1. Home
  2. |Insights
  3. |To Notify or Not to Notify - 2006 Update

To Notify or Not to Notify - 2006 Update

Client Alert | 2 min read | 04.07.06

Following in the footsteps of the California legislature, twenty-three other states have now passed security breach notification laws, and there are similar laws pending in several more states. Additionally, as we march into the second quarter of 2006, several states are considering legislation to expand their existing security breach notification laws to broaden the types of entities covered by the law, to eliminate exemptions under the law (including some exemptions for HIPAA-covered or Graham-Leach-Bliley-covered entities) and to regulate the use of social security numbers, among other things.

Each of the recently enacted laws, like the California law, generally requires entities to promptly notify the residents of that state if the security, confidentiality or integrity of their personal information (defined similarly by most states with some notable exceptions) has been compromised. 

However, the new state security laws don't just require notification of breaches after the fact. Some states require businesses to take measures now to prevent the occurrence of breaches. Depending on where you do business, you could be required by state law to:

  • Implement and maintain security procedures and practices to protect personal information.
  • Adopt measures to ensure transfers of personal information to third parties are subject to contractual safeguards.
  • Review existing document destruction policies to ensure appropriate timing and methods for the destruction of personal information.
  • Utilize encryption to ensure the safe transfer of personal information to third parties.

The best way to avoid disclosure under the new laws is to avoid the breach in the first place. Therefore, corporations are well-advised to adopt procedures for handling the security of personal information generally, and prepare a response plan which includes an established method for notifying individuals when and if their personal information is compromised. In addition to enforcement by the State Attorneys General and private litigants, the FTC is actively enforcing privacy laws through the general unfair act or practices portion of the FTC Act.

The FTC brought a number of high profile enforcement actions involving security breach incidents in 2005 and the trend continues in 2006, increasing the pressure for businesses to implement and maintain adequate security procedures and practices that closely mirror those found in the Safeguards Rules of the Gramm-Leach-Bliley Act. Most notably, the FTC recently issued the largest fine in FTC history against ChoicePoint, with $10 million in civil penalties, and $5 million in consumer redress.

Contacts

Insights

Client Alert | 5 min read | 12.12.25

Eleventh Circuit Hears Argument on False Claims Act Qui Tam Constitutionality

On the morning of December 12, 2025, the Eleventh Circuit heard argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, et al., No. 24-13581 (11th Cir. 2025). This case concerns the constitutionality of the False Claims Act (FCA) qui tam provisions and a groundbreaking September 2024 opinion in which the United States District Court for the Middle District of Florida held that the FCA’s qui tam provisions were unconstitutional under Article II. See United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, 751 F. Supp. 3d 1293 (M.D. Fla. 2024). That decision, penned by District Judge Kathryn Kimball Mizelle, was the first success story for a legal theory that has been gaining steam ever since Justices Thomas, Barrett, and Kavanaugh indicated they would be willing to consider arguments about the constitutionality of the qui tam provisions in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). In her opinion, Judge Mizelle held (1) qui tam relators are officers of the U.S. who must be appointed under the Appointments Clause; and (2) historical practice treating qui tam and similar relators as less than “officers” for constitutional purposes was not enough to save the qui tam provisions from the fundamental Article II infirmity the court identified. That ruling was appealed and, after full briefing, including by the government and a bevy of amici, the litigants stepped up to the plate this morning for oral argument....

View All Insights