State breach laws

Every US state, the District of Columbia, Puerto Rico, Guam and the US Virgin Islands has a law requiring organizations to notify people when their personal information is compromised. There is no single federal breach law for most businesses, so a breach affecting people in many states means applying many laws at once.

The laws share a common shape: a definition of personal information, a definition of breach, a duty to notify affected residents, and often a duty to tell the state regulator. They differ in the details that decide your timeline, and those details are where multi-state responses go wrong.

• Any organization that owns, licenses or maintains personal information about residents of the state, wherever the organization is located. The residence of the affected person decides which law applies, not where you are.
• Personal information is typically a first name or initial and last name combined with a Social Security number, a driver's license or state ID number, or a financial account or card number with the code needed to use it. Many states add biometric data, health or medical information, health insurance numbers, passport numbers, and online account credentials (a username or email with its password).
• A breach is usually unauthorized acquisition of unencrypted personal information. Some states, such as New York, also count unauthorized access.
• Vendors that hold data for another organization must generally notify that organization, which then notifies the affected people.

Affected residents are entitled to a notice that tells them what happened, what information was involved, what the organization is doing, and what they can do to protect themselves. Some states require an offer of free credit monitoring or identity theft protection when Social Security numbers are involved (for example, Connecticut and Massachusetts). A few states, including California, let individuals sue over breaches caused by a failure to maintain reasonable security.

Enforced mainly by state attorneys general, usually under the state's consumer protection law, with civil penalties that vary widely by state. Late or incomplete notices are among the most common grounds for settlements. Where a private right of action exists, class actions often follow large breaches.

1. Keep a state matrix: definition of personal information, deadline, regulator notice and threshold, credit bureau notice, and content rules for every state where you hold resident data.
2. Know where your data subjects live, so you can tell within days which states' laws apply.
3. Encrypt personal information at rest and in transit; most states exempt encrypted data when the key was not compromised.
4. Put breach reporting clauses in vendor contracts with a short deadline to tell you.
5. Prepare notice templates that meet the strictest content rules, and a process to add state-specific paragraphs.
6. Rehearse with counsel, including the decision on whether an incident is a notifiable breach.