Vermont Attorney General Security Breach Notification Guidance Updated September 2014 Overview ..................................................................................................................................................... 1 1. What is the purpose of this Guidance? ....................................................................................... 1 2. Does this Guidance apply to me? ................................................................................................ 1 3. What is a Security Breach? .......................................................................................................... 1 4. What is Personally Identifiable Information (or “PII”)? ............................................................... 2 5. I think I’ve suffered a Security Breach, what should I do? .......................................................... 2 Detailed Explanations ................................................................................................................................ 3 6. What if I’m not sure whether I’ve had a Security Breach? .......................................................... 3 7. Under what circumstances is notification triggered?.................................................................. 4 8. Explain “owns or licenses” ........................................................................................................... 5 9. Explain “maintains or possesses” ................................................................................................ 5 10. Explain “electronic” or “computerized” ...................................................................................... 5 11. Explain “discovers or is notified” ................................................................................................. 6 12. Who must be notified in the event of a security breach? ........................................................... 6 13. Should I send notice to the Attorney General or Department of Financial Regulation? ............ 6 14. What deadlines apply? ................................................................................................................ 7 15. Explain “most expedient time possible and without unreasonable delay” ................................ 7 16. When do deadlines run from? ..................................................................................................... 7 17. How do I secure my data? ........................................................................................................... 8 18. Contacting law enforcement. ...................................................................................................... 8 19. Explain the 14-day Preliminary Notice. ....................................................................................... 9 20. Exception to 14-Day Preliminary Notice requirement: ............................................................. 10 21. Explain the Consumer Notice..................................................................................................... 10 22. What must be included in the Consumer Notice?..................................................................... 11 23. How must Consumer Notice be sent? ....................................................................................... 11 24. Under what circumstance may Consumer Notice be sent by email? ....................................... 12 25. I had a security breach, but I think that misuse of the PII is not reasonably possible. ............. 12 26. What information does the Attorney General hold confidential? ............................................ 13 i Last Modified: 6/10/2016 1:57 PM 27. Should I contact the credit reporting agencies? ........................................................................ 13 28. How does the Act apply to financial institutions? ..................................................................... 14 29. If I report the breach to you, are you going to investigate me? ................................................ 14 30. What happens if I violate the Act?............................................................................................. 15 APPENDIX 1............................................................................................................................................... 16 Procedures Businesses Should Institute Both to Avoid Security Breaches and After a Breach Has Occurred ............................................................................................................................................... 16 Reporting a Security Breach to Law Enforcement ............................................................................... 16 Incident Response DOs and DON’Ts..................................................................................................... 17 APPENDIX 2 – MODEL LETTER .................................................................................................................. 18 APPENDIX 3 – MEDIA FOR SUBSTITUTE NOTICE ...................................................................................... 20 ii Last Modified: 6/10/2016 1:57 PM If you have a Security Breach, you must provide Preliminary Notice to the Vermont Office of the Attorney General (the “Office”) within 14 business days of discovery or notification of the breach, and provide Consumer Notice in the most expedient time possible in the most expedient time possible and not later than 45 days after discovery or notification of the breach. Preliminary Notice is kept confidential. If you have any questions or are uncertain about anything in the guidance, please contact the Office at [email protected] or 802-828-5479. Overview 1. What is the purpose of this Guidance? This Guidance describes how the Vermont Office of the Attorney General (the “Office”) interprets the Data Breach Notification Act, 9 V.S.A. § 2430 and § 2435 (the “Act”). This Guidance is not directed towards entities regulated by the Department of Financial Regulation (“DFR”). This Guidance also does not address security issues raised by federal law like HIPAA and the Gramm- Leach-Bliley Act. 2. Does this Guidance apply to me? Yes, if you are a Data Collector that has experienced a Security Breach. “Data Collector” is a very broad term, and includes any entity that “for any purpose, whether by automated collection or otherwise, handles, collects, disseminates, or otherwise deals with nonpublic personal information.”1 In addition to most businesses, the state, state agencies, municipalities, public and private universities, and both for-profit and non-profit entities are subject to the Act. Certain financial institutions, however, are exempt from most provisions of the Act. See Question 28 (How does the Act apply to financial institutions?) The location of the Data Collector in is not relevant. As long as one Vermont resident has been affected by a Security Breach, the Act applies to the Data Collector.2 3. What is a Security Breach? "Security breach" means unauthorized acquisition of electronic data or a reasonable belief of an unauthorized acquisition of electronic data that compromises the security, confidentiality, or integrity of a consumer's personally identifiable information maintained by the Data Collector. See also Question 6 (What if I’m not sure whether I’ve had a Security Breach?) 1 Last Modified: 6/10/2016 1:57 PM 4. What is Personally Identifiable Information (or “PII”)? PII means an individual’s first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or protected by another method that renders them unreadable or unusable by unauthorized persons: Social Security number; Motor vehicle operator’s license number or non-driver identification card number; Financial account number or credit or debit card number, if circumstances exist in which the number could be used without additional identifying information, access codes, or passwords; or Account passwords or personal identification numbers or other access codes for a financial account. The Office considers the front of a check, which contains name, account number, routing number, and potentially address and signature, to be PII. PII does not include information from federal, state, or local governments that is lawfully made available to the general public.3 5. I think I’ve suffered a Security Breach, what should I do? You, as a business or state agency, should take the following steps if you think you may have suffered a security breach. Review all steps immediately, and take as many of the steps as possible, as quickly as possible. Each step is described more fully below in Detailed Explanations. a. Secure the data immediately Take reasonable steps to stop ongoing data theft, ideally without destroying evidence that could be used in a future investigation. For example, you can secure the data by disconnecting affected computers from networks or removing affected hard drives. See also Question 17 (How do I secure my data?) b. Involve Law Enforcement immediately See Question 18 (Contacting Law Enforcement). c. If you are storing someone else’s data, contact the owner of the data. See Questions 9 (Explain “maintains or possesses”), 12 (Who must be notified in the event of a security breach?). 2 Last Modified: 6/10/2016 1:57 PM d. Provide confidential Preliminary Notice to the Attorney General or DFR about