Two days ago, we heard that Target Corporation has brought in anto oversee the company’s post-breach data security and technology operations. Now we learn that its home base of operations, Minnesota, is the latest state to propose a legislative reaction to the Target data breach.
The Minnesota legislature has introduced an expansive bill to amend the state’s data breach notification law to effectively create a 50-state notification requirement for entities doing business in Minnesota. The bill would:
-
Broaden the breach notification requirement to require that all individuals be notified, rather than only residents of Minnesota
-
Require notification to affected individuals or the owners/licensees of the informationwithin 48 hoursof discovery or notification of the breach
-
Require that the business required to give notice make available one year of free credit monitoring services to all affected individuals and that such services must be made available within 30 days of the breach
-
Require that breached retailers or wholesalers of consumer goods or services provide each affected individual with a $100 gift card for future use, valid for at least one year
-
Reimburse individuals who incur any charges or fees as a consequence of the breach