[BreachExchange] Data Breach Notification Laws Now Enacted in All 50 States

[Audrey McNeil]

https://www.natlawreview.com/article/data-breach-
notification-laws-now-enacted-all-50-states

South Dakota and Alabama are the last of the 50 states to have enacted
breach notification laws, along with Washington, D.C., Guam, Puerto Rico
and the Virgin Islands. South Dakota became the 49th state to enact a data
breach notification law when Governor Dennis Daugaard signed Senate Bill 62
into law on March 21. It goes into effect on July 1, 2018. On March 28,
2018, Alabama Governor Kay Ivey signed into law Alabama Senate Bill 318,
effective May 1, 2018. Below are the parameters of these new data breach
notification laws.

South Dakota

The South Dakota law only applies to computerized data and, like many
states’ laws, includes an encryption safe harbor in the definition of
“breach.” This means that a breach occurs when there is an unauthorized
acquisition (versus access) of unencrypted computerized data or encrypted
data with the encryption key. As with the majority of other states, the law
includes a risk of harm analysis before affected individuals must be
notified.

Notice to the South Dakota Attorney General is required if the breach
affects more than 250 state residents – joining 24 other state attorneys
general that require specific notice of a breach.   Notification to
affected state residents must be made within 60 days of the discovery that
a breach has occurred, which is longer than most states that establish a
specific timeframe. The new law does not create a private right of action,
but authorizes the attorney general to both bring criminal prosecutions and
seek up to $10,000 per day per violation, along with attorneys’ fees, in
civil suits.

Alabama

Alabama’s Data Breach Notification Act of 2018 applies only to electronic
data, includes an encryption safe harbor in the definition of “breach,” and
incorporates a risk of harm analysis before notice to individuals is
required. “Covered entities” is broadly defined to include government
entities.

If the number of affected individuals exceeds 100,000, or the cost exceeds
$500,000, substitute notice is allowed and requires a conspicuous notice on
the covered entity’s website for 30 days, as well as notice in print and
broadcast media where individuals reside. Notice to the attorney general is
required if the number of affected individuals exceeds 1,000 and must be
made as expeditiously as possible or within 45 days of the covered entity’s
determination that a breach has occurred.

The Alabama law also requires that the consumer reporting agencies be
notified if the incident affects more than 1,000 individuals at a single
time. In addition, third-party agents who experience breaches are required
to notify the covered entity within 10 days. The attorney general can seek
civil penalties of up to $5,000 per day that covered entities fail to
comply with the notice provision, and covered entities may be subject to up
to $500,000 per breach under the Alabama Deceptive Trade Practices Act.
Finally, government entities are required to comply with the notice
provisions of the act, but are not subject to the monetary penalties.
Instead, the attorney general must provide a report annually to the
governor and the leaders of the House and Senate describing the nature of
any reported breaches relating to government entities or their agents.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180410/669642fd/attachment.html>