Since January 1st of 2017, there has been upwards of 10 million personal information records lost or stolen each day. Odds are that you, or someone you know, has had their records compromised by a data breach. With such a high incident rate, individuals and businesses that have never received any kind of notification that their records were included in a breach, generally consider themselves lucky and assume that they are not at risk of identity theft or unauthorized account usage. Unfortunately for them, that is not always the case.
The fact is that there is a significant chance that your personal or non-public business information has been compromised in some way but, legally, the company that lost your information was not obligated to make you aware of the event. For your own benefit, understanding what your rights are when it comes to data breach laws is the first step in protecting your data. For example, do you know what information is considered ‘personal’? Are there ways that your data could have been lost or stolen but the offending entity was not compelled by law to notify you for some reason? The answer is yes.
Legal Definitions of Personal Information
Even though each state has their own laws and policies regarding data breaches and notification requirements, there is pretty much a consensus on the basics of what elements or combination of elements constitutes as ‘personal information’ in the eyes of the law. At a minimum, personal information includes:
As mentioned, this does make up the foundation of most secular legislation on data breaches. Many states go a step further, and only consider account information requiring a pin or password as having been compromised if the required pin or password was included with the record that was stolen. That is, if the use of a debit card requires a pin for a transaction, you will not be notified of the data loss unless both your debit card number and the pin are accessed.
A few of the more progressive states, like North Carolina and Nebraska, include biometrics and fingerprint information as part of their definition of personal information. Similarly, some states, like Missouri have more specific, detailed laws, limiting the legal maneuverability that comes with ambiguity in statutes.
Even though laws regarding the majority of health and medical information and data policies are covered under the United States’ federally mandated Health Insurance Portability and Accountability Act (HIPAA), a few states do include health-related information in their definition of personal information.
One more thing that the some of the state laws regarding data breaches of personal information address is that once a relatively high number of records have been stolen, the information holders must also notify consumer reporting agencies in addition to the Attorney Generals of all states that have affected residents. The number of records lost that trigger reporting to a consumer reporting agency tend to number between 1,000 and 5,000.
When it comes to sectoral legislation, the current statutes are, in general, skewed in favor of protecting the corporate information holder, as opposed to the individuals that have their information compromised.
For most small and medium-sized businesses, a data breach, regardless of whether their information was stolen or their network had been penetrated losing client records, has the potential be catastrophic. We help you take proactive data and network security measures and significantly reduce the chance that your network will fall victim to cybercriminals. Contact us today for a free consultation at (973) 882-4644.