Draft Federal legislation will require notification of breach if and only if a business determines:
- “a reasonable risk that the breach of data security has resulted in identity theft, fraud or economic loss”
Why does this specific statuory draft langauge matter? Courts are split on whether a business is liable when a data breach hasn’t resulted in actual fraud or economic loss, which means the language sets up a liability threshold.
Fox 13 | Report: Draft bill would allow credit reporting agencies, banks to conceal data breaches