Arent Fox LLP Survey of Data Breach Notification Statutes James Westerlind
Total Page:16
File Type:pdf, Size:1020Kb
september 2019 Arent Fox LLP Survey of Data Breach Notification Statutes James Westerlind Survey Overview This Survey focuses on the data breach notification statutes of the states and territories within the US, and should be a useful tool and guide for data security planning and response purposes. Smart In Your World arentfox.com September 2019 We are pleased to share with you the third version of Arent Fox LLP’s Survey of Data Breach Notification statutes within the United States and its territories. This Survey includes amendments and new statutes that have been enacted since August of last year, and provides answers to the key initial questions that a company should have with respect to state data breach notification statutes if it learns that the personal identifiable information that it maintains for its customers or employees, or on behalf of other companies that it does business with, has been, or likely has been, breached or used in an unauthorized manner. Namely: (1) Which statutes in a particular jurisdiction apply? (2) Who must comply with the notification requirements? (3) What data is covered by the statutes? (4) What constitutes a data breach? (5) Who must be notified pursuant to the statute? (6) When must notice be sent? (7) In what form or manner must notice be sent? (8) What must the notice say? (9) Are there any exemptions? (10) Who may enforce the requirements and what penalties may be imposed for violations? (11) Are there any data security requirements imposed? (12) Are there any industry-specific requirements? This updated Survey focuses on the data breach notification statutes of the states and territories within the U.S., and should be a useful tool and guide for data security planning and response purposes. If your company experiences a data security incident, one of the first things that you must consider is the potential scope of the incident and whose personal information may be implicated. If you have customers who reside in multiple jurisdictions and whose personal information may have been breached, you will have to analyze the data breach notification rules of each of those jurisdictions and comply with each. While most of the statutes are similar, many have particular nuances that differ, and a failure to comply may result in additional problems and liability for your company. This Survey is intended to make that task easier for you. In addition to state and territory specific statutes, you will also have to consider the applicability of various federal laws and private industry requirements (e.g., HIPAA and the HITECH Act; the Gramm-Leach-Bliley Act; and Payment Card Industry requirements) and, if your company does business outside the U.S., the laws of other countries (e.g., the EU General Data Protection Regulation, which became enforceable on May 25, 2018, and Canada’s Personal Information Protection and Electronic Documents Act, which becomes effective November 1, 2018). While this Survey does not address these additional laws, feel free to give us a call if you have any questions about them. We hope that you find this survey useful. James Westerlind TABLE OF CONTENTS Page INTRODUCTION ......................................................................................................................... 1 ALABAMA ................................................................................................................................... 5 ARIZONA.................................................................................................................................... 16 ARKANSAS ................................................................................................................................ 20 CALIFORNIA ............................................................................................................................. 23 COLORADO ............................................................................................................................... 31 CONNECTICUT ......................................................................................................................... 37 DELAWARE ............................................................................................................................... 44 DISTRICT OF COLUMBIA ....................................................................................................... 49 FLORIDA .................................................................................................................................... 53 GEORGIA.................................................................................................................................... 58 GUAM ......................................................................................................................................... 63 HAWAII ...................................................................................................................................... 67 IDAHO ......................................................................................................................................... 72 ILLINOIS ..................................................................................................................................... 76 INDIANA .................................................................................................................................... 82 IOWA ........................................................................................................................................... 87 KANSAS...................................................................................................................................... 92 KENTUCKY ................................................................................................................................ 96 LOUISIANA ................................................................................................................................ 99 MAINE ...................................................................................................................................... 104 MARYLAND ............................................................................................................................ 108 MASSACHUSETTS.................................................................................................................. 116 MICHIGAN ............................................................................................................................... 127 MINNESOTA ............................................................................................................................ 132 MISSISSIPPI ............................................................................................................................. 137 MISSOURI ................................................................................................................................ 143 MONTANA ............................................................................................................................... 148 NEBRASKA .............................................................................................................................. 153 NEVADA ................................................................................................................................... 158 NEW HAMPSHIRE .................................................................................................................. 164 -i- TABLE OF CONTENTS (cont’d.) Page NEW JERSEY ........................................................................................................................... 172 NEW MEXICO .......................................................................................................................... 177 NEW YORK .............................................................................................................................. 181 NORTH CAROLINA ................................................................................................................ 189 NORTH DAKOTA .................................................................................................................... 195 OHIO.......................................................................................................................................... 199 OKLAHOMA ............................................................................................................................ 205 OREGON ................................................................................................................................... 208 PENNSYLVANIA ..................................................................................................................... 213 PUERTO RICO ......................................................................................................................... 216 RHODE ISLAND ...................................................................................................................... 219 SOUTH CAROLINA ................................................................................................................. 223 SOUTH DAKOTA .................................................................................................................... 227 TENNESSEE ............................................................................................................................. 230 TEXAS ......................................................................................................................................