Three States Launch New Data Breach Notification Requirements

guest · Dec 31, 2019

Three States Launch New Data Breach Notification Requirements
December 31, 2019
https://news.bloomberglaw.com/priva...nch-new-data-breach-notification-requirements

Companies in Texas, Illinois, and Oregon will have new notification obligations if they experience a data breach, under amendments to state laws taking effect Jan. 1.

States have been updating data breach notice statutes in recent years to broaden the definition of personal information and change requirements for when and how to notify affected individuals or the state attorney general
The amendments taking effect Jan. 1 are “building on the trends we’ve been seeing,” Brian Kint, an attorney at Cozen O’Connor P.C. in Philadelphia who advises companies on privacy and cybersecurity issues, said.
Click to expand...

Expanded Definition
The Oregon measure (S.B. 684) extends some data breach notice obligations to vendors and expands the definition of personal information to include information used to access an online account.
The Oregon law is “quite unique” in requiring vendors to notify the state attorney general if a breach involves the personal information of more than 250 Oregon residents, Hennessy said.

Illinois will require “data collectors” to notify the state attorney general for breaches affecting more than 500 Illinois residents under the bill (S.B. 1624) amending the state’s personal information protection law.

Texas will require businesses to notify affected individuals within 60 days of determining a breach occurred, rather than notifying them “as quickly as possible,” under the current law. The bill (H.B. 4390) also adds an obligation to notify the state attorney general if the breach involves at least 250 residents and creates a privacy protection council that will make recommendations for future state privacy laws by Sept. 1, 2020.
Click to expand...

Oregon (SB 684) (PDF): https://src.bna.com/IMg
Illinois (SB 1624) (PDF): https://aboutblaw.com/NGR
Texas (HB 4390) (PDF): https://aboutblaw.com/NGS

guest · Jan 3, 2020

Oregon Requires Vendors to Report Data Breaches
January 2, 2020
https://www.lexology.com/library/detail.aspx?g=4c591dc7-a1cb-44e8-a0f2-c538eb697109

The law is unique among state data breach notification laws in that it imposes a direct obligation on vendors to provide regulatory notice to the state. It also requires vendors to provide notice to the data owner within 10 days. And upon receipt of such notice of a data breach from a vendor, the data owner must provide notice to affected individuals within 45 days.
However, the new requirement may also incentivize service providers to take more responsibility for incident response.

Under the new Oregon statute, a vendor may now be directly required to provide regulatory notices, though there is an exception when the data owner has already provided such regulatory notice. What this means in practice is that there may be increased pressure on companies to provide regulatory notices more quickly and any disputes with vendors as to whether there has been a notifiable data breach will carry increased consequences that may turn public.

The Oregon law also specified that covered entities or vendors may have an affirmative defense to certain claims in the event of a data breach if they can show that “[...] the covered entity or vendor developed, implemented and maintained reasonable security measures that would be required for personal information subject to the applicable Act.”
Click to expand...

Log in or Sign up

Three States Launch New Data Breach Notification Requirements

guest Guest

guest Guest

Log in or Sign up

Three States Launch New Data Breach Notification Requirements

guest Guest

guest Guest

Useful Searches