<div dir="ltr"><a href="http://www.jdsupra.com/legalnews/nebraska-and-illinois-update-breach-48552/">http://www.jdsupra.com/legalnews/nebraska-and-illinois-update-breach-48552/</a><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p>
The data breach notification laws for <a href="http://nebraskalegislature.gov/laws/statutes.php?statute=87-801" target="_blank">Nebraska</a> and <a href="http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapAct=815%C2%A0ILCS%C2%A0530/&ChapterID=67&ChapterName=BUSINESS+TRANSACTIONS&ActName=Personal+Information+Protection+Act." target="_blank">Illinois</a>
have been updated to expand the definition of “personal information”
to include usernames and email addresses in combination with a password
or security question and answer allowing access to an online user
account.</p>
<p>
In addition to expanding the scope of covered information, Nebraska’s <a href="http://nebraskalegislature.gov/FloorDocs/Current/PDF/Slip/LB835.pdf" target="_blank">L.B. 835</a>
will require notification to the Attorney General in the event of any
breach that requires notice to a Nebraska resident in the first
instance. Illinois’ <a href="http://www.ilga.gov/legislation/publicacts/99/PDF/099-0503.pdf" target="_blank">H.B. 1260</a>
further expands the definition of PI to include a resident’s medical
information, health insurance information, and unique biometric data,
specifies required notice content when consumers’ usernames or email
addresses are affected by a breach, and imposes new data security
requirements.</p>
<p>
Nebraska’s new law will go into effect on<strong> July 21, 2016, </strong>while Illinois’ new law will become operative on<strong> Jan. 1, 2017</strong>. Changes to these laws are summarized below, and can be compared to other states requirements on our <a href="http://www.dwt.com/statedatabreachstatutes/" target="_blank">website</a>.</p>
<p>
<strong>Changes to Nebraska’s Breach Notification Statute </strong></p>
<ul style="margin-left:40px"><li>
<strong>New PI Data Elements.</strong> The definition of Personal Information or “PI” is expanded to include a resident’s online <strong>username or email address</strong>, combined with a password or security question and answer allowing access to an online account.</li><li>
<strong>Compromised Encryption Key. </strong>Nebraska’s breach
notification statute currently includes a safe harbor that allows a
business to forego data breach notification when affected PI is
encrypted, redacted or otherwise made unreadable. L.B. 835 clarifies
that data is not considered encrypted when the encryption process or key
itself is compromised in the breach.</li><li>
<strong>AG Notice.</strong> Nebraska’s data breach notification law
will soon require businesses and other entities to notify the Nebraska
Attorney General whenever notice to any state resident is required, and
must be given no later than the time when the resident is notified.</li></ul>
<p>
<strong>Changes to Illinois’ Breach Notification Statute</strong></p>
<ul style="margin-left:40px"><li>
<strong>New PI Data Elements.</strong>B. 1260 will enlarge the definition of PI to include:</li><li>
A resident’s <strong>medical information, health insurance information, and unique biometric data</strong> when combined with a consumer’s first name or first initial and last name; and</li><li>
A resident’s online <strong>username or email address</strong>, combined with a password or security question and answer allowing access to an online account.</li><li>
<strong>Notice Content for Breach of Username or Email Address</strong>.
Businesses will be permitted to notify Illinois residents of a breach
affecting usernames or email addresses via electronic or other form
directing residents to promptly change their username or password and
security question or answer or take “other appropriate steps” to protect
all affected online accounts which use the same username or email
address and security question or answer.</li><li>
<strong>Compromised Encryption Key</strong>. H.B. 1260 clarifies Illinois’ safe harbor <em>does not apply</em> when the key to unencrypt, unredact, or otherwise read the data elements is itself compromised in the breach.</li><li>
<strong>Substitute Notice to “Local Media.”</strong> If a breach impacts Illinois residents in <em>one geographic area</em>,
affected businesses otherwise permitted by the statute to give notice
via substitute notice (i.e. if notification costs exceed $250,000 or if
the affected business would have to notify more than 500,000 residents)
will be allowed to notify prominent <em>local</em> media instead of major <em>statewide</em>
Businesses should note that such localized notice is in addition to the
other substitute notice requirements (i.e. email notice if residents’
addresses on file, and conspicuous posting of the notice on the
business’ website), and must be “reasonably calculated” to give
residents actual notice.</li><li>
<strong>Data Security Requirements.</strong> In addition, H.B. 1260
expands the current Illinois statute to include data security
requirements very similar to those demanded by Nevada’s data breach
notification laws (<a href="http://www.leg.state.nv.us/NRS/NRS-603A.html" target="_blank">NRS 603A.210</a>).
When the statute goes into effect next year, all entities that own,
license, maintain or store records containing residents’ PI will be
required to:
<ul><li>
Implement and maintain <strong>“reasonable security measures”</strong> to protect from unauthorized access, acquisition, destruction, use, modification, or disclosure; and</li><li>
Require all third parties to implement and maintain similar security
measures when PI will be disclosed pursuant to a contract.</li></ul>
</li><li>
<strong>Entities Covered by other Federal Privacy and Data Security Regimes</strong>
<ul><li>
Covered entities and business associates subject to and in
compliance with the Health Insurance Portability and Accountability Act
as amended (HIPAA) and the Health Information Technology for Economic
and Clinical Health (“HITECH”) Act will be deemed complaint with the
Illinois statute for data security purposes, <u>but</u> any covered
entity or business associate required to provide notification of a
breach to the Secretary of Health and Human Services pursuant to HITECH
must provide notice to the Illinois Attorney General within 5 business
days of notifying the Secretary.</li><li>
Financial institutions subject to applicable provisions of the
Gramm-Leach-Bliley Act will also be deemed in compliance with Illinois’
new data security requirements.</li></ul>
</li></ul>
<p>
<strong>What’s Next for Businesses?</strong></p>
<p>
The Nebraska and Illinois updates are just the latest changes in the
patchwork of state-level data breach notification requirements. <a href="http://www.privsecblog.com/2016/04/articles/dataprotection/tennessee-gives-businesses-45-days-for-data-breach-notice/" target="_blank">Tennessee</a>
recently passed substantive amendments to its breach notification
statute that will which go into effect on July 1 and the amendments <a href="http://www.privsecblog.com/2015/07/articles/policy-regulatory-positioning/2015-data-breach-legislation-six-month-review-many-proposals-few-changes/" target="_blank">to Rhode Island’s statute</a> will take effect on July 2.</p>
<p>
Some of Nebraska’s and Illinois’ expanded requirements mirror those
that already exist under other states’ notice regimes, however, all
entities that collect consumer information should:</p>
<ul style="margin-left:40px"><li>
<strong>Review breach notification policies and procedures and update as needed. </strong>As
with any change to state data breach notification statutes, businesses
and other entities are strongly encouraged to revisit, review, and
revise their breach notification policies and procedures where needed to
be in compliance with the alterations to these statutes.</li><li>
<strong>Don’t Store Data and Encryption Keys in the Same Place.</strong>
The tweaks to Nebraska’s and Illinois’ encryption safe harbors are good
reminders that encrypting or taking other measures to make sensitive
data unreadable will not do much if the keys to decode the data are
compromised as well. Companies should <em>not</em> store their
encryption keys on the same machine or in the same location as the data
that the keys secure. More importantly, when transmitting encrypted
files, companies should use alternate methods of transmitting the
encryption keys. For instance, don’t email an encrypted file and
include the encryption key in the same email.</li></ul>
<p>
Cut: Companies required by other state or federal laws to implement
greater protections to safeguard records with PI, as well as those
subject to and in compliance with the Gramm-Leach-Bliley Act, will be
deemed in compliance.</p></div></div></div></div></div></div></div></div></div>
</div>