If your organization suffers a data breach, you are required -- in many instances -- to notify individuals that their personal information may have been compromised. Security breach notification laws enacted in almost all states are designed to help protect affected individuals by giving them due warning and the opportunity to take action to protect themselves against the consequences of identity theft and unauthorized account access.
The requirements of the security breach notification laws, however, present a maze of compliance obligations. Although the 44 state laws governing breach notification are similar, each presents a somewhat unique approach to the basic set of issues. How a company prepares for and responds to a security breach can be key to ensuring compliance.
Prevention: Your best legal defense
Given the adverse publicity that often follows a breach disclosure, a premium should be placed on taking steps, in advance, to reduce or eliminate the risk of having to make a disclosure. Perhaps the most basic step is to reduce or eliminate the amount of notice-triggering information that your company collects and maintains.
[ For a complete understanding of IT's security obligations see "Data security: What the law requires of IT" and Thomas J. Smedinghoff's Enterprise Data Protection presentation ( Part 1 | Part 2 | Part 3 ) ]
First, you should review your information-collection practices, both to identify where sensitive personal information is collected and stored, and to assess whether such information is really needed. In many cases, the retention of information subject to the security breach notification laws, such as Social Security numbers, may not be necessary. If it is, it is vital to have an accurate understanding and inventory of the sensitive personal data your company collects, how it is used, where it is stored, and how it is protected.
It is, of course, important to ensure that appropriate security measures are in place to protect this data. Encryption, in particular, provides a potential legal benefit, as breach notification statutes apply only to the compromise of unencrypted personal information. Thus, to the extent reasonably feasible, encryption of all sensitive personal information may well help you avoid the need to make embarrassing disclosures.
Regardless of the level of security implemented, breaches may still occur. Thus, companies should develop and implement a well-thought-out incident response plan.
Notification in the wake of a breach
If a breach of personal information does occur, the first step is to determine whether notification is required, and if so, who must be notified. Those seemingly simple questions often require very complex analysis and a review of numerous state laws.
First, you must identify the data elements that were compromised and the states in which the data subjects reside. All state breach laws apply if the compromise involves an individual's name plus Social Security number, driver's license number, or credit card number. But many states also cover a variety of other information, such as medical information, mother's maiden name, date of birth, and passport numbers. Thus, an assessment of the data elements compromised and the states of residence of the data subjects will determine the potentially applicable laws.
Next, you must evaluate the applicability of those laws to the facts of the case at hand. It is possible that there may be one or more exceptions to the notification requirement. As mentioned above, breach laws do not require notification if the data was encrypted. And under many of the breach laws, even if an unauthorized acquisition of unencrypted personal data occurred, notice is not required where there is no reasonable likelihood of harm to the persons whose information has been compromised.
If the notification laws do apply to the breach, the next step is determining who must be notified. In all cases, of course, the individuals who are the subject of the compromised data must be notified. But many laws also require notice to the credit agencies, and several states require notice to the state's attorney general. Moreover, some states, such as Maryland, require notice to the attorney general before any announcements are sent to individual residents of the state.
When notifying affected individuals, timing is essential. Generally, persons must be notified in the most expedient time possible and without unreasonable delay. In most states, notification times may be extended to accommodate the needs of law enforcement and to give the company the opportunity to take measures necessary to determine the scope of the breach and restore reasonable integrity to the system. Some states, however, impose specific time limits, such as 45 days from discovery of the breach.
Finally, the text of the notification itself is critical. Many state laws impose requirements for the content of the notice. But equally as important is the tone the notice sends to the affected individuals and to the public generally. When a security breach becomes public, it can have a significant impact on the perception of the business in the marketplace. The content of the notice, and its impact on the recipients and others who read it, is critical to consider. It is, in effect, a public relations document.