1. Home
  2. |Insights
  3. |To Notify, or not to Notify? Trend Towards Security Breach Notification Laws Continues

To Notify, or not to Notify? Trend Towards Security Breach Notification Laws Continues

Client Alert | 1 min read | 12.01.05

Since our last update in September of this year, four additional states have enacted security breach notification laws and similar laws are still pending in several states. New York, New Jersey, North Carolina and Ohio have all joined the fray, increasing the pressure on the federal government to pass a uniform federal security breach notification law. 

Each of the recently enacted laws, like the California law, generally require entities to promptly notify the residents of that state if the security, confidentiality or integrity of their personal information (defined similarly by most states with some notable exceptions) has been compromised.

The new state security laws don't just require notification of breaches after the fact. Some states require businesses to take measures now to prevent the occurrence of breaches. Depending on where your corporation does business, you could now be required by state law to:

  • Implement and maintain security procedures and practices to protect personal information.
  • Adopt measures to ensure transfers of personal information to third parties are subject to contractual safeguards.
  • Review existing document destruction policies to ensure appropriate methods for the destruction of personal information.
  • Utilize encryption to ensure the safe transfer of personal information to third parties.

The best way to avoid disclosure under the new laws is to avoid the breach in the first place. Therefore, we recommend that corporations adopt procedures for handling the security of personal information generally, and prepare a response plan which includes an established method for notifying individuals when and if their personal information is compromised. Furthermore, most states will accept an existing information security policy if it contains notification provisions that meet the timing requirements of the new laws. If you already have an information security policy, you may wish to review it to ensure it comports with new applicable state law.

Contacts

Insights

Client Alert | 5 min read | 12.12.25

Eleventh Circuit Hears Argument on False Claims Act Qui Tam Constitutionality

On the morning of December 12, 2025, the Eleventh Circuit heard argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, et al., No. 24-13581 (11th Cir. 2025). This case concerns the constitutionality of the False Claims Act (FCA) qui tam provisions and a groundbreaking September 2024 opinion in which the United States District Court for the Middle District of Florida held that the FCA’s qui tam provisions were unconstitutional under Article II. See United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, 751 F. Supp. 3d 1293 (M.D. Fla. 2024). That decision, penned by District Judge Kathryn Kimball Mizelle, was the first success story for a legal theory that has been gaining steam ever since Justices Thomas, Barrett, and Kavanaugh indicated they would be willing to consider arguments about the constitutionality of the qui tam provisions in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). In her opinion, Judge Mizelle held (1) qui tam relators are officers of the U.S. who must be appointed under the Appointments Clause; and (2) historical practice treating qui tam and similar relators as less than “officers” for constitutional purposes was not enough to save the qui tam provisions from the fundamental Article II infirmity the court identified. That ruling was appealed and, after full briefing, including by the government and a bevy of amici, the litigants stepped up to the plate this morning for oral argument....

View All Insights