Editorial · February 9, 2017
Data Breach Notification Laws: A State by State Primer
Data breach notification laws in the United States are set by the states, not by one national rule. If you lose customer data, the state where each customer lives may decide what you must do. A small firm with buyers in ten states can face ten sets of rules at once.
Which states have these laws
The National Conference of State Legislatures (NCSL) keeps a running list. Its January 2016 page says forty-seven states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws that require notice after a security breach. Only Alabama, New Mexico and South Dakota are listed without one.
Most of these laws share a core idea. If certain personal information is taken, the business must tell the people it affects. The Federal Trade Commission (FTC) says the same in its business guide: most states have passed such laws, and you should check the rules that apply to your firm.
The laws also name who must follow them. Some cover only businesses. Others also cover data brokers, government offices and schools. Read the scope section of each statute before you assume it does or does not reach you.
Sources: National Conference of State Legislatures, Security Breach Notification Laws (page dated January 4, 2016); Federal Trade Commission, Data Breach Response: A Guide for Business.
What counts as personal information
Most states start with a name plus a Social Security number, a driver's license number, or a financial account number with its access code. That is the classic list. It is not the same everywhere.
Several states widened it in 2016. A law firm summary from Mintz says Nevada now includes medical and health insurance ID numbers. It also covers a user name or email address paired with a password or security answer for an online account. Rhode Island added medical and health insurance information and the same kind of online login data. Nebraska added online login data as well.
The lesson for a small firm is simple. A customer email and password list can be covered data in one state and not in another.
Sources: Mintz, Summer Round-Up: Four States Bolster Data Breach Notification Laws (September 2, 2016).
How fast you must act
Many older laws say only that notice must go out without unreasonable delay. Newer changes put a number on it. Mintz reports that Rhode Island and Tennessee now require notice to affected residents within forty-five days of discovering a breach. A delay is allowed only when law enforcement needs it.
Some states also want the state attorney general told. In Nebraska, the attorney general must hear no later than the time residents are told. In Rhode Island, a breach that touches more than five hundred residents must also be reported to the attorney general.
These are examples, not a full table. Deadlines and thresholds change from state to state, so confirm the current text of each law.
Sources: Mintz, Summer Round-Up: Four States Bolster Data Breach Notification Laws (September 2, 2016).
Encryption is not always a safe harbor
Many laws excuse a firm if the stolen data was encrypted. That rule has limits. Nebraska and Rhode Island now say data is not treated as encrypted if the key or process that unlocks it was taken in the same breach.
Tennessee removed the word unencrypted from its definition of a breach. Mintz explains the aim: partial encryption should not let a firm skip the statute.
So encryption helps, but only when the keys stay safe. Store them apart from the data they protect.
Sources: Mintz, Summer Round-Up: Four States Bolster Data Breach Notification Laws (September 2, 2016).
Steps the FTC suggests
The FTC guide lists a clear order of work. First, secure your systems and stop more data from leaking. Then work out which laws apply to you, because the type of data and the home states of your customers both matter.
Next, notify the right parties. The guide tells firms to call local police right away. If the data is health information, other federal rules may apply, including the HIPAA Breach Notification Rule. If you hold data for other businesses, tell them. If Social Security numbers were taken, contact the credit bureaus.
When you tell individuals, the FTC suggests a plain letter that says how the breach happened, what was taken, what you have done, and who to call. It also suggests offering at least a year of free credit monitoring when Social Security numbers or financial data were exposed. Many state laws spell out what the notice must or must not contain, so check yours before you send it.
Sources: Federal Trade Commission, Data Breach Response: A Guide for Business (ftc.gov).
A short plan for a small firm
Start before anything goes wrong. List the states where your customers live. Note what personal data you keep and where. Keep a one-page summary of each state's rule next to your incident plan, and ask a lawyer to review it each year.
State legislatures were still active in 2016. NCSL said more than twenty-five states had bills on this topic that year, as reported by Mintz. Rules that are correct today can change next session, so a yearly check is worth the time.
Sources: Mintz, Summer Round-Up (September 2, 2016), citing the National Conference of State Legislatures.
Sources list: NCSL, Security Breach Notification Laws; FTC, Data Breach Response: A Guide for Business; Mintz, Summer Round-Up.