Navigating the Maze of Data Breach Notification Laws
How a company prepares for and responds to a security breach can be key to ensuring compliance.
InfoWorld — If your organization suffers a data breach, you are required—in many instances—to notify individuals that their personal information may have been compromised. Security breach notification laws enacted in almost all states are designed to help protect affected individuals by giving them due warning and the opportunity to take action to protect themselves against the consequences of identity theft and unauthorized account access.
The requirements of the security breach notification laws, however, present a maze of compliance obligations. Although the 44 state laws governing breach notification are similar, each presents a somewhat unique approach to the basic set of issues. How a company prepares for and responds to a security breach can be key to ensuring compliance.
Prevention: Your best legal defense Given the adverse publicity that often follows a breach disclosure, a premium should be placed on taking steps, in advance, to reduce or eliminate the risk of having to make a disclosure. Perhaps the most basic step is to reduce or eliminate the amount of notice-triggering information that your company collects and maintains.
First, you should review your information-collection practices, both to identify where sensitive personal information is collected and stored, and to assess whether such information is really needed. In many cases, the retention of information subject to the security breach notification laws, such as Social Security numbers, may not be necessary. If it is, it is vital to have an accurate understanding and inventory of the sensitive personal data your company collects, how it is used, where it is stored, and how it is protected.
It is, of course, important to ensure that appropriate security measures are in place to protect this data. Encryption, in particular, provides a potential legal benefit, as breach notification statutes apply only to the compromise of unencrypted personal information. Thus, to the extent reasonably feasible, encryption of all sensitive personal information may well help you avoid the need to make embarrassing disclosures.
Regardless of the level of security implemented, breaches may still occur. Thus, companies should develop and implement a well-thought-out incident response plan.
Notification in the wake of a breach If a breach of personal information does occur, the first step is to determine whether notification is required, and if so, who must be notified. Those seemingly simple questions often require very complex analysis and a review of numerous state laws.
First, you must identify the data elements that were compromised and the states in which the data subjects reside. All state breach laws apply if the compromise involves an individual's name plus Social Security number, driver's license number, or credit card number. But many states also cover a variety of other information, such as medical information, mother's maiden name, date of birth, and passport numbers. Thus, an assessment of the data elements compromised and the states of residence of the data subjects will determine the potentially applicable laws.
