Washington, D.C. Adds Security Requirements in New Data Breach Notification Law

guest · May 13, 2020

Washington, D.C. Adds Security Requirements in New Data Breach Notification Law
May 8, 2020
https://www.dwt.com/blogs/privacy--...ashington-dc-new-data-breach-notification-law

Washington, D.C. amended its data breach notification law (D.C. Act 23-268) on March 26, 2020, expanding the definition of personal information covered by the law and requiring businesses collecting data from D.C. residents to implement “reasonable security safeguards.” Because D.C. law already provides a private right of action for violations of the data breach law, the updates will enable lawsuits in the event that an entity fails to meet the “reasonable security” standard—though recovery is limited to actual damages.

Personal information covered by the law was previously limited to first name or initial and last name in combination with a sensitive identifying number [...]
Click to expand...

The new law adds first name or initial and last name plus medical information, genetic information and DNA profile, health insurance information, and biometric information to the definition, or any listed data element without name if it would allow a person to commit identity theft. The law also now covers a user name or email in combination with authentication data that would permit access to an individual’s email account.

The breached entity must also provide notification to the D.C. Attorney General if the breach affects 50 or more D.C. residents; the prior law required only notification of credit reporting agencies if more than 1,000 D.C. residents were affected.
Click to expand...

The changes are projected to become effective on May 19, 2020.
Click to expand...

guest · May 31, 2020

New Washington D.C. Data Breach Notification Law Takes Effect
May 29, 2020
https://www.hipaajournal.com/new-washington-d-c-data-breach-notification-law-takes-effect/

On May 19, 2020, legislative changes to the Washington D.C. data breach notification law took effect. The changes were introduced in March and significantly updated existing breach notification requirements. There has been a major expansion of data classified as personal information that warrants breach notifications if subjected to unauthorized access and new data security requirements have been introduced.

Prior to the change, notifications were required if personal information such as names, phone numbers, and addresses were exposed in combination with a Social Security number, driver’s license number, DC ID card, or credit/debit card number or if numbers and codes were breached that allowed credit or finance accounts to be accessed.
The change has seen several other data elements added to the list. Breach notifications are now required if any of the following data is breached, even in the absence of a name if the data could be used for identity theft: [...]
Click to expand...

Log in or Sign up

Washington, D.C. Adds Security Requirements in New Data Breach Notification Law

guest Guest

guest Guest

Log in or Sign up

Washington, D.C. Adds Security Requirements in New Data Breach Notification Law

guest Guest

guest Guest

Useful Searches