[BreachExchange] North Carolina AG Seeks Breach Notification For Ransomware, Other Enhancements To Data Breach Law

[Destry Winant]

https://www.jdsupra.com/legalnews/north-carolina-ag-seeks-breach-90426/

According to SC Magazine, an escalating number of victims of data
breaches in 2017 have led Attorney General Josh Stein and state Rep.
Jason Saine to propose updates to the state’s existing data breach
notification law – “Act to Strengthen Identity Theft Protections.”

The Act would make a number of changes to the existing law, including:

- Expand the definition of “security breach” to include “ransomware”
attacks. Ransomware attacks generally result in the encryption of an
organization’s system files, preventing the owner from accessing the
files unless the owner buys (usually through some form of
cryptocurrency) a valid encryption code from the attackers, which may
never be delivered. In many cases, the malware deployed by the
attackers does not enable them to access or acquire the organization’s
information. However, sponsors of the law change would like the victim
organization to notify both the affected consumers and the Attorney
General’s office, empowering the affected person and the Attorney
General’s Office to determine the risk of harm – not the breached
organization.

- Mandate reasonable safeguards. The Act would require businesses that
own or license personal information to implement and maintain
reasonable security procedures and practices – appropriate to the
nature of personal information – to protect the personal information
from a security breach. It does not appear that the new law would
provide specific requirements for safeguarding personal information.
States such as Massachusetts and Colorado have provided more specific
requirements for the safeguards covered entities must put in place.

- Update definition of personal information. The Act would update the
definition of personal information to include medical information and
insurance account numbers.

- Shorter (15-day) notification period. The Act would require
notification to the affected consumer(s) and the Attorney General’s
office within 15 days. The hope is this would give consumers more time
to freeze their credit across all major credit reporting agencies and
take other preventative measures to prevent identity theft before it
occurs.

- Free credit freezes and credit reports. The Act would permit
consumers to place and lift a credit freeze on their credit report at
any time, for free. They also would be able to access three free
credit reports from each consumer reporting agency that compiles and
maintains files on consumers on a nationwide basis. Notably, if
consumer reporting agencies experience a security breach, they will
have to provide five years of free credit monitoring to affected
consumers.

- Penalty clarification. The Act would provide that businesses that
suffer a breach and that failed to maintain reasonable security
procedures will have committed a violation of the state’s Unfair and
Deceptive Trade Practices Act and each person affected by the breach
would constitute a separate and distinct violation of the law
triggering a penalty.

If the Act is passed into law, North Carolina would join a number of
other states that have and continue to update and strengthen their
state laws requiring notification following a breach, and that have
added obligations requiring reasonable safeguards to protect personal
information. All organizations should be reviewing these developments
and take appropriate steps to safeguard personal information they
maintain about individuals, as well evaluating and enhancing their
breach response readiness.