18.2-186.6 - Breach of personal information notification. - Virginia Statutes

§ 18.2-186.6. Breach of personal information notification.

A. As used in this section:

"Breach of the security of the system" means the unauthorized access andacquisition of unencrypted and unredacted computerized data that compromisesthe security or confidentiality of personal information maintained by anindividual or entity as part of a database of personal information regardingmultiple individuals and that causes, or the individual or entity reasonablybelieves has caused, or will cause, identity theft or other fraud to anyresident of the Commonwealth. Good faith acquisition of personal informationby an employee or agent of an individual or entity for the purposes of theindividual or entity is not a breach of the security of the system, providedthat the personal information is not used for a purpose other than a lawfulpurpose of the individual or entity or subject to further unauthorizeddisclosure.

"Encrypted" means the transformation of data through the use of analgorithmic process into a form in which there is a low probability ofassigning meaning without the use of a confidential process or key, or thesecuring of the information by another method that renders the data elementsunreadable or unusable.

"Entity" includes corporations, business trusts, estates, partnerships,limited partnerships, limited liability partnerships, limited liabilitycompanies, associations, organizations, joint ventures, governments,governmental subdivisions, agencies, or instrumentalities or any other legalentity, whether for profit or not for profit.

"Financial institution" has the meaning given that term in 15 U.S.C. §6809(3).

"Individual" means a natural person.

"Notice" means:

1. Written notice to the last known postal address in the records of theindividual or entity;

2. Telephone notice;

3. Electronic notice; or

4. Substitute notice, if the individual or the entity required to providenotice demonstrates that the cost of providing notice will exceed $50,000,the affected class of Virginia residents to be notified exceeds 100,000residents, or the individual or the entity does not have sufficient contactinformation or consent to provide notice as described in subdivisions 1, 2,or 3 of this definition. Substitute notice consists of all of the following:

a. E-mail notice if the individual or the entity has e-mail addresses for themembers of the affected class of residents;

b. Conspicuous posting of the notice on the website of the individual or theentity if the individual or the entity maintains a website; and

c. Notice to major statewide media.

Notice required by this section shall not be considered a debt communicationas defined by the Fair Debt Collection Practices Act in 15 U.S.C. § 1692a.

Notice required by this section shall include a description of the following:

(1) The incident in general terms;

(2) The type of personal information that was subject to the unauthorizedaccess and acquisition;

(3) The general acts of the individual or entity to protect the personalinformation from further unauthorized access;

(4) A telephone number that the person may call for further information andassistance, if one exists; and

(5) Advice that directs the person to remain vigilant by reviewing accountstatements and monitoring free credit reports.

"Personal information" means the first name or first initial and last namein combination with and linked to any one or more of the following dataelements that relate to a resident of the Commonwealth, when the dataelements are neither encrypted nor redacted:

1. Social security number;

2. Driver's license number or state identification card number issued in lieuof a driver's license number; or

3. Financial account number, or credit card or debit card number, incombination with any required security code, access code, or password thatwould permit access to a resident's financial accounts.

The term does not include information that is lawfully obtained from publiclyavailable information, or from federal, state, or local government recordslawfully made available to the general public.

"Redact" means alteration or truncation of data such that no more than thefollowing are accessible as part of the personal information:

1. Five digits of a social security number; or

2. The last four digits of a driver's license number, state identificationcard number, or account number.

B. If unencrypted or unredacted personal information was or is reasonablybelieved to have been accessed and acquired by an unauthorized person andcauses, or the individual or entity reasonably believes has caused or willcause, identity theft or another fraud to any resident of the Commonwealth,an individual or entity that owns or licenses computerized data that includespersonal information shall disclose any breach of the security of the systemfollowing discovery or notification of the breach of the security of thesystem to the Office of the Attorney General and any affected resident of theCommonwealth without unreasonable delay. Notice required by this section maybe reasonably delayed to allow the individual or entity to determine thescope of the breach of the security of the system and restore the reasonableintegrity of the system. Notice required by this section may be delayed if,after the individual or entity notifies a law-enforcement agency, thelaw-enforcement agency determines and advises the individual or entity thatthe notice will impede a criminal or civil investigation, or homeland ornational security. Notice shall be made without unreasonable delay after thelaw-enforcement agency determines that the notification will no longer impedethe investigation or jeopardize national or homeland security.

C. An individual or entity shall disclose the breach of the security of thesystem if encrypted information is accessed and acquired in an unencryptedform, or if the security breach involves a person with access to theencryption key and the individual or entity reasonably believes that such abreach has caused or will cause identity theft or other fraud to any residentof the Commonwealth.

D. An individual or entity that maintains computerized data that includespersonal information that the individual or entity does not own or licenseshall notify the owner or licensee of the information of any breach of thesecurity of the system without unreasonable delay following discovery of thebreach of the security of the system, if the personal information wasaccessed and acquired by an unauthorized person or the individual or entityreasonably believes the personal information was accessed and acquired by anunauthorized person.

E. In the event an individual or entity provides notice to more than 1,000persons at one time pursuant to this section, the individual or entity shallnotify, without unreasonable delay, the Office of the Attorney General andall consumer reporting agencies that compile and maintain files on consumerson a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing,distribution, and content of the notice.

F. An entity that maintains its own notification procedures as part of aninformation privacy or security policy for the treatment of personalinformation that are consistent with the timing requirements of this sectionshall be deemed to be in compliance with the notification requirements ofthis section if it notifies residents of the Commonwealth in accordance withits procedures in the event of a breach of the security of the system.

G. An entity that is subject to Title V of the Gramm-Leach-Bliley Act (15U.S.C. § 6801 et seq.) and maintains procedures for notification of a breachof the security of the system in accordance with the provision of that Actand any rules, regulations, or guidelines promulgated thereto shall be deemedto be in compliance with this section.

H. An entity that complies with the notification requirements or procedurespursuant to the rules, regulations, procedures, or guidelines established bythe entity's primary or functional state or federal regulator shall be incompliance with this section.

I. Except as provided by subsections J and K, pursuant to the enforcementduties and powers of the Office of the Attorney General, the Attorney Generalmay bring an action to address violations of this section. The Office of theAttorney General may impose a civil penalty not to exceed $150,000 per breachof the security of the system or a series of breaches of a similar naturethat are discovered in a single investigation. Nothing in this section shalllimit an individual from recovering direct economic damages from a violationof this section.

J. A violation of this section by a state-chartered or licensed financialinstitution shall be enforceable exclusively by the financial institution'sprimary state regulator.

K. A violation of this section by an individual or entity regulated by theState Corporation Commission's Bureau of Insurance shall be enforcedexclusively by the State Corporation Commission.

L. The provisions of this section shall not apply to criminal intelligencesystems subject to the restrictions of 28 C.F.R. Part 23 that are maintainedby law-enforcement agencies of the Commonwealth and the organized CriminalGang File of the Virginia Criminal Information Network (VCIN), establishedpursuant to Chapter 2 (§ 52-12 et seq.) of Title 52.

(2008, cc. 566, 801.)