With Memorial Day unofficially kicking off summer, those keeping up on recent changes to state data breach laws are eyeing their calendars, as a series of state amendments are due to come into effect. Beginning on July 1, both Nevada and Wyoming will expand their definitions of personal information. One month later on August 1, North Dakota will follow suit, slightly limiting its definition of personal information but expanding its reporting duties. Key takeaways from the state amendments are detailed below.
The states’ legislative actions will likely up the ante at a time when Congress is considering a national data breach notification standard. The recent flurry of activity reflects the states’ growing interest in how data breaches affect their residents. Even in the face of national legislation, that interest is unlikely to subside.
Nevada (A.B. 179)
· Nevada’s definition of “personal data” will expand to include medical, health insurance, or driver’s authorization identification numbers. The law will now also apply to breaches of a “user name, unique identifier or electronic mail address in combination with a password, access code or security question and answer that would permit access to an online account.”
· Wyoming will become the only state to define personal information as including an individual’s name in combination with shared log-in authenticators or security tokens, as well as birth or marriage certificates.
· Wyoming will also expand the information required in a breach notification. Not only must the notification be “clear and conspicuous,” but it must also indicate the types of information reasonably believed to be comprised, include a summary of the incident, and describe the actions taken to prevent future breaches.
North Dakota (S. 2214)
· In contrast to its Western brethren, North Dakota will actually limit its definition of personal information. With the amendment, employer-assigned identification numbers will only trigger the notification law if the numbers’ breach is also accompanied by a breach of a “required security code, access code, or password.”
· North Dakota will, however, expand its law in other ways. It will now require notification of the state Attorney General, in addition to those individuals whose data was compromised. Before the amendment, only individual notification was necessary.
· Most notably, North Dakota is also expanding the pool of companies potentially subject to its notification law. Previously, only those companies conducting business in the state were required to adhere to its breach notification procedures. As written, the amendment now applies the law to any company who suffers a breach, regardless of where it conducts business.