/>iOver the past six months, a significant number of states have amended their data breach notification statutes. Specifically, thirteen states have amended their statutes to: (1) require notice to the State Attorney General, (2) broaden existing definitions (e.g., expand the definition of “personal information”), (3) provide industry exemptions (e.g., exempt HIPAA-regulated entities, financial institutions, and entities regulated by the state’s insurance code), (4) regulate the insurance industry (through implementation of the National Association of Insurance Commissioner’s 2017 Insurance Data Security Model Law), (5) add new terms and definitions, (6) require stricter notification timeframes, (7) regulate entities that were breached, but were not the owner or licensee of the data, (8) add a statute of limitations for civil actions brought under the statute, and (9) create a state cybersecurity task force. The below descriptions provide a high-level overview of each state’s data breach notification statute amendments, which are further summarized in the below chart.
Arkansas amended its data breach notification statute (Ark. Code Ann. § 4-110-101, et seq. (West 2019)) to broaden the definition of “personal information” to include “biometric data[;]” and require notification to the State Attorney General, if 1,000 or more individuals are affected, at the same time as notice to the affected individuals or 45 days after the business “determines that there is a reasonable likelihood of harm to customers, whichever occurs first[.]”
Bill: H.B. 1943
Passed: April 15, 2019
Effective: July 23, 2019
Connecticut amended its data breach notification statute (Conn. Gen. Stat. § 36a-701b (West 2019)) to add the “Insurance Data Security Law,” which regulates those licensed under Connecticut insurance laws.
Bill: H.B. 7424
Passed: June 26, 2019
Effective: October 1, 2019
Florida amended its data breach notification statute (Fla. Stat. § 501.171 (West 2019)) to transfer “powers, duties, functions, records, offices, personnel, pending issues [and] contracts, administrative authority, administrative rules, [and] funds from” the Florida Agency for State Technology (“AST”) to the Florida Department of Management Services (“DMS”); establish the Division of State Technology within DMS; specify reporting requirements for the executive branch agencies and judicial branch through a statewide travel management system; require each state agency to adopt formal procedures for cloud-computing options; and create a Florida Cybersecurity Task Force “to review and conduct an assessment of the state’s cybersecurity infrastructure, governance, and operations.”
Bill: H.B. 5301
Passed: June 24, 2019
Effective: July 1, 2019
Maryland amended its data breach notification statute (Md. Code Ann., Com. Law. § 14-3501, et seq. (West 2019)) to add the “Insurance – Breach of Security of a Computer System – Notification Requirement,” which requires “certain carriers […] to notify the Maryland Insurance Commissioner […] that a certain breach of the security of a system has occurred;” and requires “a carrier to provide the notice” within 45 days (S.B. 30). Further, Maryland amended its statute to add that when the breached business is not the “owner or licensee of the computerized data, the business may not charge the owner or licensee of the computerized data a fee for providing information that the owner or licensee needs to make a notification under” the statute, and the “owner or licensee of the computerized data may” only use the information relative to the breach to (1) provide notification of the breach, (2) protect or secure personal information, or (3) provide notification to national information security organizations created for information-sharing and analysis of security threats to avert additional breaches (S.B. 1154).
Bills: S.B. 30 H.B. 1154
Passed: April 18, 2019 April 30, 2019
Effective: October 1, 2019 October 1, 2019
Massachusetts amended its data breach notification statute (Mass. Gen. Laws Ann. ch. 93H, § 1, et seq. (West 2019)) to add requirements to a breach notification letter to affected consumers, the State Attorney General, and the office of consumer affairs and business regulation. The requirements include whether the organization implemented a written information security program.
Bill: H.B. 4806
Passed: January 10, 2019
Effective: April 10, 2019
Michigan amended its data breach notification statute (Mich. Comp. Laws § 445.61, et seq. (West 2019)) to exempt entities regulated by the Insurance Code (Mich. Comp. Laws §§ 500.100-8302 (West, 2019)), and added a chapter to the Insurance Code (Mich. Comp. Laws § 500.559, et seq. (West 2019)) to regulate individuals or companies licensed by the Michigan Department of Insurance and Financial Services with respect to data breaches separate and apart from other industry sectors.
Bills: H.B. 6491 H.B. 6406
Passed: December 28, 2018 December 28, 2018
Effective: January 20, 2021 January 20, 2020
Mississippi amended its data breach notification laws (Miss. Code § 75-24-29 (West 2019)) to add the “Insurance Data Security Law,” which regulates those licensed under Mississippi insurance laws.
Bill: S.B. 2831
Passed: April 3, 2019
Effective: July 1, 2019
New Jersey amended its data breach notification statute (N.J. Rev. Stat. § 56:8-161, et seq. (West 2019)) to broaden the definition of “personal information” to include “user name, email address, or any other account holder identifying information, in combination with any password or security question and answer that would permit access to an online account,” and the business that was breached may provide notification in “in electronic or other form that directs the customer […] to promptly change any password […] to protect the online account with the business,” but the “business […] that furnishes an email account shall not provide notification to the email account that is subject to a security breach.”
Bill: S.B. 52
Passed: May 10, 2019
Effective: September 1, 2019
Oregon amended its data breach notification statute (Or. Rev. Stat. § 646A.600, et seq. (West 2019)) to broaden the definition of “personal information” (e.g., a “user name or other means of identifying a consumer for the purpose of permitting access to the consumer’s account, together with any other method necessary to authenticate the user name or means of identification”); define “covered entity” (“a person that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of the person’s business, vocation, occupation or volunteer activities”) and “vendor” (“a person with which a covered entity contracts to maintain, store, manage, process or otherwise access personal information for the purpose of, or in connection with, providing services to or on behalf of the covered entity”); exempt entities regulated under HIPAA; and require a breached “vendor” to notify the State Attorney General when there is more than 250 affected consumers.
Bill: S.B. 684
Passed: May 24, 2019
Effective: January 1, 2020
Texas amended its data breach notification statute (Tex. Bus. & Com. Code § 521.001, et seq. (West 2019)) to impose, on state agencies, a breach notification timeframe of 10 days “after the date of the eradication, closure, and recovery from a breach, suspected breach, or unauthorized exposure;” and create a cybersecurity coordination program for utilities (H.B. 64). Further, Texas amended its statute to add a breach notification requirement to the State Attorney General where more than 250 residents are affected and to impose a 60-day reporting period to affected residents and the State Attorney General following determination of a breach; and provide requirements for the contents of a breach notification letter, including any measures intended to be taken regarding the breach after notification (H.B. 4390).
Bills: H.B. 4390 H.B. 64
Passed: June 14, 2019 April 15, 2019
Effective: January 1, 2020 September 1, 2019
Utah amended its data breach notification statute (Utah Code § 13-44-101, et seq. (West 2019)) to add the definition of “financial institution;” exempt financial institutions and their affiliates; add a statute of limitations of 5 years for a civil action under the statute; and amend the State Attorney General litigation fund from $2 million to $4 million, which now includes “citizen education and outreach[.]”
Bill: S.B. 193
Passed: March 26, 2019
Effective: May 14, 2019
Virginia amended its data breach notification statute (Va. Code § 18.2-186.6 (West 2019)) to broaden the definition of “personal information” to include “[p]assport number;” and “[m]ilitary identification number” and require notification of a breach of such information in combination with the resident’s “first name or first initial and last name” to the State Attorney General and any affected residents “without unreasonable delay[.]”
Bill: H.B. 2396
Passed: March 18, 2019
Effective: July 1, 2019
Washington amended its data breach notification statute (Wash. Rev. Code Ann. § 19.255.010, et seq. (West 2019)) to broaden the definition of “personal information” (e.g., “full date of birth,” “Student, military, or passport identification number,” etc.) and change the timing of notification to affected individuals and the State Attorney General from 45 to 30 days after discovery of a data breach.
Bill: S.H.B. 1071
Passed: May 7, 2019
Effective: March 1, 2020
***
In light of these amendments, organizations should revisit their incident response plans to ensure compliance with the new data breach notification requirements.
