To Notify, or not to Notify? Trend Towards Security Breach Notification Laws Continues

Since our last update in September of this year, four additional states have enacted security breach notification laws and similar laws are still pending in several states. New York, New Jersey, North Carolina and Ohio have all joined the fray, increasing the pressure on the federal government to pass a uniform federal security breach notification law. 

Each of the recently enacted laws, like the California law, generally require entities to promptly notify the residents of that state if the security, confidentiality or integrity of their personal information (defined similarly by most states with some notable exceptions) has been compromised.

The new state security laws don't just require notification of breaches after the fact. Some states require businesses to take measures now to prevent the occurrence of breaches. Depending on where your corporation does business, you could now be required by state law to:

• Implement and maintain security procedures and practices to protect personal information.
• Adopt measures to ensure transfers of personal information to third parties are subject to contractual safeguards.
• Review existing document destruction policies to ensure appropriate methods for the destruction of personal information.
• Utilize encryption to ensure the safe transfer of personal information to third parties.

The best way to avoid disclosure under the new laws is to avoid the breach in the first place. Therefore, we recommend that corporations adopt procedures for handling the security of personal information generally, and prepare a response plan which includes an established method for notifying individuals when and if their personal information is compromised. Furthermore, most states will accept an existing information security policy if it contains notification provisions that meet the timing requirements of the new laws. If you already have an information security policy, you may wish to review it to ensure it comports with new applicable state law.