Category Archives: notification

Lege Trend. What triggers a notification? How does that standard impact a business liability?

Draft Federal legislation will require notification of breach if and only if a business determines:

  • “a reasonable risk that the breach of data security has resulted in identity theft, fraud or economic loss”

Why does this specific statuory draft langauge matter? Courts are split on whether a business is liable when a data breach hasn’t resulted in actual fraud or economic loss, which means the language sets up a liability threshold.

Fox 13 | Report: Draft bill would allow credit reporting…

5 Points. Unanimous Data Security Bill Post- Equifax.

Oregon’s SB 1551 (2018)  will require:

  • notification to consumers of a data breach within 45 days unless it could hinder law enforcement
  • if more than 250 Oregonians are affected, then notice must also go to the state Attorney General
  • a violation triggers Deceptive Trade Practices Act 
    • this means class action lawsuits
    • this also means big fines
  • no fees for credit freezes or thaws
  • prohibits ‘ “upselling” by breached companies or third-party contractors when they offer people free credit…

6 Data Security Policy Trends in 2018

  • Policies to improve data security workforce
  • Liability policy for businesses that utilize 3rd parties to manage and mitigate security incidents and challenges
  • Policies to encourage more women in data security workforce
  • Liability and notification requirements when comapnies utilize automated security security tools
  • Policies that Support Awareness and Training of existing workforce
  • Policies that ecourage businesses to maintain a base level of data security and notification requirements

Hea…

12 TEXAS INTERIM CHARGES. DATA SECURITY. 1 Select Committee.

House Committee on Appropriations 

#5  Trends in data security & cost savings Monitor the ongoing implementation of Article IX, Sec. 9.13 of the General Appropriations Act and determine if state agencies are realizing cost savings and/or security enhancements in state operations related to cybersecurity, information technology, and cloud computing. Study trends in cloud computing and IT delivery services, and identify whether additional cost efficiencies, economies of scale, or IT…

2,000 TX HHSC Clients Data Exposed.

Data Breach at HHSC? No, a box of client records was left in a box unattended by a dumpster in Houston.

The personal information exposed included:

  • names
  • client numbers
  • birth dates
  • case numbers
  • phone numbers

The HHSC response:

  • 1 year of free credit monitoring to anyone affected
  • A review. of HHSC’s document destruction procedures

SC Media | 2,000 Texas HHSC clients health data compromised

HHSC | HIPAA Notice: Houston-area Accidental Loss of Client Information

Lege Trend. +1 State Adding More Stringent Notification & Mandating Identity Theft Services

State: Delaware

 What is HB 180 in Delaware trying to do?

  • Improve notification requirements
  • Require 1 year of identity theft mitigation services when Social Security numbers are breached
  • Require businesses to safeguard personal information
  • Require notice to Delawareans affected by a breach within 60 days of discovery
  • If more than 500 residents impacted, the Attorney General must be notified

If passed, Delaware would be state #2 to require ID theft services after a breach.

News.Delaware.Go…

Lege Trend. Exception to Data Notification.

Trendy new exception to data breach notifications: encrypted data

How Tennesee worded the exception in its legislation: 

(1) “Breach of system security”:
      (A) Means the acquisition of the information set out in subdivision (a)(1)(A)(i) or (a)(1)(A)(ii) by an unauthorized person that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder:

           (i) Unencrypted computerized data; or

           (ii) Encrypted…

New Mexico. Data Security Legislation 2017. 3 Key Points.

New Mexico’s House Bill 15  wants to put the state on par with other states by remedying  a gap in our existing consumer protections by:

  • Requiring notice within 45 days 
  • After Personal Identifying Information is Compromised
  • With notification to the state attorney general and consumer credit reporting agencies

Los Alamos Daily Post | House Passes Data Breach Notification Act

Lege Trend: Western Neighbor Data Breach Bill Applies to All.

Long gone are the days when data breach notifications only applied to retailers, or so says New Mexico.

The Bill: House Bill 15 (2017) The Data Breach Notification Act

What it does:

  • Any person who possess personal information about a New Mexican has 30 days to disclose any data breach
  • Requires the state attorney general office to work with any person who has suffered a data breach that triggers notification to New Mexicans.

KOB 4 | Lawmaker sponsors data breach notification bill