five years. Notification shall be delayed if a law enforcement agency determines that the notification will impede a criminal or civil investigation and that agency has made a request that the notification be delayed. Notification shall be made after the law enforcement agency determines that its disclosure will not compromise the investigation and notifies that business or public entity. Notice may be provided by one of the following methods: Written notice Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 101 of the federal "Electronic Signatures in Global and National Commerce Act" (15 U.S.C. Section 7001) Data Breach Charts current as of December 31, 2015 Page 68

69 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Other: Notice to Division of State Police, Dept. of Law and Public Safety Substitute notice may be given, if the business or public entity demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the business or public entity does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when the business or public entity has an address; Conspicuous posting of the notice on the Internet web site page of the business or public entity, if the business or public entity maintains one; and Notification to major Statewide media. A business or public entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and is otherwise consistent with the requirements of the statute, shall be deemed to be in compliance with the notification requirements if the business or public entity notifies subject customers in accordance with its policies in the event of a breach of security of the system. If a business or public entity is required to notify more than 1,000 persons at one time, the business or public entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile or maintain files on consumers on a nationwide basis, as defined by subsection (p) of section 603 of the federal "Fair Credit Reporting Act" (15 U.S.C. Section 1681a), of the timing, distribution and content of the notices. It shall be an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.) to willfully, knowingly or recklessly violate the act. Any business or public entity required to disclose a breach of security of a customer s personal information shall, in advance of the disclosure to the customer, report the breach of security and any information pertaining to the breach to the Division of State Police in the Department of Law and Public Safety for investigation or handling, which may include dissemination or referral to other appropriate law enforcement entities. Back to top Data Breach Charts current as of December 31, 2015 Page 69

70 NEW MEXICO No legislation. Back to top Data Breach Charts current as of December 31, 2015 Page 70

71 NEW YORK: N.Y. Gen. Bus. Law 899-aa, N.Y. State Tech. Law 208 Persons Covered Definition of Security Breach Definition of Personal Information Definition of Private Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any person or business which conducts business in New York state and owns or licenses, or any state entity that maintains, computerized data which includes private information. Means unauthorized acquisition or acquisition without valid authorization of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a business. Means any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person. Means personal information consisting of any information in combination with any one or more of the following data elements, when either the personal information or the data element is not encrypted, or encrypted with an encryption key that has also been acquired: social security number; driver s license number or non-driver identification card number; or account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to computerized data containing personal information that is neither unencrypted nor redacted. An entity shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, acquired by a person without valid authorization. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system. Any entity which maintains computerized data which includes private information which such person or business does not own shall notify the owner or licensee of the information of any breach of the security of the system immediately following discovery, if the private information was, or is reasonably believed to have been, acquired by a person without valid authorization. In determining whether information has been acquired, or is reasonably believed to have been acquired, by an unauthorized person or a person without valid authorization, an entity may consider the following factors, among others: indications that the information is in the physical possession and control of an unauthorized person, such as a lost or stolen computer or other device containing information; or indications that the information has been downloaded or copied; or indications that the information was used by an unauthorized person, such as fraudulent accounts opened or instances of identity theft reported. Notification may be delayed if a law enforcement agency determines that such notification impedes a criminal investigation. The notification shall be made after such law enforcement agency determines that such notification does not compromise such investigation. The notice shall be directly provided to the affected persons by one of the following methods: written notice; electronic notice, provided that the person to whom notice is required has expressly consented to receiving said notice in electronic form and a log of each such notification is kept by the person or business who notifies affected persons in such form; provided further, however, that in no case shall any person or business require a person to consent to accepting said notice in said form as a condition of establishing any business relationship or engaging in any transaction. Data Breach Charts current as of December 31, 2015 Page 71

72 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Other: Notice to Others: telephone notification provided that a log of each such notification is kept by the person or business who notifies affected persons The notice shall include contact information for the person or business making the notification and a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired. Substitute notice may be used, if a business demonstrates to the state attorney general that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or such business does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when such business has an address for the subject persons; conspicuous posting of the notice on such business s web site page, if such business maintains one; and notification to major statewide media. In the event that more than 5,000 New York residents are to be notified at one time, the person or business shall also notify consumer reporting agencies as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents. In the event that any New York residents are to be notified, the person or business shall notify the state attorney general as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents. The attorney general may bring an action in the name and on behalf of the people of the state of New York to enjoin and restrain the continuation of a violation. Preliminary relief may be granted. The court may award damages for actual costs or losses incurred by a person entitled to notice, if notification was not provided to such person, including consequential financial losses. Whenever the court determines that a person or business violated the statute knowingly or recklessly, the court may impose a civil penalty of the greater of $5,000 or up to $10.00 per instance of failed notification, provided that the latter amount shall not exceed $150,000. The remedies provided shall be in addition to any other lawful remedy available. No action may be brought under the provisions of the statute unless the action is commenced within 2 years immediately after the date of the act complained of or the date of discovery of such act. In the event that any New York residents are to be notified, the person or business shall notify the department of state and the division of state police as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents. Back to top Data Breach Charts current as of December 31, 2015 Page 72

73 NORTH CAROLINA: N.C. Gen. Stat 75-61, Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any business that owns or licenses personal information of residents of North Carolina or any business that conducts business in North Carolina that owns or licenses, or maintains and possesses personal information in any form (whether computerized, paper, or otherwise); Any business that maintains or possesses records or data containing personal information of residents of North Carolina that the business does not own or license, or any business that conducts business in North Carolina that maintains or possesses records or data containing personal information that the business does not own or license. An incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key shall constitute a security breach. A person's first name or first initial and last name in combination with identifying information (including social security or employer taxpayer identification numbers; drivers license, state identification card, or passport numbers; checking account numbers; savings account numbers; credit card numbers; debit card numbers; personal Identification (PIN) code; digital signatures; any numbers or information that can be used to access a person's financial resources; biometric data; and fingerprints). Personal information shall not include electronic identification numbers, electronic mail names or addresses, Internet account numbers, Internet identification names, parent's legal surname prior to marriage, or a password unless this information would permit access to a person's financial account or resources. The statute only applies to unencrypted and unredacted records or data containing personal information. A business shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach. The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Any business that maintains or possesses records or data containing personal information of residents of North Carolina that the business does not own or license, or any business that conducts business in North Carolina that maintains or possesses records or data containing personal information that the business does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement. Notification is not required if there is no illegal use of the personal information or illegal use is not reasonably likely to occur or does not create a material risk of harm to a consumer. The notice shall be delayed if a law enforcement agency informs the business that notification may impede a criminal investigation or jeopardize national or homeland security, provided that such request is made in writing or the business documents such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer s law enforcement agency engaged in the investigation. The notice shall be provided without unreasonable delay after the law enforcement agency communicates to the business its determination that notice will no longer impede the investigation or jeopardize national or homeland security. Notice to affected persons may be provided by one of the following methods: Written notice. Data Breach Charts current as of December 31, 2015 Page 73

74 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Electronic notice, for those persons for whom it has a valid address and who have agreed to receive communications electronically if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing set forth in 15 U.S.C Telephonic notice provided that contact is made directly with the affected persons. The notice shall be clear and conspicuous. The notice shall include all of the following: A description of the incident in general terms. A description of the type of personal information that was subject to the unauthorized access and acquisition. A description of the general acts of the business to protect the personal information from further unauthorized access. A telephone number for the business that the person may call for further information and assistance, if one exists. Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports. The toll-free numbers and addresses for the major consumer reporting agencies. The toll-free numbers, addresses, and Web site addresses for the Federal Trade Commission and the North Carolina Attorney General s Office, along with a statement that the individual can obtain information from these sources about preventing identity theft. Substitute notice may be used, if the business demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds 500,000, or if the business does not have sufficient contact information or consent to satisfy the notice requirements, for only those affected persons without sufficient contact information or consent, or if the business is unable to identify particular affected persons, for only those unidentifiable affected persons. Substitute notice shall consist of all the following: notice when the business has an electronic mail address for the subject persons; Conspicuous posting of the notice on the Web site page of the business, if one is maintained; and Notification to major statewide media. A financial institution that is subject to and in compliance with the Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice, issued on March 7, 2005, by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision; or a credit union that is subject to and in compliance with the Final Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice, issued on April 14, 2005, by the National Credit Union Administration; and any revisions, additions, or substitutions relating to any of the said interagency guidance, shall be deemed to be in compliance with this section. In the event a business provides notice to more than 1,000 persons at one time, the business shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. 1681a(p), of the timing, distribution, and content of the notice. If notification to affected persons is required, the business shall notify without unreasonable delay the Consumer Protection Division of the Attorney General s Office of the nature of the breach, the number of consumers affected by the breach, steps taken to investigate the breach, steps taken to prevent a similar breach in the future, and information regarding the timing, distribution, and content of the notice. In the event a business provides notice to more than 1,000 persons at one time, the business shall notify, without unreasonable delay, the Consumer Protection Division of the Attorney Data Breach Charts current as of December 31, 2015 Page 74

75 Violations Waiver General s Office of the timing, distribution, and content of the notice. A violation of the statute is an unfair or deceptive act or practice in or affecting commerce under G.S No private right of action may be brought by an individual for a violation of the statute unless such individual is injured as a result of the violation. Any waiver of the provisions of the statute is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 75

76 NORTH DAKOTA: N.D. Cent. Code et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Any person that conducts business in this state, and that owns or licenses computerized data that includes personal information of a resident of North Dakota; Any person that maintains computerized data that includes personal information that the person does not own. Means unauthorized acquisition of computerized data when access to personal information has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable. Means an individual s first name or first initial and last name in combination with any of the following data elements, when the name and the data elements are not encrypted: The individual s social security number; The operator s license number; A non-driver color photo identification card number; The individual s financial institution account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual s financial accounts; The individual s date of birth; The maiden name of the individual s mother; Medical information; Health insurance information; An identification number assigned to the individual by the individual s employer; or The individual s digitized or other electronic signature. The statute only applies to computerized data with personal information that has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable. Any person shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any North Dakota resident of whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and to restore the integrity of the data system. Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following the discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. Notification must be made after the law enforcement agency determines that the notification will not compromise the investigation. Notice may be provided by one of the following methods: Written notice Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code Substitute notice may be used, if the person demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person does not have sufficient contact information. Substitute notice consists of the following: notice when the person has an address for the subject persons; Conspicuous posting of the notice on the person s website page, if the person maintains one; and Data Breach Charts current as of December 31, 2015 Page 76

77 Compliance with Notification Requirements Notification to major statewide media. A person that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute is deemed to be in compliance with the notification requirements if the person notifies subject individuals in accordance with its policies in the event of a breach of security of the system. A financial institution, trust company, or credit union that is subject to, examined for, and in compliance with the federal interagency guidance on response programs for unauthorized access to customer information and customer notice is in compliance with the statute. A covered entity, business associate, or subcontractor subject to breach notification requirements under Title 45, Code of Federal Regulations, subpart D, part 164, is considered to be in compliance with this chapter. Notice to Consumer Reporting Agencies Notice to Attorney General Violations The attorney general, in enforcing the statute, has all the powers provided in chapter and may seek all the remedies in chapter A violation of this chapter is deemed a violation of chapter The remedies, duties, prohibitions, and penalties of the statute are not exclusive and are in addition to all other causes of action, remedies, and penalties under chapter 51-15, or otherwise provided by law. Waiver Back to top Data Breach Charts current as of December 31, 2015 Page 77

78 OHIO: Ohio Rev. Code , , , Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Any state agency or agency of a political subdivision or person, or business entity that conducts business in Ohio that owns or licenses computerized data that includes personal information of Ohio residents. Means unauthorized access to and acquisition of computerized data that compromises the security or confidentiality of personal information owned or licensed by a person or state agency or an agency of a political subdivision and that causes, or reasonably is believed to have caused, or reasonably is believed will cause a material risk of identity theft or other fraud to the person or property of a resident of this state. Means an individual s name, consisting of the individual s first name or first initial and last name, in combination with and linked to any one or more of the following data elements, when the data elements are not encrypted, redacted, or altered by any method or technology in such a manner that the data elements are unreadable: Social security number; Driver s license number or state identification card number; Account number or credit or debit card number, in combination with and linked to any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to computerized data elements that are not encrypted, redacted, or altered by any method or technology in such a manner that the data elements are unreadable. Any person or agency shall disclose any breach of the security of the system, following its discovery or notification of the breach, to any resident of this state whose personal information was, or reasonably is believed to have been, accessed and acquired by an unauthorized person if the access and acquisition by the unauthorized person causes or reasonably is believed will cause a material risk of identity theft or other fraud to the resident. The disclosure shall be made in the most expedient time possible but not later than 45 days following its discovery or notification of the breach in the security of the system, subject to the legitimate needs of law enforcement activities and consistent with any measures necessary to determine the scope of the breach, including which residents personal information was accessed and acquired, and to restore the reasonable integrity of the data system. Any person or agency that is the custodian of or stores computerized data that includes personal information shall notify that other state agency or agency of a political subdivision of any breach of the security of the system in an expeditious manner, if the personal information was, or reasonably is believed to have been, accessed and acquired by an unauthorized person and if the access and acquisition by the unauthorized person causes or reasonably is believed will cause a material risk of identity theft or other fraud to a resident of this state. Notification is only required if the access and acquisition of personal information by the unauthorized person causes or reasonably is believed will cause a material risk of identity theft or other fraud to the resident. The agency may delay the disclosure or notification if a law enforcement agency determines that the disclosure or notification will impede a criminal investigation or jeopardize homeland or national security, in which case, the agency shall make the disclosure or notification after the law enforcement agency determines that disclosure or notification will not compromise the investigation or jeopardize homeland or national security. Data Breach Charts current as of December 31, 2015 Page 78

79 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Notification may be made by any of the following methods: Written notice Electronic notice, if the state agency s or agency of a political subdivision s primary method of communication with the resident to whom the disclosure must be made is by electronic means Telephone notice Substitute notice may be used, if the agency demonstrates that the agency does not have sufficient contact information, or that the cost of providing disclosure or notice to affected residents would exceed $250,000, or that the affected class of subject residents to whom disclosure or notification is required exceeds 500,000 persons. Substitute notice shall consist of all of the following: Electronic mail notice if the agency has an electronic mail address for the resident to whom the disclosure must be made; Conspicuous posting of the disclosure or notice on the agency s web site, if the agency maintains one; Notification to major media outlets, to the extent that the cumulative total of the readership, viewing audience, or listening audience of all of the outlets so notified equals or exceeds 75% of the population of Ohio. If the agency or business entity demonstrates that it has 10 employees or fewer and that the cost of providing the disclosures or notices to affected residents will exceed $10,000. Then substitute notice shall consist of all of the following: Notification by a paid advertisement in a local newspaper that is distributed in the geographic area in which the agency or business entity is located, which advertisement shall be of sufficient size that it covers at least one-quarter of a page in the newspaper and shall be published in the newspaper at least once a week for three consecutive weeks; Conspicuous posting of the disclosure or notice on the agency s or business entity s web site, if the it maintains one; (c) Notification to major media outlets in the geographic area in which the agency or business entity is located. If an agency or person is required to provide disclosure to more than 1,000 residents involved in a single occurrence of a breach of the security of the system, the agency or person shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the disclosure given by the agency or person to the residents of Ohio. An agency or person shall not delay any disclosure or notification in order to make the notification to the consumer reporting agencies. The attorney general may conduct an investigation and bring a civil action upon an alleged failure by an agency or person to comply with the requirements of the statute. The attorney general may seek appropriate relief, including a temporary restraining order, preliminary or permanent injunction, and civil penalties. Any waiver of the statute is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 79

80 OKLAHOMA: Okla. Stat , to -166 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any individual, entity, state agency, board, commission or other unit or subdivision of state government that owns or licenses computerized data that includes personal information of an Oklahoma resident, or maintains computerized data that includes personal information that it does not own. Means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of Oklahoma. Means the first name or first initial and last name of an individual in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: social security number, driver license number, or account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to the financial account of an individual. The statute only applies to the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained as part of a database of personal information regarding multiple individuals. A person or entity shall disclose any breach of the security of the system following discovery or notification of the breach to any resident of Oklahoma whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any person or entity that maintains computerized data that includes personal information that the state agency, board, commission or other unit or subdivision of state government does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. An individual or entity must disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state. The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice means one of the following methods: written notice, or electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code. Data Breach Charts current as of December 31, 2015 Page 80

81 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Substitute notice may be used, if the agency demonstrates that the cost of providing notice would exceed $250,000.00, or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when the agency has an address for the subject persons, conspicuous posting of the notice on the agency s web site page, if the agency maintains one, and notification to major statewide media. An individual, entity, state agency, board, commission or other unit or subdivision of state government that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute shall be deemed to be in compliance with the notification requirements if it notifies subject persons in accordance with its policies in the event of a breach of security of the system. A financial institution that complies with the notification requirements prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with the provisions of the statute. An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures, or guidelines established by the primary or functional federal regulator of the entity shall be deemed to be in compliance with the provisions of the statute. A violation that results in injury or loss to residents of Ohio may be enforced by the Attorney General or a district attorney in the same manner as an unlawful practice under the Oklahoma Consumer Protection Act. Except as provided below, the Attorney General or a district attorney shall have exclusive authority to bring action and may obtain either actual damages for a violation of this act or a civil penalty not to exceed $150, per breach of the security of the system or series of breaches of a similar nature that are discovered in a single investigation. A violation of this act by a state-chartered or state-licensed financial institution shall be enforceable exclusively by the primary state regulator of the financial institution. Back to top Data Breach Charts current as of December 31, 2015 Page 81

82 OREGON: Oregon Rev. Stat. 646A.600 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis A person that owns or licenses personal information that the person uses in the course of the person s business, vocation, occupation or volunteer activities and that was the subject to a breach of security. Means an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains. Means a consumer s first name or first initial and last name in combination with any one or more of the following data elements, if the data elements are not rendered unusable through encryption, redaction or other methods, or if the data elements are encrypted and the encryption key has also been acquired: Social Security number; Driver s license number or state identification card number issued by the Department of Transportation; Passport number or other identification number issued by the United States; or Financial account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to a consumer s financial account; Data from automatic measurements of a consumer s physical characteristics, such as an image of a fingerprint, retina or iris, that are used to authenticate the consumer s identity in the course of a financial transaction or other transaction; Health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the consumer; or Any information about a consumer s medical history or mental or physical condition or about a health care professional s medical diagnosis or treatment of the consumer. Means any of the data elements or any combination of the data elements described above without the consumer s first name or first initial and last name if Encryption, redaction or other methods have not rendered the data element or combination of data elements unusable; and The data element or combination of data elements would enable a person to commit identity theft against a consumer. The statute only applies if the data elements are not rendered unusable through encryption, redaction or other methods, or if the data elements are encrypted and the encryption key has also been acquired. A person that owns or licenses personal information that the person uses in the course of the person s business, vocation, occupation or volunteer activities and that was the subject to a breach of security shall give notice of the breach of security to the consumer to whom the personal information pertains after the person receives notice of a breach of security. The person shall notify the consumer in the most expeditious manner possible, without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures that are necessary to determine sufficient contact information for the affected consumer, determine the scope of the breach of security and restore the reasonable integrity, security and confidentiality of the personal information. A person that maintains or otherwise possesses personal information on behalf of, or under license of, another person shall notify the other person after discovering a breach of security. Notification is not required if, after an appropriate investigation or after consultation with relevant federal, state or local law enforcement agencies, the person reasonably determines that the consumers whose personal information was subject to the breach of security are unlikely to suffer harm. The person must document the determination in writing and maintain the documentation for at least five years. Data Breach Charts current as of December 31, 2015 Page 82

83 Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Notification may be delayed if a law enforcement agency determines that a notification will impede a criminal investigation and if the law enforcement agency requests in writing that the person delay the notification. A person that owns or licenses personal information may notify a consumer of a breach of security: In writing; Electronically, if the person customarily communicates with the consumer electronically or if the notice is consistent with the provisions regarding electronic records and signatures set forth in the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001) as that Act existed on January 1, 2016; or By telephone, if the person contacts the affected consumer directly. Notice must include at a minimum: A description of the breach of security in general terms; The approximate date of the breach of security; The type of personal information that was subject to the breach of security; Contact information for the person that owned or licensed the personal information that was subject to the breach of security; Contact information for national consumer reporting agencies; and Advice to the consumer to report suspected identity theft to law enforcement, including the Attorney General and the Federal Trade Commission. Substitute notice may be used, if the person demonstrates that the cost of notification otherwise would exceed $250,000 or that the affected class of consumers to be notified exceeds 350,000, or if the person does not have sufficient contact information to notify affected consumers. Substitute notice consists of the following: Posting the notice or a link to the notice conspicuously on the person s website if the person maintains a website; Notifying major statewide television and newspaper media. The following shall be deemed in compliance with the notification requirements of the statute: A person that complies with a state or federal law that provides greater protection to personal information than the protections that this section provides. A person that complies with regulations promulgated under Title V of the Gramm- Leach-Bliley Act of 1999 (15 U.S.C to 6809) as that Act existed on January 1, A person that complies with regulations that implement the Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. parts 160 and 164) in effect on the January 1, A person that implements an information security program with certain elements. If a person discovers a breach of security that affects more than 1,000 consumers, the person shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain reports on consumers on a nationwide basis of the timing, distribution and content of the notice the person gave to affected consumers and shall include in the notice any police report number assigned to the breach of security. A person may not delay notifying affected consumers of a breach of security in order to notify consumer reporting agencies. A person that owns or licenses personal information that the person uses in the course of the person s business, vocation, occupation or volunteer activities and that was the subject to a breach of security shall give notice of the breach of security to the Attorney General, either in writing or electronically, if the number of consumers to whom the person must send the notice exceeds 250. The Director of the Department of Consumer and Business Services may make public or private investigations within or outside Oregon to determine whether a person has violated Data Breach Charts current as of December 31, 2015 Page 83

84 Waiver any provision of ORS 646A.600 to 646A.628, or to aid in the enforcement of ORS 646A.600 to 646A.628. A person s violation of a provision of ORS 646A.600 to 646A.628 is an unlawful practice under ORS In addition to all other penalties and enforcement provisions provided by law, any person who violates or who procures, aids or abets in the violation of ORS 646A.600 to 646A.628 shall be subject to a penalty of not more than $1,000 for every violation, which shall be paid to the General Fund of the State Treasury. Every violation is a separate offense and, in the case of a continuing violation, each day s continuance is a separate violation, but the maximum penalty for any occurrence shall not exceed $500,000. Back to top Data Breach Charts current as of December 31, 2015 Page 84

85 PENNSYLVANIA: 73 Pa. Stat et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice A State agency, a political subdivision of Pennsylvania or an individual or a business doing business in Pennsylvania that maintains, stores or manages computerized data that includes personal information of a resident of Pennsylvania. The unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals and that causes or the entity reasonably believes has caused or will cause loss or injury to any resident of Pennsylvania. Means an individual s first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted: Social Security number. Driver s license number or a State identification card number issued in lieu of a driver s license. Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual s financial account. An entity must provide notice of the breach if encrypted information is accessed and acquired in an unencrypted form, if the security breach is linked to a breach of the security of the encryption or if the security breach involves a person with access to the encryption key. An entity shall provide notice of any breach of the security of the system following discovery of the breach of the security of the system to any resident of Pennsylvania whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person. The disclosure shall be without unreasonable delay, consistent with the legitimate needs of law enforcement, or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. A vendor that maintains, stores or manages computerized data on behalf of another entity shall provide notice of any breach of the security system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data. The entity shall be responsible for making the determinations and discharging any remaining duties under this act. Notification is required if the unauthorized access and acquisition of computerized data materially compromises the security or confidentiality of personal information causes or the entity reasonably believes has caused or will cause loss or injury to any resident of Pennsylvania. Notification may be delayed if a law enforcement agency determines and advises the entity in writing specifically referencing the statute that the notification will impede a criminal or civil investigation. Notification shall be made after the law enforcement agency determines that it will not compromise the investigation or national or homeland security. Notice may be provided by any of the following methods: Written notice to the last known home address for the individual. Telephonic notice, if the customer can be reasonably expected to receive it and the notice is given in a clear and conspicuous manner, describes the incident in general terms and verifies personal information but does not require the customer to provide personal information and the customer is provided with a telephone number to call or Internet website to visit for further information or assistance. notice, if a prior business relationship exists and the person or entity has a valid address for the individual. Data Breach Charts current as of December 31, 2015 Page 85

86 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Substitute notice may be used, if the entity demonstrates the cost of providing notice would exceed $100,000; the affected class of subject persons to be notified exceeds 175,000; or the entity does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when the entity has an address for the subject persons. Conspicuous posting of the notice on the entity s Internet website if the entity maintains one. Notification to major Statewide media. An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and is consistent with the notice requirements of the statute shall be deemed to be in compliance with the notification requirements if it notifies subject persons in accordance with its policies in the event of a breach of security of the system. A financial institution that complies with the notification requirements prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with the statute. An entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures or guidelines established by the entity s primary or functional Federal regulator shall be in compliance with the statute. When an entity provides notification to more than 1,000 persons at one time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in Section 603 of the Fair Credit Reporting Act (Public Law , 15 U.S.C. 1681a), of the timing, distribution and number of notices. A violation of the statute shall be deemed to be an unfair or deceptive act or practice in violation of the act of December 17, 1968 (P.L. 1224, No. 387), known as the Unfair Trade Practices and Consumer Protection Law. The Office of Attorney General shall have exclusive authority to bring an action under the Unfair Trade Practices and Consumer Protection Law for a violation of the statute. Back to top Data Breach Charts current as of December 31, 2015 Page 86

87 RHODE ISLAND: R.I. Gen. Laws et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Notice to Consumer Reporting Agencies Any state agency or person that owns, maintains or licenses computerized data that includes personal information about a Rhode Island resident. Means unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the state agency or person. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: Social security number; Driver s license number or Rhode Island Identification Card number; Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to personal information that is neither unencrypted nor redacted. A state agency or person shall disclose any breach of the security of the system which poses a significant risk of identity theft following discovery or notification of the breach in the security of the data to any resident of Rhode Island whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person or a person without authority, to acquire said information. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any state agency or person that maintains computerized unencrypted data that includes personal information that the state agency or person does not own shall notify the owner or licensee of the information of any breach of the security of the data which poses a significant risk of identity theft immediately, following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification of a breach is not required if, after an appropriate investigation or after consultation with relevant federal, state, or local law enforcement agencies, a determination is made that the breach has not and will not likely result in a significant risk of identity theft to the individuals whose personal information has been acquired. Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. Notification shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice may be provided by one of the following methods: Written notice Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set for the in Section 7001 of Title 15 of the United States Code Substitute notice may be used, if the state agency or person demonstrates that the cost of providing notice would exceed $25,000, or that the affected class of subject persons to be notified exceeds 50,000, or the state agency or person does not have sufficient contact information. Substitute notice shall consist of all of the following: notice when the state agency or person has an address for the subject persons; Conspicuous posting of the notice on the state agency s or person s website page, if the state agency or person maintains one; and Notification to major statewide media. Data Breach Charts current as of December 31, 2015 Page 87

88 Notice to Attorney General Compliance with Notification Requirements Violations Waiver Any state agency or person that maintains its own security breach procedures as part of an information security policy for the treatment of personal information and otherwise complies with the timing requirements, shall be deemed to be in compliance with the security breach notification requirements, provided such person notifies subject persons in accordance with such person s policies in the event of a breach of security. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of the statute, provided such person notifies subject persons in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security of the system. A financial institution, trust company, credit union or its affiliates that is subject to and examined for, and found in compliance with the Federal Interagency Guidelines on Response Programs for Unauthorized Access to Customer Information and Customer Notice shall be deemed in compliance with the statute. A provider of health care, health care service plan, health insurer, or a covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall be deemed in compliance with the chapter. Any state agency or person required to make notification and who fails to do so promptly is liable for a fine of not more than a $100 per occurrence and not more than $25,000 may be adjudged against a defendant. Any waiver of a provision of the statute is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 88

89 SOUTH CAROLINA: S.C. Code , 2013 H.B Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice A person conducting business in South Carolina, and owning or licensing or maintaining computerized data or other data that includes personal identifying information of a South Caroline resident. Means unauthorized access to and acquisition of computerized data that was not rendered unusable through encryption, redaction, or other methods that compromises the security, confidentiality, or integrity of personal identifying information maintained by the person, when illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to a resident. Means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of this State, when the data elements are neither encrypted nor redacted: social security number; driver s license number or state identification card number issued instead of a driver s license; financial account number, or credit card or debit card number in combination with any required security code, access code, or password that would permit access to a resident s financial account; or other numbers or information which may be used to access a person s financial accounts or numbers or information issued by a governmental or regulatory entity that uniquely will identify an individual. The statute only applies to computerized data that was not rendered unusable through encryption, redaction, or other methods that compromises the security, confidentiality, or integrity of personal identifying information. A person shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of South Carolina whose personal identifying information that was not rendered unusable through encryption, redaction, or other methods was, or is reasonably believed to have been, acquired by an unauthorized person when the illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to the resident. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or with measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. A person conducting business in this State and maintaining computerized data or other data that includes personal identifying information that the person does not own shall notify the owner or licensee of the information of a breach of the security of the data immediately following discovery, if the personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification is required when personal identifying information that was not rendered unusable through encryption, redaction, or other methods, was or is reasonably believed to have been acquired by an unauthorized person and illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to a resident. Notification may be delayed if a law enforcement agency determines that the notification impedes a criminal investigation. Notification must be made after the law enforcement agency determines that it no longer compromises the investigation. Notice may be provided by: written notice; electronic notice, if the person s primary method of communication with the individual is by electronic means or is consistent with the provisions regarding electronic records and signatures in Section 7001 of Title 15 USC and Chapter 6, Data Breach Charts current as of December 31, 2015 Page 89

90 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Title 11 of the 1976 Code; or telephonic notice Substitute notice may be used, if the person demonstrates that the cost of providing notice exceeds $250,000 or that the affected class of subject persons to be notified exceeds 500,000 or the person has insufficient contact information. Substitute notice consists of: notice when the person has an address for the subject persons; conspicuous posting of the notice on the web site page of the person, if the person maintains one; or notification to major statewide media A person that maintains its own notification procedures as part of an information security policy for the treatment of personal identifying information and is otherwise consistent with the timing requirements of the statute is considered to be in compliance with the notification requirements if the person notifies subject persons in accordance with its policies in the event of a breach of security of the system. A financial institution that is subject to and in compliance with the federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice, issued March 7, 2005, by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision, as amended, is considered to be in compliance with the statute. If a business provides notice to more than 1,000 persons at one time, the business shall notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs and all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined in 15 USC Section 1681a(p), of the timing, distribution, and content of the notice. A resident of this South Caroline who is injured by a violation of the statute, in addition to and cumulative of all other rights and remedies available at law, may: (1) institute a civil action to recover damages in case of a wilful and knowing violation; (2) institute a civil action that must be limited to actual damages resulting from a violation in case of a negligent violation of this section; (3) seek an injunction to enforce compliance; and (4) recover attorney s fees and court costs, if successful. A person who knowingly and wilfully violates the statute is subject to an administrative fine in the amount of $1,000 for each resident whose information was accessible by reason of the breach, the amount to be decided by the Department of Consumer Affairs. Back to top Data Breach Charts current as of December 31, 2015 Page 90

91 SOUTH DAKOTA No legislation. Back to top Data Breach Charts current as of December 31, 2015 Page 91

92 TENNESSEE: Tenn. Code Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements Any person or business that conducts business in Tennessee, or any agency of the state of Tennessee or any of its political subdivisions, that owns or licenses computerized data that includes personal information. Means unauthorized acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder. Means an individual s first name or fist initial and last name, in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver s license number or state identification card number issued instead of a driver s license; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual s financial account. The statute only applies to unencrypted computerized data containing personal information. Any information holder shall disclose any breach of the security of the system, following discovery or notification of the breach in the security of the data, to any resident of Tennessee whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any information holder that maintains computerized data that includes personal information that the information holder does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice is only required if the unauthorized acquisition of unencrypted computerized data is determined to materially compromise the security, confidentiality, or integrity of the personal information. Notification may be delayed, if a law enforcement agency determines that the notification will impede a criminal investigation. Notification shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice may be provided by one of the following methods: Written notice; or Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C Substitute notice may be used, if the information holder demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the information holder does not have sufficient contact information. Substitute notice shall consist of all of the following: notice, when the information holder has an address for the subject persons; Conspicuous posting of the notice on the information holder s Internet web site page, if the information holder maintains such web site page; and Notification to major statewide media. An information holder that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and is otherwise consistent with the timing requirements of the statute, shall be deemed to be in compliance Data Breach Charts current as of December 31, 2015 Page 92

93 Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver with the notification requirements, if it notifies subject persons in accordance with its policies in the event of a breach of security of the system. If notification is required to be sent to more than 1,000 persons at one time, the person shall also notify, without unreasonable delay, all consumer reporting agencies and credit bureaus that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. 1681a, of the timing, distribution and content of the notices. Any customer of an information holder who is a person or business entity, but who is not an agency of the state or any political subdivision of Tennessee, and who is injured by a violation of the statute, may institute a civil action to recover damages and to enjoin the person or business entity from further action in violation of the statute. The rights and remedies available under the statute are cumulative to each other and to any other rights and remedies available under law. Back to top Data Breach Charts current as of December 31, 2015 Page 93

94 TEXAS: Tex. Bus. & Com. Code , Persons Covered Definition of Security Breach Sensitive Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information. Means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data. Mean an individual s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: social security number; driver s license number or government-issued identification number; or account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual s financial account; or Means information that identifies an individual and relates to: the physical or mental health or condition of the individual; the provision of health care to the individual; or payment for the provision of health care to the individual. The statute applies to personal information that is neither unencrypted nor redacted or encrypted data if the person accessing the data has the key required to decrypt the data. A person shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made as quickly as possible or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. A person may delay providing notice at the request of a law enforcement agency that determines that the notification will impede a criminal investigation. The notification shall be made as soon as the law enforcement agency determines that the notification will not compromise the investigation. A person required to provide notice of the breach of system security, may provide notice according to the security breach notification of laws of the affected individual s state, if any, or Texas law as described below. A person may give notice by providing: written notice at the last known address of the individual; electronic notice, if the notice is provided in accordance with 15 U.S.C. Section 7001 If the person required to give notice demonstrates that the cost of providing notice would exceed $250,000, the number of affected persons exceeds 500,000, or the person does not have sufficient contact information, the notice may be given by: electronic mail, if the person has electronic mail addresses for the affected persons; conspicuous posting of the notice on the person s website; or notice published in or broadcast on major statewide media. A person who maintains the person s own notification procedures as part of an information security policy for the treatment of sensitive personal information that complies with the Data Breach Charts current as of December 31, 2015 Page 94

95 timing requirements for notice under the statute complies with the notification requirements if the person notifies affected persons in accordance with that policy. Notice to Consumer If a person is required to notify at one time more than 10,000 persons of a breach of system Reporting Agencies security, the person shall also notify each consumer reporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices. The person shall provide the notice without unreasonable delay. Notice to Attorney General Violations A person who violates the statute is liable to the state for a civil penalty of at least $2,000 but not more than $50,000 for each violation. The attorney general may bring an action to recover the civil penalty imposed. Waiver Back to top Additionally, a person who fails to take reasonable action to comply with the notification requirements is liable to the state for a civil penalty of not more than $100 for each individual to whom notification is due for each consecutive day that the person fails to provide notice. Civil penalties may not exceed $250,000 for all individuals to whom notification is due after a single breach. The attorney general may bring an action to recover the civil penalties imposed under this subsection. The attorney general may also bring an action for a temporary restraining order or for permanent or temporary injunction. Data Breach Charts current as of December 31, 2015 Page 95

96 UTAH: Utah Code et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice A person who owns or licenses computerized data that includes personal information concerning a Utah resident. Means an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information. Means a person s first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable: Social Security number; financial account number, or credit or debit card number; and any required security code, access code, or password that would permit access to the person s account; or driver license number or state identification card number. The statute only applies to personal information that is neither unencrypted nor redacted. When the person becomes aware of a breach of system security, the person shall provide the notification to the affected Utah resident in the most expedient time possible without unreasonable delay consistent with the legitimate investigative needs of law enforcement, after determining the scope of the breach of system security and restoring the reasonable integrity of the system. A person who maintains computerized data that includes personal information that the person does not own or license shall notify and cooperate with the owner or licensee of the information of any breach of system security immediately following the person s discovery of the breach if misuse of the personal information occurs or is reasonably likely to occur. Cooperation includes sharing information relevant to the breach with the owner or licensee of the information. A person shall conduct in good faith, a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused for identity theft or fraud purposes. If the investigation reveals that the misuse of personal information for identity theft or fraud purposes has occurred, or is reasonably likely to occur, the person shall provide notification to each affected Utah resident. Notification may be delayed at the request of a law enforcement agency that determines that notification may impede a criminal investigation. Notification shall be provided in good faith without unreasonable delay in the most expedient time possible after the law enforcement agency informs the person that notification will no longer impede the criminal investigation. Notice may be provided: in writing by first-class mail to the most recent address the person has for the resident; electronically, if the person s primary method of communication with the resident is by electronic means, or if provided in accordance with the consumer disclosure provisions of 15 U.S.C. Section 7001; by telephone, including through the use of automatic dialing technology not prohibited by other law; or by publishing notice of the breach of system security: o in a newspaper of general circulation; and o as required in Section Data Breach Charts current as of December 31, 2015 Page 96

97 Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If a person maintains the person s own notification procedures as part of an information security policy for the treatment of personal information the person is considered to be in compliance with the statute s notification requirements if the procedures are otherwise consistent with the statute s timing requirements and the person notifies each affected Utah resident in accordance with the person s information security policy in the event of a breach. A person who is regulated by state or federal law and maintains procedures for a breach of system security under applicable law established by the primary state or federal regulator is considered to be in compliance with this part if the person notifies each affected Utah resident in accordance with the other applicable law in the event of a breach. The attorney general may enforce the statute s provisions. A person who violates the statute s provisions is subject to a civil fine of no more than $2,500 for a violation or series of violations concerning a specific consumer, and no more than $100,000 in the aggregate for related violations concerning more than one consumer. In addition to civil penalties, the attorney general may seek injunctive relief to prevent future violations. The Division of Corporations and Commercial Code or any other relevant entity shall revoke any authorization to do business in Utah of a person who fails to pay any amount required under the statute. Nothing in this chapter creates a private right of action. Nothing in this chapter affects any private right of action existing under other law, including contract or tort. A waiver of this section is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 97

98 VERMONT: Vt. Stat. tit , 2435 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification The State, State agencies, political subdivisions of the State, public and private universities, privately and publicly held corporations, limited liability companies, financial institutions, retail operators, and any other entity ( data collector ) that, for any purpose owns or licenses computerized personally identifiable information that includes personal information concerning a Vermont resident. Means unauthorized acquisition of electronic data or a reasonable belief of an unauthorized acquisition of electronic data that compromises the security, confidentiality, or integrity of a consumer s personally identifiable information maintained by the data collector. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or protected by another method that renders them unreadable or unusable by unauthorized persons: Social Security number; Motor vehicle operator s license number or non-driver identification card number; Financial account number or credit or debit card number, if circumstances exist in which the number could be used without additional identifying information, access codes, or passwords; Account passwords or personal identification numbers or other access codes for a financial account. The statute only applies to personally identifiable information that is not encrypted or redacted or protected by another method that renders them unreadable or unusable by unauthorized persons. A data collector shall notify the consumer that there has been a security breach following discovery or notification to the data collector of the breach. Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system. Any data collector that maintains or possesses computerized data containing personally identifiable information of a consumer that the data collector does not own or license or any data collector that acts or conducts business in Vermont that maintains or possesses records or data containing personally identifiable information that the data collector does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement. Notification is not required if the data collector establishes that misuse of personal information is not reasonably possible. The data collector shall provide notice of the determination and a detailed explanation to the Vermont Attorney General or to the Department of Financial Regulation, as appropriate. Notification shall be delayed upon request of a law enforcement agency if it believes that notification may impede a law enforcement investigation, or a national or Homeland Security investigation or jeopardize public safety or national or Homeland Security interests. In the event law enforcement makes the request in a manner other than in writing, the data collector shall document such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer s law enforcement agency engaged in the investigation. Notification shall be made without unreasonable delay upon receipt of a written communication from the law enforcement agency withdrawing its request for delay. Data Breach Charts current as of December 31, 2015 Page 98

99 Methods of Notice Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General The notice to a consumer shall be clear and conspicuous. The notice shall include the following, if known to the data collector: The incident in general terms. The type of personally identifiable information that was subject to the security breach. The general acts of the data collector to protect the personally identifiable information from further security breach. A telephone number, toll-free if available, that the consumer may call for further information and assistance. Advice that directs the consumer to remain vigilant by reviewing account statements and monitoring free credit reports. The approximate date of the security breach. Notice may be provided by one of the following methods: Direct notice to consumers, which may be by one of the following methods: o Written notice mailed to the consumer s residence; o Electronic notice, for those consumers for whom the data collector has a valid address; or o Telephonic notice, provided that telephonic contact is made directly with each affected consumer, and the telephonic contact is not through a prerecorded message. Substitute notice may be used, if the data collector demonstrates that the cost of providing written or telephonic notice would exceed $5,000 or that the affected class of affected consumers to be provided written or telephonic notice exceeds 5,000, or the data collector does not have sufficient contact information. Substitute notice shall consist of all of the following: conspicuous posting of the notice on the data collector s website page if the data collector maintains one; and notification to major statewide and regional media. If a data collector provides notice to more than 1,000 consumers at one time, the data collector shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. 1681a(p), of the timing, distribution, and content of the notice. This subsection shall not apply to a person who is licensed or registered under Title 8 by the Department of Financial Regulation. The data collector shall notify the Attorney General or the Department of Financial Regulation, as applicable, of the date of the security breach and the date of discovery of the breach and shall provide a preliminary description of the breach within 14 business days, consistent with the legitimate needs of the law enforcement agency of the data collector s discovery of the security breach or when the data collector provides notice to consumers, whichever is sooner. A data collector who, prior to the date of the breach, had sworn in writing to the Attorney General that it maintains written policies and procedures to maintain the security of personally identifiable information and respond to a breach in a manner consistent with Vermont law shall notify the Attorney General of the date of the security breach and the date of discovery of the breach and shall provide a description of the breach prior to providing notice of the breach to consumers. Data Breach Charts current as of December 31, 2015 Page 99

100 Violations Waiver The Attorney General and state s attorney shall have sole and full authority to investigate potential violations and to enforce, prosecute, obtain, and impose remedies for a violation. The Attorney General may refer the matter to the state s attorney in an appropriate case. With respect to a person or entity licensed or registered with the Department of Financial Regulation under Title 8 or this title, the Department shall have the full authority to investigate potential violations and to prosecute, obtain, and impose remedies for a violation of the statute or any rules or regulations adopted pursuant to the statute. Any waiver of the provisions of the statute is contrary to public policy and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 100

101 VIRGINIA: Va. Code , :05 Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice An individual or entity that owns or licenses computerized data that includes personal information of a resident of Virginia Means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of Virginia. Means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a Virginia resident, when the data elements are neither encrypted nor redacted: Social security number; Driver s license number or state identification card number issued in lieu of a driver s license number; or Financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to a resident s financial accounts. An entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key. An individual or entity shall disclose any breach of the security of the system following discovery or notification of the breach of the security if unencrypted or unredacted personal was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any Virginia resident. Notice must be made given without unreasonable delay. An entity that maintains computerized data that includes personal information that the entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the personal information was accessed and acquired by an unauthorized person. An individual or entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such a breach has caused or will cause identity theft or other fraud to any Virginia resident. Notice may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice may be delayed if, after the individual or entity notifies a law-enforcement agency, the law-enforcement agency determines and advises that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security. Notice means: Written notice to the last known postal address in the records of the individual or entity Telephone notice Electronic notice Data Breach Charts current as of December 31, 2015 Page 101

102 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver Substitute notice may be used, if the individual or the entity demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the individual or the entity does not have sufficient contact information or consent to provide notice. Substitute notice consists of all of the following: notice if the individual or the entity has addresses for the members of the affected class of residents; Conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a website; and Notice to major statewide media. Notice shall include a description of the following: The incident in general terms; The type of personal information that was subject to the unauthorized access and acquisition; The general acts of the individual or entity to protect the personal information from further unauthorized access; A telephone number that the person may call for further information and assistance, if one exists; and Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports. An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information that are consistent with the timing requirements of the statute shall be deemed to be in compliance with the notification requirements if it notifies residents of Virginia in accordance with its procedures in the event of a breach of the security of the system. An entity that is subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C et seq.) and maintains procedures for notification of a breach of the security of the system in accordance with the provision of that Act and any rules, regulations, or guidelines promulgated thereto shall be deemed to be in compliance with the statute. An entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the entity s primary or functional state or federal regulator shall be in compliance with the statute. If an individual or entity is required to provide notice to more than 1,000 persons at one time, the individual or entity shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. 1681a(p), of the timing, distribution, and content of the notice. If an individual or entity is required to provide notice to more than 1,000 persons at one time, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General of the timing, distribution, and content of the notice. The Attorney General may bring an action to address violations of the statute. The Office of the Attorney General may impose a civil penalty not to exceed $150,000 per breach of the security of the system or a series of breaches of a similar nature that are discovered in a single investigation. Nothing in the statute shall limit an individual from recovering direct economic damages from a violation of the statute. A violation of the statute by a state-chartered or licensed financial institution shall be enforceable exclusively by the financial institution s primary state regulator. A violation of the statute by an individual or entity regulated by the State Corporation Commission s Bureau of Insurance shall be enforced exclusively by the State Corporation Commission. Back to top Data Breach Charts current as of December 31, 2015 Page 102

103 WASHINGTON: Wash. Rev. Code , , , H.B (effective 7/24/15) Persons Covered Definition of Security Breach Definition of Personal Information Definition of Secured Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Any person, business or agency that owns or licenses data that includes personal information Means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the person, business or agency. Means an individual s first name or first initial and last name in combination with any one or more of the following data elements: Social security number; Driver s license number or Washington identification card number; or Full account number, credit or debit card number or any required security code, access code, or password that would permit access to an individual s financial account. Means encrypted in a manner that meets or exceeds the national institute of standards and technology (NIST) standard or is otherwise modified so that the personal information is rendered unreadable, unusuable, or undecipherable by an unauthorized person. A breach of secured personal information must be disclosed only if the information acquired and accessed is not secured during a security breach or if the confidential process, encryption key, or other means to decipher the secured information was acquired by an unauthorized person. See above for definition of secured. Any person or business or agency shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of WA whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person and personal information was not secured. Any person or business or agency that maintains data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification to affected consumers/individuals and to the attorney general must be made in the most expedient time possible and without unreasonable delay, no more than forty-five calendar days after the breach was discovered, unless at the request of law enforcement, or due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. A person or business or agency shall not be required to provide notice if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm. Notification may be delayed if the data owner or licensee contacts a law enforcement agency after discovery of a breach of the security of the system and a law enforcement agency determines that the notification will impede a criminal investigation. Notification shall be made after the law enforcement agency determines that it will not compromise the investigation. Notice may be provided by one of the following methods: Written notice; Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures, 15 U.S.C. Sec Notice shall meet all of the following requirements: The notification must be written in plain language; and The notification must include at a minimum, the following information: o Name and contact information of the reporting person or business or agency required to give notice Data Breach Charts current as of December 31, 2015 Page 103

104 Substitute Notice Compliance with Notification Requirements o A list of the types of personal information that were or are reasonably believed to have been the subject of a breach; and o The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed personal information Substitute notice may be used, if the person, business, or agency demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following: notice; Conspicuous posting of the notice on the web site page of the person, business or agency, if one is maintained; and Notification to major statewide media. A person, business or agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the statute is in compliance with the notification requirements if subject persons are notified in accordance with its policies in the event of a breach of security of the system. HIPPA: A covered entity under the federal health insurance portability and accountability act of 1996, 42 U.S.C. Sec. 1320d et seq., is deemed to have complied with the requirements with respect to protected health information if it has complied with section of the federal health information technology for economic and clinical health act, Public Law as it existed on the effective date of this section. Covered entities shall notify the attorney general in compliance with the timeliness of notification requirements of section of the federal health information technology for economic and clinical health act, Public Law as it existed on the effective date of this section, notwithstanding the notification requirement in subsection (16) of this section. Financial Institutions: A financial institution under the authority of the office of the comptroller of the currency, the federal deposit insurance corporation, the national credit union administration, or the federal reserve system is deemed to have complied with the requirements of this section with respect to "sensitive customer information" as defined in the interagency guidelines establishing information security standards, 12 C.F.R. Part 30, Appendix B, 12 C.F.R. Part 22208, Appendix D-2, 12 C.F.R. Part 225, Appendix F, and 12 C.F.R. Part 23364, Appendix B, and 12 C.F.R. Part 748, Appendices A and B, as they existed on the effective date of this section, if the financial institution provides notice to affected consumers pursuant to the interagency guidelines and the notice complies with the customer notice provisions of the interagency guidelines establishing information security standards and the interagency guidance on response programs for unauthorized access to customer information and customer notice under 12 C.F.R. Part 364 as it existed on the effective date of this section. The entity shall notify the attorney general pursuant to subsection (15) of this section in addition to providing notice to its primary federal regulator. Notice to Consumer Reporting Agencies Notice to Attorney General Any person or business or agency that is required to issue a notification to more than 500 Washington residents as a result of a single breach shall, by the time notice is provided to the affected consumers, electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. The person or business shall also provide to the Attorney General the number of Washington consumers affected by the breach, or an estimate if the exact number is not known. Data Breach Charts current as of December 31, 2015 Page 104

105 Violations Waiver The Attorney General may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state. For actions brought by the Attorney General, the legislature finds that the practices covered by the statute are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter RCW. Additionally, a violation of this statute is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade and commerce and an unfair method of competition for purposes of applying the consumer protection act, chapter RCW. An action to enforce the statute may not be brought under RCW Any consumer/individual injured by a violation of this section may institute a civil action to recover damages. Any person or business that violates, proposes to violate, or has violated the statute may be enjoined. The rights and remedies available under the statute are cumulative to each other and to any other rights and remedies available under law. Any agency that violates, proposes to violate or has violated this statute may be enjoined. The rights and remedies available under the statute are cumulative to each other and to any other rights and remedies available under the law. Processors, businesses, and vendors are not liable under RCW if (a) the account information was encrypted at the time of the breach, or (b) the processor, business, or vendor was certified compliant with the payment card industry data security standards adopted by the payment card industry security standards council, and in force at the time of the breach. If a processor, business, or vendor fails to take reasonable care to guard against unauthorized access to account information that is in its the possession or under the control, and the failure is found to be the proximate cause of a breach, it is liable to a financial institution for reimbursement of reasonable actual costs related to the reissuance of credit cards and debit cards, even if the financial institution has not suffered a physical injury in connection with the breach. In any legal action, the prevailing party is entitled to recover its reasonable attorneys fees and costs incurred. Any waiver of the provisions of the statute is contrary to public policy, and is void and unenforceable. Back to top Data Breach Charts current as of December 31, 2015 Page 105

106 WEST VIRGINIA: W.V. Code 46A-2A-101 et seq. Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice An individual or entity that owns or licenses or maintains computerized data that includes personal information of a West Virginia resident. Means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes the individual or entity to reasonably believe that the breach of security has caused or will cause identity theft or other fraud to any resident of West Virginia. Means the first name or first initial and last name linked to any one or more of the following data elements that relate to a West Virginia resident, when the data elements are neither encrypted nor redacted: Social security number; Driver s license number or state identification card number issued in lieu of a driver s license; or Financial account number, or credit card, or debit card number in combination with any required security code, access code or password that would permit access to a resident s financial accounts. The statute only applies to computerized data containing personal information that is neither encrypted nor redacted. An individual or entity shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any West Virginia resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state. An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery, if the personal information was or the entity reasonably believes was accessed and acquired by an unauthorized person. Except to take measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the notice shall be made without unreasonable delay. An individual or entity must give notice of the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state. Notice required may be delayed if a law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation or homeland or national security. Notice must be made without unreasonable delay after the lawenforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security. Notice may be provided by the following methods: Written notice to the postal address in the records of the individual or entity; Telephonic notice; Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures, set forth in Section 7001, United States Code Title 15, Electronic Signatures in Global and National Commerce Act. The notice shall include: To the extent possible, a description of the categories of information that were reasonably believed to have been accessed or acquired by an unauthorized person, Data Breach Charts current as of December 31, 2015 Page 106

107 Substitute Notice Compliance with Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver including social security numbers, driver s licenses or state identification numbers and financial data; A telephone number or website address that the individual may use to contact the entity or the agent of the entity and from whom the individual may learn: o What types of information the entity maintained about that individual or about individuals in general; and o Whether or not the entity maintained information about that individual. The toll-free contact telephone numbers and addresses for the major credit reporting agencies and information on how to place a fraud alert or security freeze. Substitute notice by may be used, if the individual or the entity demonstrates that the cost of providing notice will exceed $50,000 or that the affected class of residents to be notified exceeds 100,000 persons or that the individual or the entity does not have sufficient contact information or to provide notice as described above. Substitute notice consists of any two of the following: notice if the individual or the entity has addresses for the members of the affected class of residents; Conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a website; or Notice to major statewide media. An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and that are consistent with the timing requirements of the statute shall be deemed to be in compliance with the notification requirements if it notifies residents of West Virginia in accordance with its procedures in the event of a breach of security of the system. A financial institution that responds in accordance with the notification guidelines prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with the statute. An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures or guidelines established by the entity s primary or functional regulator shall be in compliance with the statute. If an entity is required to notify more than 1,000 persons of a breach of security, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on a nationwide basis of the timing, distribution and content of the notices. Failure to comply with the notice provisions constitutes an unfair or deceptive act of practice, which may be enforced by the Attorney General, who has exclusive authority to bring an action. No civil penalty may be assessed in an action unless the court finds that the defendant has engaged in a course of repeated and willful violations. No civil penalty shall exceed $150,000 per breach of security of the system or series of breaches of a similar nature that are discovered in a single investigation. A violation by a licensed financial institution shall be enforceable exclusively by the financial institution s primary functional regulator. Back to top Data Breach Charts current as of December 31, 2015 Page 107

108 WISCONSIN: Wis. Stat Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Any person, other than an individual, that does any of the following: Conducts business in Wisconsin and maintains personal information in the ordinary course of business. Licenses personal information in Wisconsin. Maintains for a resident of Wisconsin a depository account as defined in Section (2)(e). Lends money to a resident of Wisconsin. Means the unauthorized acquisition of personal information in the entity s possession. Means an individual s last name and the individual s first name or first initial, in combination with and linked to any of the following elements, if the element is not publicly available information and is not encrypted, redacted, or altered in a manner that renders the element unreadable: The individual s social security number. The individual s driver s license number or state identification number. The number of the individual s financial account number, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual s financial account. The individual s DNA profile. The individual s unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation. The statute only applies to personal information that is not encrypted, redacted, or altered in a manner that renders the element unreadable. If the entity knows that personal information in the entity s possession has been acquired by an unauthorized person, the entity shall make reasonable efforts to notify each affected person. If a person that stores personal information pertaining to a resident of Wisconsin, but does not own or license the personal information, knows that the personal information has been acquired by an unauthorized person, the person shall notify the person that owns or licenses the personal information of the acquisition as soon as practicable. An entity shall provide the notice within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information. A determination as to reasonableness shall include consideration of the number of notices that an entity must provide and the methods of communication available to the entity. An entity is not required to provide notice if the acquisition of personal information does not create a material risk of identity theft or fraud to the subject of the personal information. A law enforcement agency may, in order to protect an investigation or homeland security, ask an entity not to provide a notice that is otherwise required for any period of time and the notification process required shall begin at the end of that time period. If an entity receives such a request, the entity may not provide notice of or publicize an unauthorized acquisition of personal information, except as authorized by the law enforcement agency that made the request. An entity shall provide the notice: by mail or by a method the entity has previously employed to communicate with the affected persons. If an entity cannot with reasonable diligence determine the mailing address of the subject of the personal information, and if the entity has not previously communicated with the subject of the personal information, the entity shall provide notice by a method reasonably calculated to provide actual notice to the subject of the personal information. Data Breach Charts current as of December 31, 2015 Page 108

109 Notification Requirements Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver If, as the result of a single incident, an entity is required to notify 1,000 or more individuals, the entity shall without unreasonable delay notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 USC 1681a(p), of the timing, distribution, and content of the notices sent to the individuals Failure to comply with the statute is not negligence or a breach of any duty, but may be evidence of negligence or a breach of a legal duty. Back to top Data Breach Charts current as of December 31, 2015 Page 109

110 WYOMING: Wyo. Stat et seq., SF 35, SF 36 (eff. July 1, 2015) Persons Covered Definition of Security Breach Definition of Personal Information Encryption Safe Harbor Notice Procedures/Timing An individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data or maintains information on behalf of another business entity that includes personal identifying information about a resident of Wyoming. Means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal identifying information maintained by a person or business and causes or is reasonably believed to cause loss or injury to a resident of this state. Means the first name or first initial and last name of a person in combination with one or more of the data elements specified in W.S (b)(iii) through (xiv), when the data elements are not redacted. W.S (b)(iii) through (xiv) data elements are as follows: Address; Telephone number; Social security number; Driver's license number; Account number, credit card number or debit card number in combination with any security code, access code or password that would allow access to a financial account of the person; Tribal identification card; Federal or state government issued identification card; Shared secrets or security tokens that are known to be used for data based authentication; A username or address, in combination with a password or security question and answer that would permit access to an online account; A birth or marriage certificate; Medical information, meaning a person s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; Health insurance information, meaning a person s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the person or information related to a person s application and claims history; Unique biometric data, meaning data generated from measurements or analysis of human body characteristics for authentication purposes; An individual taxpayer identification number. The statute only applies to personal information that is neither unencrypted nor redacted. If an investigation determines that the misuse of personal identifying information has occurred or is reasonably likely to occur, the individual or the commercial entity shall give notice as soon as possible to the affected Wyoming resident. Notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity any breach of the security of the system as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The person who maintains the data on behalf of another business entity and the business entity on whose behalf the data is maintained may agree which person or entity will provide any required notice, provided only a single notice for each Data Breach Charts current as of December 31, 2015 Page 110

111 Risk of Harm Analysis Allowable Delay in Notification Methods of Notice Substitute Notice Compliance with Notification Requirements breach of the security of the system shall be required. If agreement regarding notification cannot be reached, the person who has the direct business relationship with the Wyoming resident shall provide notice. Notification is required, if after a good faith, reasonable and prompt investigation, the entity determines that the breach has materially compromised the security, confidentiality, or integrity of the personal information of one or more Wyoming residents and misuse of the information has occurred or is reasonably likely to occur. The notification required by this section may be delayed if a law enforcement agency determines in writing that the notification may seriously impede a criminal investigation. Notice to consumers may be provided by one of the following methods: Written notice Electronic mail notice Notice shall be clear and conspicuous and include at a minimum: A toll-free number that the individual may use to contact the person collecting the data, or his agent; and from which the individual may learn the toll-free contact telephone numbers and addresses for the major credit reporting agencies. The types of personal identifying information that were or are reasonably believed to have been the subject of the breach; A general description of the breach incident; The approximate date of the breach of security, if that information is reasonably possible to determine at the time notice is provided; In general terms, the actions taken by the individual or commercial entity to protect the system containing the personal identifying information from further breaches; Advice that directs the person to remain vigilant by reviewing account statements and monitoring credit reports; Whether notification was delayed as a result of a law enforcement investigation, if that information is reasonably possible to determine at the time the notice is provided. Substitute notice may be used, if the person demonstrates that the cost of providing notice would exceed $10, for Wyoming-based persons or businesses, and $250, for all other businesses operating but not based in Wyoming; that the affected class of subject persons to be notified exceeds 10,000 for Wyoming-based persons or businesses and 500,000 for all other businesses operating but not based in Wyoming; or the person does not have sufficient contact information. Substitute notice shall consist of all of the following: Conspicuous posting of the notice on the Internet, the World Wide Web or a similar proprietary or common carrier electronic system site of the person collecting the data, if the person maintains a public Internet, the World Wide Web or a similar proprietary or common carrier electronic system site; and Notification to major statewide media. The notice to media shall include a toll-free phone number where an individual can learn whether or not that individual s personal data is included in the security breach. Any financial institution as defined in 15 U.S.C or federal credit union as defined by 12 U.S.C that maintains notification procedures subject to the requirements of 15 U.S.C. 6801(b)(3) and 12 C.F.R. Part 364 Appendix B or Part 748 Appendix B, is deemed to be in compliance with the statute if the financial institution notifies affected Wyoming customers in compliance with the requirements of 15 U.S.C through 6809 and 12 C.F.R. Part 364 Appendix B or Part 748 Appendix B. A covered entity or business associate that is subject to and complies with the Health Insurance Portability and Accountability Act, and the regulations promulgated under that act, 45 C.F.R. Parts 160 and 164, is deemed to be in compliance with this section if the Data Breach Charts current as of December 31, 2015 Page 111

112 Notice to Consumer Reporting Agencies Notice to Attorney General Violations Waiver covered entity or business associate notifies affected Wyoming customers or entities in compliance with the requirements of the Health Insurance Portability and Accountability Act and 45 C.F.R. Parts 160 and 164. The attorney general may bring an action in law or equity to address any violation and for other relief that may be appropriate to ensure proper compliance, to recover damages, or both. Back to top Data Breach Charts current as of December 31, 2015 Page 112