US 2005 Breach of Information Legislation Resources in United States

US 2005 Breach of Information Legislation Resources

Last update: February 10, 2006
2005 Legislation

Alaska
H.B. 226
05/10/05 Legislature adjourned.
Relates to breaches of security involving personal information; and relating to credit report security freezes.

S.B. 148
05/10/05 Legislature adjourned.
Relates to breaches of security involving personal information; and relating to credit report security freezes.

S.B. 149
05/10/05 Legislature adjourned.
Relates to breaches of security involving personal information; and relating to credit report security freezes.

S.B. 180
05/10/05 Legislature adjourned.
Relates to breaches of security involving personal information, consumer report security freezes, protection of social security numbers, disposal of records, and the accuracy of reports on credit history, score, and ranking.

Arizona
H.B. 2575
05/13/05 Legislature adjourned
Requires that if personal identifying information is stolen from a person or entity, the person or entity shall send notice to its customers within 48 hours of the theft discovery that their personal identifying information has been stolen and shall provide information on what the customers may do to protect against the unauthorized use of their personal identifying information.

S.B. 1114
05/13/05 Legislature adjourned
Requires an entity disposing of records to take reasonable steps to ensure the destruction of personal financial and health information and personal identification numbers that are issued by governmental entities. Directs an entity discovering that personal identifying information has been stolen or improperly obtained, the entity must, within the most expedient time possible and without unreasonable delay: a) transmit notice to the person that there has been a breach of security regarding that person’s personal identifying information. b) Provide information to that person regarding steps to be taken to protect against the unauthorized use of personal identifying information. Immunizes the entity from liability if it returned custody and control of the records back to the individual to whom the records pertain. Specifies that this legislation does not apply to the disposal of records by a transfer of the records to another entity. Allows an individual, who believes he or she may be injured by an entity’s actions or failure to act, to request that a court stop an entity’s actions or failure to act pursuant to this legislation. Permits the court to grant an injunction to stop an entity’s actions or failure to act. Authorizes the attorney general to bring a civil action for damages and/or injunctive relief against an entity that fails to comply with this legislation. Specifies that any bank, financial institution, health care organization or other entity subject to and in compliance with certain federal regulations regarding protecting identifying information is in compliance with this legislation. Provides that the rights and remedies of this legislation are in addition to other rights or remedies provided by law. Defines “destroy,” “entity,” “individual,” “personal identifying information” and “record.”

Arkansas
S.B. 1167
03/31/05 Signed by governor, Act 1526
Provides notice to consumers of the disclosure of their personal information.

California
A.B. 786
09/09/05 Legislature adjourned
Requires the California State University system to provide an employee, upon request, with four hours of time off with pay following a disclosure by the university that there is, or could have been, a breach of security of employee personal information data, as specified.

A.B. 1694
09/09/05 Legislature adjourned
This bill would require a consumer credit reporting agency, upon the request of a consumer whose personal information was breached by a computerized data system, to place a security freeze on the consumer’s credit report without charge to the consumer for this service. The bill would authorize the consumer credit reporting agency to charge the agency responsible for the breach, and would require the consumer to submit a copy of notification of the breach to the consumer credit reporting agency, as a condition of receiving the security freeze. The bill would make related findings and declarations of the Legislature. This bill would require a consumer credit reporting agency to notify each consumer who is the subject of a consumer credit report of each instance that a new account is entered on the consumer’s report if the address on the credit application is different from the last address on record held by the consumer credit reporting agency.

S.B. 433
09/09/05 Legislature adjourned
Existing law contains two identical provisions of law requiring any person or business that conducts business in California and that owns or licenses computerized data that includes personal information to disclose any breach of the security system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Repeals one of those two identical provisions, thereby making a technical, nonsubstantive change.

S.B. 550
05/19/05 Passed Senate
09/09/05 Legislature adjourned
Regulates a data broker, which would be defined as a commercial entity that collects, assembles, or maintains personally identifiable information about a California resident for the sale or transmission of, or provision of access to, that information to any third party. The bill, among other things, authorizes a California resident to request that his or her personally identifiable information, as defined, be excluded from any report prepared by a data broker, and requires a data broker to inform that resident every time the broker issues a report containing that information. Requires every data broker to allow every California resident the right to obtain disclosure of all personally identifiable information pertaining to that individual held by the broker, and to be informed of the identity of each person or entity that procures that information from the broker. Requires the prompt correction of errors in any report, and, upon a breach of security of an individual’s information, would require the data broker to pay for a security freeze of that individual’s credit reports. Provides for specified penalty provisions and injunctive relief.

S.B. 852
05/26/05 Passed Senate
09/09/05 Legislature adjourned
Requires an agency, or a person or business conducting business in California, that possesses any data that includes the personal information of a California resident, to notify the resident of any breach of the security of the data, as specified. The bill also repeals duplicative provisions of law.

Colorado
S.B. 137
(Final version of bill does not include security breach provision)
06/01/05 Signed by governor
Permits a consumer to put a security freeze on his or her credit report. Allows the consumer to temporarily lift the freeze to allow a particular entity access to the credit report for the purpose of issuing or extending credit to the consumer. Requires the freeze to be maintained until the consumer specifically requests its removal. Requires that a consumer be notified of the right to place a security freeze on his or her credit report each time the consumer receives a summary of the rights relating to credit reports. Compels a consumer reporting agency to notify the consumer within 5 days after releasing credit information that was in violation of a security freeze. Allows a consumer who had credit information released in violation of a security freeze to bring a private civil right of action against the consumer reporting agency that released the information in violation of the security freeze. Prohibits a consumer reporting agency from furnishing a consumer’s credit header to someone who does not have a permissible basis to obtain the consumer credit header. Requires a data collector that owns or uses personal information in any form concerning a Colorado resident to notify the resident that there has been a breach of the security of the system data following the discovery of the breach.

Connecticut
S.B. 650
06/08/05 Signed by governor, Public Act 05-148
Requires a business that has suffered a security breach involving personal information to disclose it to affected consumers, generally without unreasonable delay. It generally requires the notice to be given in writing, by telephone, or electronically. It allows a substitute form of notice when the cost of providing it is high or the number of affected people is large. It prescribes the form of the substitute notice.

Delaware
H.B. 116
06/28/05 Signed by governor
Helps ensure that personal information about Delaware residents is protected by encouraging data brokers to provide reasonable security for personal information. Requires an individual or a commercial entity that conducts business in Delaware and that owns or licenses computerized data that includes personal information to notify a resident of Delaware of any breach of the security of the system immediately following the discovery of a breach in the security of personal information of the Delaware resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification must be made in good faith, in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. Alternative notification procedures are provided in §12B-103. In a civil action to recover damages (for example, losses due to identity theft), the award is triple the amount of actual damages plus reasonable attorney fees. A violation of this Act falls under the enforcement duties and powers of the Consumer Protection Division of the Department of Justice, which may bring an action in law or equity to address violations of the Act and other appropriate relief. The provisions of this Act do not nullify or impair any common law or statutory right that a person may have in regard to violations under the Act.

Florida
H.B. 129
05/06/05 Legislature adjourned
Requires business persons maintaining computerized data that includes personal information to provide notice of breaches of system security under certain circumstances; provides requirements; provides for administrative fines; provides exceptions and limitations; authorizes delays of such disclosures under certain circumstances; provides definitions; provides for alternative notice methods; specifies conditions of compliance for persons maintaining certain alternative notification procedures; specifies conditions under which notification is not required; provides requirements for documentation and maintenance of documentation; provides an administrative fine for failing to document certain failures to comply; provides for application of administrative sanctions to certain persons under certain circumstances; authorizes the Department of Legal Affairs to institute proceedings to assess and collect fines.

H.B. 481
06/014/05 Signed by governor, Chapter 229
Includes other information within the definition of the term “personal identification information”; defines the term “counterfeit or fictitious personal identification information”; revises criminal penalties relating to the offense of fraudulently using, or possessing with intent to fraudulently use, personal identification information; provides minimum mandatory terms of imprisonment; creates the offenses of willfully and fraudulently using, or possessing with intent to fraudulently use, personal identification information concerning a deceased individual; provides criminal penalties; provides for minimum mandatory terms of imprisonment; creates the offense of willfully and fraudulently creating or using, or possessing with intent to fraudulently use, counterfeit or fictitious personal identification information; provides criminal penalties; provides for reclassification of offenses; provides for reduction or suspension of sentences; requires business persons maintaining computerized data that includes personal information to provide notice of breaches of system security; provides for administrative fines; authorizes delays of such disclosures; provides for alternative notice methods; provides definitions; specifies conditions of compliance for persons maintaining alternative notification procedures; specifies conditions under which notification is not required; provides an administrative fine for failing to document failures to comply; provides requirements for such documentation and maintenance of documentation; authorizes the Department of Legal Affairs to institute proceedings to assess and collect fines; requires notification of consumer reporting agencies of breaches of system security.

S.B. 284
05/06/05 Legislature adjourned
Requires business persons maintaining computerized data that includes personal information to provide notice of breaches of system security under certain circumstances; revises criminal penalties re offense of fraudulently using, or possessing with intent to fraudulently use, personal identification information; provides minimum mandatory terms of imprisonment, etc.

S.B. 978
05/06/05 Legislature adjourned
Includes other information within definition of term “personal identification information”; defines term “counterfeit or fictitious personal identification information”; revises criminal penalties re offense of fraudulently using, or possessing with intent to fraudulently use, said info; requires business persons maintaining computerized data that includes personal info to disclose breaches of system security under certain circumstance, etc.

Georgia
H.B. 638
03/31/05 Legislature adjourned
Relates to selling and other trade practices, so as to provide definitions; to require investigative consumer reporting agencies to give notice to consumers of certain security breaches; to provide for a standard of care to be exercised by investigative consumer reporting agencies; to provide for rules, regulations, and guidelines; to provide for related matters; to provide an effective date; to repeal conflicting laws; and for other purposes.

H.B. 648
03/31/05 Legislature adjourned
Requires a person or business that conducts business in this state and that owns or licenses computerized data that includes personal information to disclose in specified ways any breach of the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person; to permit notification to be delayed if a law enforcement agency determines that it would impede a criminal investigation; to require a person or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of the security of the data; to provide for certain civil actions.

S.B. 230
05/05/05 Signed by governor, Act 163
Relates to selling and other trade practices, so as to provide definitions; requires investigative consumer reporting agencies to give notice to consumers of certain security breaches.

S.B. 245
03/31/05 Legislature adjourned
Relates to business records, so as to require a person or business that conducts business in this state and that owns or licenses computerized data that includes personal information to disclose in specified ways any breach of the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person; permits notification to be delayed if a law enforcement agency determines that it would impede a criminal investigation; requires a person or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data; provides for certain civil actions; defines certain terms; to amends Chapter 18 of Title 50 of the Official Code of Georgia Annotated, relating to state printing and documents, so as to require an agency that owns or licenses computerized data that includes personal information to disclose in specified ways any breach of the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person; permits notification to be delayed if a law enforcement agency determines that it would impede a criminal investigation; requires an agency that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data; defines certain terms; provides for legislative findings and declarations.

S.B. 251
03/31/05 Legislature adjourned
Relates to selling and other trade practices; requires certain business entities to give notice to consumers of certain security breaches; to provide for causes of actions and damages for unauthorized or improper access of personal information of consumers; to provide for certain criminal penalties; to provide for related matters; to provide an effective date; to repeal conflicting laws; and for other purposes.

H.B. 649
03/31/05 Legislature adjourned
Provides that any person who is engaged in any business which involves the collection or maintenance of identifying information with respect to consumers shall have a duty to maintain such identifying information in a manner which is secure against unauthorized disclosure; requires prompt notification to a consumer if the security of that consumer’s identifying information is or may have been breached; provides for criminal penalties and civil and administrative remedies.

Illinois
H.B. 1633
06/16/05 Signed by governor, Public Act 94-36
Creates the Personal Information Protection Act. Provides that any data collector that owns or uses personal information in any form, whether computerized, paper, or otherwise, that includes personal information concerning an Illinois resident shall notify the resident that there has been a breach of the security of the system data following discovery or notification of the breach, without regard for whether the data has been accessed by an unauthorized third party for legal or illegal purposes. Provides that the notification required pursuant to the Act may be delayed if a law enforcement agency determines that the notification may impede a criminal investigation. Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that a violation of the Personal Information Protection Act is a violation of the Consumer Fraud and Deceptive Business Practices Act.

H.B. 3743
Creates the Security Breach Notification Act. Requires any person or business conducting business in the State, and that owns or licenses computerized data that includes personal information, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any person whose unencrypted personal information was, or is reasonably believed to have been acquired by an unauthorized person. Requires any person or business that maintains computerized data that includes personal information that the person or business does not own, to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery of such breach, if the personal information was, or is reasonably believed to have been acquired by an unauthorized person. Provides that notice may be provided to a customer in one of the following ways: (1) written notice; (2) electronic notice; or (3) substitute notice if the person or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Provides a private right of action for a violation of the Act.

H.B. 4198
Amends the Personal Information Protection Act. Requires a data collector to disclose to a consumer, at no cost, the personal information obtained resulting in a breach of the security of the system data.

S.B. 209
Creates the Personal Information Protection Act. Requires each financial institution to provide an annual disclosure statement to all persons for which the financial institution maintains unencrypted personal information concerning measures the financial institution has taken to prevent (i) a breach of the security system and (ii) any unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the financial institution. Requires each financial institution to maintain duplicate records of all computerized data at a back-up site located at least 90 miles from the primary site at which the data is stored. Provides that the effectiveness of the back-up site shall be tested annually and requires the results o that test to be included in the annual disclosure statement.

S.B. 1479
04/08/05 Passed Senate
Creates the Identity Theft Notification Act. Requires any data collector that owns or uses personal information in any form that includes personal information concerning an Illinois resident, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data, without regard for whether the data has been accessed by an unauthorized third party for legal or illegal purposes. Provides that notice may be provided in one of the following ways: (1) written notice; (2) electronic notice; or (3) substitute notice if the person or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Provides a private right of action for a violation of the Act.

S.B. 1798
Creates the Personal Information Protection Act. Requires any person, business, or State agency conducting business in the State, and that owns or licenses computerized data that includes vulnerable personal information, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any person whose unencrypted personal information was, or is reasonably believed to have been acquired by an unauthorized person. Requires any person, business, or State agency that maintains computerized data that includes vulnerable personal information that the person, business, or State agency does not own, to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the vulnerable personal information was, or is reasonably believed to have been acquired by an unauthorized person. Provides that notice may be provided to a customer in one of the following ways: (1) written notice; or (2) substitute notice if the person or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information.

S.B. 1799
06/16/05 Signed by governor, Public Act 94-0041
Amends the Department of Revenue Law of the Civil Administrative Code of Illinois. Requires the Department of Revenue to notify an individual if the Department discovers or reasonably suspects that another person has used that individual’s Social Security number.

S.B. 1899
Creates the Identity Theft Notification Act. Requires any agency, person, or business that conducts business in Illinois and owns or licenses data that includes personal information concerning an Illinois resident to notify the resident that there has been a breach of the security of that data following discovery or notification of the breach. Requires any agency, person, or business that maintains data that includes personal information concerning an Illinois resident and that the agency, person, or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been acquired by an unauthorized person. Provides that notice may be provided in one of the following ways: (1) written notice; (2) electronic notice; or (3) substitute notice if the agency, person, or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the agency, person, or business does not have sufficient contact information.

Indiana
S.B. 49
(Final version of bill does not include security breach provision)
05/23/05 Signed by governor, Public Law 115
Various computer issues. Prohibits certain uses of spyware. Authorizes a provider of computer software, a web site owner, or a trademark or copyright holder harmed by a prohibited use of spyware to bring a civil action against the person who committed the prohibited act. Allows a person who brings a cause of action for unlawful spyware installation to receive injunctive relief and the greater of actual damages or $100,000 per violation.

S.B. 503
04/26/05 Signed by governor, Act 503
Requires a state agency to notify: (1) an individual of a security breach of the agency’s computer system if the individual’s unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person; and (2) all consumer reporting agencies if notice is provided to more than 1,000 people. Prohibits a state agency from releasing the Social Security number of an individual unless the release is: (1) required by state law, federal law, or court order; (2) authorized in writing by the individual; (3) made to comply with the USA Patriot Act or Presidential Executive Order 13224; or (4) made to a commercial entity for permissible uses set forth in the Drivers Privacy Protection Act, the Fair Credit Reporting Act, or the Financial Modernization Act of 1999. Provides that disclosure of the last four digits of a Social Security number is not considered a disclosure of the Social Security number. Makes it a Class D felony to knowingly make a false representation to obtain a Social Security number or for an agency employee to knowingly disclose a Social Security number. Provides that an agency employee who negligently discloses a Social Security number commits a Class A infraction. Requires an individual who prepares a document for recording to certify that the individual reviewed the entire document and took reasonable care to redact Social Security numbers in the document. After December 31, 2007, requires a county recorder or an employee of a county recorder to search documents using the redacting technology to redact Social Security numbers before the documents are release for public inspection. Establishes a pilot project beginning July 1, 2005, to develop procedures and test technology and equipment for searching recorded documents and redacting Social Security numbers.

Louisiana
S.B. 205
07/12/05 Signed by governor, Act 499
Provides for the Database Security Breach Notification Law.

Maine
L.D. 1671
06/10/05 Signed by governor, Chapter 379
Requires a business that owns or licenses electronic data containing personal information, following the discovery of a security breach, to notify the person whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Maryland
H.B. 1588 / S.B. 1002
03/28/05 Withdrawn (SB 1002)
04/04/05 Withdrawn (HB 1588)
04/11/05 Legislature adjourned
Requiring a business to destroy or arrange for the destruction of a customer’s records that contain specified personal information of the customer in a specified manner; requiring a business that owns or licenses specified personal information of an individual residing in the State to implement and maintain specified security procedures and practices; requiring businesses that own, license, or maintain specified records to notify specified persons of a breach of the security of a system.

Massachusetts
H.B. 2797
Requires companies that deal with nonpublic personal information to disclose any breach where said data was, or is reasonably believed to have been, acquired by an unauthorized person.

S.B. 184
Prevents identity theft through security breach notices and establishes a victim’s bill of rights.

S.B. 2058
Requires companies that collect personal information to disclose when said data has been compromised.

Michigan
H.B. 4525
Requires notification of unauthorized access to computer databases.

H.B. 4587
Requires notice of any breach of database security.

H.B. 4658
Consumer protection; requires notification of security breach of database containing personal identifying information.

S.B. 309
Requires notification of security breach of database containing personal identifying information.

Minnesota
H.F. 225 / S.F. 361
06/03/05 Signed by governor, Chapter 163
Relating to the classification and dissemination of government data; making certain technical, conforming and clarifying changes to certain provisions under the government data practices act, changing the terms state agency, political subdivision and statewide system to government entity; granting the legislative auditor access to classified data for inspection purposes.

H.F. 1410 / S.F. 1307 (Substituted by H.F. 2121)
05/23/05 Legislature adjourned
Requires businesses maintaining personal information in electronic form to disclose to consumers breaches in security.

H.F. 1943 / S.B. 2002 (§ 6)
05/23/05 Legislature adjourned
Consumer credit report security freeze authorized, identity theft and Social Security number protections, credit monitoring, personal record destruction, and civil and criminal penalties provided.

H.F. 1805 / S.F. 1805
05/23/05 Legislature adjourned
Requires businesses that possess personal data to notify persons whose information has been disclosed to unauthorized persons.

H.F. 2121 / S.F. 2118
06/02/05 Signed by governor, Chapter 167
Requires businesses that possess personal data to notify persons whose personal information has been disclosed to unauthorized persons.

Missouri
S.B. 506
05/26/05 Legislature adjourned
Prohibits the sharing of personal financial information with any unauthorized person unless the individual consents to the share. Requires a business or person that conducts business in the state that owns or licenses computerized data, to disclose any breach of security of that data, to any citizen of this state whose information may, or may very well have been, acquired by an unauthorized person. Allows for individuals to place security alerts and security freezes on their credit report, notifying any recipient of the report that the individual may have been a victim of identity theft, and prohibiting the release of the individual’s information without the express consent of the consumer. Details the obligations of consumer reporting agencies in response to this option.

Montana
H.B. 732
04/28/05 Signed by governor, Chapter 518
Adopts and revises laws to implement individual privacy and to prevent identity theft; requires a consumer reporting agency to block or expunge information on a report that results from a theft of identity; provides privacy protection provisions for credit card solicitations and renewals and telephone accounts; provides privacy protection for business records by requiring destruction of records; requires businesses to report a breach of computer security; requires a business that has an established business relationship with a customer and that has disclosed certain personal information to third parties to report that information to the customer; providing remedies and penalties for violation.

Nevada
A.B. 334
06/17/05 Signed by governor, Chapter 486
Requires a governmental agency that owns or licenses computerized data that includes personal information to notify any resident of the state whose personal information included in that data was, or is reasonably believed to have been, acquired by an unauthorized person.

A.B. 1 (22nd Special Session)
6/17/05 Signed by governor, Chapter 6
Makes technical corrections to certain legislative measures, including repeal of security breach provisions of A.B. 334.

S.B. 347
06/17/05 Signed by governor, Chapter 485
Relates to personal identifying information; prohibits the establishment or possession of a financial forgery laboratory; enhances the penalties for crimes involving personal identifying information that are committed against older persons and vulnerable persons; requires the issuer of a credit card to provide a notice including certain information concerning its policies regarding identity theft and the rights of cardholders when issuing a credit card to a cardholder; requires data collectors to provide notification concerning any breach of security involving system data; making various other changes concerning personal identifying information; provides penalties; and provides other matters properly relating thereto.

S.B. 435
06/07/05 Legislature adjourned
Relates to personal information; requires a business to implement reasonable measures to ensure security of records containing personal information; requires a business to take reasonable measures to destroy certain records containing personal information; requires data collectors to provide notification of any breach of the security of the system data to persons affected by the breach; and provides other matters properly relating thereto.

New Jersey
Assembly Committee Substitute for A.B. 4001 / S.B. 2665 / Senate Committee Substitute for Senate Bill Nos. 1914, 2154, 2155, 2440, 2441 and 2524 / A.B. 2048
09/22/05 Signed by governor, Chapter 226
Requires any business that conducts business in New Jersey or any public entity that compiles or maintains computerized records that include personal information to disclose any breach of security of those computerized records to any customer who is a resident of New Jersey whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The substitute also provides that any business or public entity that compiles or maintains computerized records on behalf of another business or public entity shall notify that business or public entity, who must then notify its New Jersey customers of the breach; however disclosure is not required if the business or public entity establishes that misuse of the information is not reasonably possible, any such determinations to be documented in writing and retained for five years. Furthermore, the disclosure may be delayed if a law enforcement agency determines that notification will impede a criminal investigation. Notice may be written or electronic. If the business demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the business does not have sufficient contact information, it may provide substitute notice, which must consist of all of the following: (1) e-mail notice when the business has an e-mail address; (2) conspicuous posting of the notice on the Web site page of the business, if the business maintains one; and (3) notification to major statewide media. However, a business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of the bill, shall be deemed to be in compliance with the notification requirements of this bill if the business notifies subject persons in accordance with its policies in the event of a breach of security of the system. Additionally, the bill requires a business to take all reasonable steps to destroy customer records within its control containing personal information which is no longer to be retained by the business. The customer records shall be destroyed by shredding, erasing, or otherwise modifying the personal information to make them unreadable or undecipherable through any means.

A.B. 1080
Requires that a financial institution that discovers or reasonably should discover that a consumer’s nonpublic personal information maintained by the financial institution was compromised in any way shall promptly notify the consumer of the breach of the security or confidentiality of the information. In addition to promptly notifying a consumer of the security compromise, a financial institution is required to provide assistance to the consumer to remedy any such compromise; to reimburse the consumer for any losses the consumer incurred as a result of the compromise of the security or confidentiality of such information; and to provide information concerning the manner in which the consumer can obtain assistance. However, a financial institution may delay notifying a consumer of the compromise of the security or confidentiality of the information at the request of a law enforcement agency investigating such violation for a period determined by the law enforcement agency performing the investigation. Additionally, if an issuer of credit receives a request for an additional credit card for an existing cardholder no later than 30 days after receiving a change of address for the cardholder, the issuer of credit is required to notify the cardholder of the request at the new address and former address no later than five days after sending the additional card to the new address. The issuer of credit shall also provide the cardholder with a means of promptly reporting incorrect changes. Any violation of this bill shall be punished under either N.J.S.A.56:11-38 or N.J.S.A.56:11-39, or both.

New York
A.B. 1525
Requires any banking institution that owns or licenses data that includes personal identifying information to disclose any breach of security following discovery or notification of such breach to any person whose personal identification was, or is reasonably believed to have been, acquired by an unauthorized person; defines personal identifying information and breach of security.

A.B. 4254 / S.B. 3492
08/09/05 Signed by governor, Chapter 442
Requires any state agency or business which owns or licenses a computerized database which includes vulnerable personal information shall disclose any breach of security of such system to any resident of New York state whose unencrypted personal information may have been acquired by an unauthorized person; provides enforcement provisions.

A.B. 5487 / S.B. 3000
Enacts the “personal information protection act”, requiring disclosure of breaches of security of data systems of business entities to affected persons; provides for administration by the department of state; requires use of best available technology to detect breaches of security; provides for a private right of action.

A.B. 6688
Requires notification of breach of security of personal information kept by state agencies; defines breach of security and personal information.

A.B. 6903
Requires any state agency or business which owns or licenses a computerized database which includes vulnerable personal information shall disclose any breach of security of such system to any resident of New York state whose unencrypted personal information may have been acquired by an unauthorized person; provides enforcement provisions.

A.B. 7349
Enacts the Identity Theft Prevention and Mitigation Act; establishes procedures to allow consumers to put a “security freeze” on their consumer information; provides for enforcement by the attorney general and security of Social Security account numbers; and provides for notice of information of breach of security.

A.B. 8937 / S.B. 5827
08/09/05 Signed by governor, Chapter 491
Makes technical changes to certain provisions of the information security breach and notification act; clarifies the definition of breach of the security system; changes references of person or entity to state entity; provides for telephone notification to affected persons.

A.B. 9037
Requires notice to consumers by credit agencies of a breach of security involving personal information.

S.B. 2161
Requires any state agency or business which owns or licenses a computerized database which includes vulnerable personal information shall disclose any breach of security of such system to any resident of New York state whose unencrypted personal information may have been acquired by an unauthorized person; provides enforcement provisions.

S.B. 2906
Requires notice to residents when a computerized database security breach releases personal information.

S.B. 3141
Requires any banking institution that owns or licenses data that includes personal identifying information to disclose any breach of security following discovery or notification of such breach to any person whose personal identification was, or is reasonably believed to have been, acquired by an unauthorized person; defines personal identifying information and breach of security.

S.B. 3494
Enacts the Identity Theft Prevention and Mitigation Act; establishes procedures to allow consumers to put a “security freeze” on their consumer information; provides for enforcement by the attorney general and security of social security account numbers; and provides for notice of information of breach of security.

S.B. 4978
Requires state agencies and business entities to disclose the breach of the security of any personal information of any resident of the state maintained on computerized database; establishes notice requirements; directs the state consumer protection board to enforce such provisions.

S.B. 5472
Requires notice to consumers by credit agencies of a breach of security involving personal information.

North Carolina
H.B. 1248 / S.B. 1048
09/21/05 Signed by governor, Chapter 414
Enacts the Identity Theft Protection Act of 2005, including consumer report security freezes, security breach notifications and protections for Social Security numbers.

S.B. 783
09/02/05 Legislature adjourned
Requires that data aggregators and other businesses immediately notify individuals of unauthorized or fraudulent access to personal information following information security breaches.

North Dakota
S.B. 2251
04/22/05 Signed by governor
Relating to requiring disclosure to consumers of a breach in security by businesses maintaining personal information in electronic form; relating to the unauthorized use of personal identifying information, penalties, and prosecution of offenses in multiple counties; to provide a penalty; declare an emergency.

Ohio
H.B. 104
11/17/05 Signed by governor
Requires a state agency, person, or business to contact individuals if unencrypted personal information about those individuals that is maintained on the computers of the agency, person, or business is obtained by unauthorized persons.

S.B. 89
Requires a state agency, person, or business to contact individuals if unencrypted personal information about those individuals that is maintained on the computers of the agency, person, or business is obtained by unauthorized persons.

Oregon
S.B. 626
Requires a person who owns or uses personal information to notify an individual when there is an unauthorized acquisition of personal information that compromises security of information.

S.B. 630
Requires person maintaining or possessing identifying information to take measures to protect against unauthorized access to or use of information prior to disposal or destruction of information.

S.B. 1057
Requires a person that owns or uses personal information to notify individual and consumer reporting agencies when there is breach of security that may result in misuse of personal information. Requires consumer reporting agency receiving notice of potential misuse of personal information to place security alert in relevant credit reports. Requires consumer reporting agency, at request of consumer, to place security freeze on consumer reports about consumer. Creates exceptions to requirements. Prohibits disclosure of Social Security number of individual. Provides exceptions. Punishes violation by maximum of one year’s imprisonment, $6,250 fine, or both. Requires person maintaining or possessing records containing personal information to take measures to protect against unauthorized access to or use of information prior to disposal or destruction of information. Allows private cause of action for damages. Makes violation of provisions of Act unlawful trade practice.

Pennsylvania
H.B. 1023
Provides for the notification of residents whose personal information data was or may have been disclosed due to a security system breach; and provides for penalties.

H.B. 1795
Providing for the notification of residents whose personal information data was or may have been disclosed due to a security system breach; and imposing penalties.

H.B. 2006
An act providing for breach of security of identifying information and for penalties.

S.B. 712
12/22/05 Signed by governor, Act 94
Providing for the notification of residents whose personal information data was or may have been disclosed due to a security system breach; and imposing penalties.

Rhode Island
H.B. 5893
07/01/05 Legislature adjourned
Establishes a duty to disclose any breach of security of a computerized data system.

H.B. 6191
07/10/05 Became law without governor’s signature, Chapter 225
Requires any person or business that conducts business in Rhode Island, and that owns or licenses computerized data that includes personal information, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of Rhode Island whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

S.B. 880
07/01/05 Legislature adjourned
Establishes a duty to disclose any breach of security of a computerized data system.

South Carolina
S.B. 669
06/02/05 Legislature adjourned
Provides for notice to a South Carolina resident whose personal identifying information may have been accessed through a breach of the security of computerized data owned, licensed, or otherwise controlled by a state agency, provides definitions, specifies requirements of the notice, and provides penalties for noncompliance; and provides for notice to a South Carolina resident whose personal identifying information may have been accessed through a breach of the security of computerized data owned, licensed, or otherwise controlled by a person conducting business in this state, provides definitions, specifies requirements of the notice, and provides penalties for noncompliance.

Tennessee
H.B. 2170 / S.B. 2220
06/08/05 Signed by governor, Chapter 473
Requires persons, businesses or government agencies that discover a breach of information security resulting in disclosure of unencrypted personal information about persons to unauthorized third parties to provide notice of such disclosure.

Texas
H.B. 1527
05/30/05 Legislature adjourned
Requires those who own or license data that includes identifying information to promptly notify the resident of any alleged breach of the security of the person’s data system, regardless of whether the resident’s identifying information has been accessed by an unauthorized person.

H.B. 1682
05/09/05 Passed House
05/30/05 Legislature adjourned
Relates to a breach in the security of a computerized data system that includes personal identifying information; providing a civil penalty.

S.B. 122
6/17/05 Signed by governor
Requires a person that conducts business in this state and owns or licenses computerized data that includes sensitive personal information to disclose any breach of system security, after discovering or receiving notification of the breach, to any resident of this state whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Virginia
H.B. 2721
02/27/05 Legislature adjourned
Requires agencies and businesses that maintain computerized data that includes personal information to notify the subject of that information when a breach of the database containing that information is discovered. No notice is required if an investigation determines that there is no reasonable belief that the information has been or will be used in an unlawful manner. Provides for various means of notifying the owner or licensee of that information and requires the agency or business to coordinate notification with consumer reporting agencies if they indicated that the affected individual can obtain a credit report. Damages for an agency violating this requirement are provided in the Government Data Collection and Dissemination Practices Act (§ 2.2-3800 et seq.). Damages for a business violating this requirement are provided in the Personal Information Privacy Act or PIPA (§ 59.1-442 et seq.). Expands the damages available for violations of PIPA to include actual damages, if greater than $100 per violation, and injunctive relief.

Washington
S.B. 6043
05/10/05 Signed by governor, Chapter 368
Requires any agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in this act, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Requires any person or business that conducts business in this state and that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in this act, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

West Virginia
H.B. 2772
04/09/05 Legislature adjourned
Requires commercial entities who maintain databases containing resident individuals’ personal information, to notify a resident individual, in writing, whenever the individual’s personal information has been compromised by unauthorized disclosure; and defines personal information.

Wisconsin
S.B. 164
11/09/05 Passed Senate
Requires an entity that possesses certain personal information about an individual to notify the individual when the information is accessed by a person who the individual has not authorized to do so (unauthorized access). The bill’s notice requirements apply to entities, including the state and local governments, that do any of the following: conduct business in Wisconsin and maintain personal information in the ordinary course of business; store personal information in this state; maintain a depository account for a Wisconsin resident; or lend money to a Wisconsin resident.

A.B. 320
This bill requires a business (or other corporate entity) that knows of the unauthorized use of unencrypted personal identifying information that was obtained from the business to make reasonable efforts to notify the individual whose personal identifying information was used. Generally, a business must notify the individual within 30 days after the business learns of the unauthorized use.