Data breach notification laws
 | This article needs to be updated. (May 2014) |
Security breach notification laws or data breach notification laws are laws that require an entity that has been subject to a data breach to notify their customers and other parties about the breach, and take other steps to remediate injuries caused by the breach. Such laws have been enacted in most U.S. states since 2002. These laws were enacted in response to an escalating number of breaches of consumer databases containing personally identifiable information.[1]
The first such law, the California data security breach notification law,[2] was enacted in 2002 and became effective on July 1, 2003.[3] As related in the bill statement, law requires "a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." In addition the law permits delayed notification "if a law enforcement agency determines that it would impede a criminal investigation." The law also requires any entity that licenses such information to notify the owner or licensee of the information of any breach in the security of the data.
In general, most state laws follow the basic tenets of California's original law: Companies must immediately disclose a data breach to customers, usually in writing.[4] California has since broadened its law to include compromised medical and health insurance information.[5]
The National Conference of State Legislatures maintains a list of enacted and proposed security breach notification laws.[1]
A number of bills that would establish a national standard for data security breach notification have been introduced in the U.S. Congress, but none passed in the 109th Congress.[6] In his 2015 State of the Union speech, President Obama proposed new legislation to create a national data breach standard that would establish a 30-day notification requirement from the discovery of a breach. [7]
The European Union implemented a breach notification law in the Directive on Privacy and Electronic Communications (E-Privacy Directive) in 2009, specific to personal data held by telecoms and Internet service providers.[8][9] This directive has to be implemented by national law until 25 May 2011.
External links
- National Conference of State Legislatures table of Security Breach Notification Laws
- Breach reporting requirements by state
- Interactive map comparing U.S. security breach notice laws (requires subscription)
References
- ^ a b Security Breach Notification Laws
- ^ SB 1386, Cal. Civ. Code 1798.82 and 1798.29.
- ^ SB 1386 Senate Bill
- ^ Scott Berinato (12 February 2008). "CSO Disclosure Series - Data Breach Notification Laws, State By State". CSO Online. Retrieved 11 May 2016.
- ^ "AB 1298 Assembly Bill - CHAPTERED". Retrieved 11 May 2016.
{{cite web}}: horizontal tab character in|title=at position 24 (help) - ^ Speaking of Security... | Blog Entry: Shannon Kellogg | Data security a: 1173
- ^ The Personal Data Notification & Protection Act
- ^ Amendment of Article 4 lit 3-5 of Directive 2002/58/EC (E-Privacy Directive) by Article 2 lit 4 c) of Directive 2009/136/EC
- ^ "New specific rules for consumers when telecoms personal data is lost or stolen in EU". Digital Single Market. 5 November 2016. Retrieved 11 May 2016.