On June 15, 2012, Connecticut amended the state’s security breach notification law. The amendment will go into effect on October 1, 2012, and requires businesses to notify the state Attorney General when notice of a security breach is provided to state residents—with such notice to affected residents to be provided “without unreasonable delay.” Connecticut follows Vermont as the second state this summer to amend its data breach statute to require notice to be given to the state’s Attorney General.
The Connecticut and Vermont amendments seem to be on the forefront of a legislative trend requiring companies suffering a data breach to provide notice of the breach not only to the affected individuals, but also to state or federal offices, giving those agencies the ability to initiate independent investigations into the circumstances surrounding the breach. Similarly, Senator Pat Toomey’s proposed national breach notification law, the Data Security and Breach Notification Act of 2012, would require businesses to notify the Secret Service or the FBI if the number of affected individuals numbers more than 10,000. Although there is no specific timing requirement for the notice to be provided to the federal agencies, the bill would require covered entities to notify affected individuals “as expeditiously as practicable and without unreasonable delay”—language that is used in over half of the state breach notification laws in effect today.
These additional requirements to notify governmental agencies in the event of a breach may derive from the White House’s Consumer Privacy Bill of Rights, which states that consumers should have the right to have companies held accountable for violations of their rights under the Privacy Bill of Rights. But whatever the reason, companies that store personally identifiable information must have policies and procedures in place to handle the actual data breach event and subsequent notification requirements.
Toomey’s national data security bill joins a long list of proposed national data security legislation that has been introduced in the past 18 months.