What does Alabama's data breach law ask a business to do?

Who does this law apply to?

The law applies to a covered entity: a person, business, nonprofit or government entity that acquires or uses sensitive personally identifying information.

Notice to each affected individual is due when the entity finds that the information was, or is reasonably believed to have been, acquired by an unauthorized person and that this is reasonably likely to cause substantial harm.

A covered entity that is not a third-party agent that determines under Section 8-38-4 that, as a result of a breach of security, sensitive personally identifying information has been acquired or is reasonably believed to have been acquired by an unauthorized person, and is reasonably likely to cause substantial harm to the individuals to whom the information relates, shall give notice of the breach to each individual.

A person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information.

What counts as personal information?

The law covers an Alabama resident's name joined with items such as a Social Security or tax identification number, a government identification number, a financial account number with the code needed to use it, medical or health insurance information.

A user name or email address with the password or security question and answer for an online account is covered too, where that account is likely to hold or give access to such information.

an Alabama resident's first name or first initial and last name in combination with one or more of the following with respect to the same Alabama resident:

A user name or email address, in combination with a password or security question and answer that would permit access to an online account affiliated with the covered entity that is reasonably likely to contain or is used to obtain sensitive personally identifying information.

How fast must people be told?

The text says notice must go out within 45 days of the entity's own determination that a breach has occurred and is reasonably likely to cause substantial harm, or of being told about the breach by a third-party agent.

A law enforcement agency may ask in writing for a delay.

Except as provided in subsection (c), the covered entity shall provide notice within 45 days of the covered entity's receipt of notice from a third-party agent that a breach has occurred or upon the covered entity's determination that a breach has occurred and is reasonably likely to cause substantial harm to the individuals to whom the information relates.

Who else must be told?

If more than 1,000 individuals must be notified, the entity must also give written notice to the Attorney General.

In the same case, the entity must notify the nationwide consumer reporting agencies of the timing, distribution and content of the notices.

If the number of individuals a covered entity is required to notify under Section 8-38-5 exceeds 1,000, the entity shall provide written notice of the breach to the Attorney General as expeditiously as possible and without unreasonable delay.

If a covered entity discovers circumstances requiring notice under Section 8-38-5 of more than 1,000 individuals at a single time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S.C. §1681a, of the timing, distribution, and content of the notices.

Is encrypted information treated differently?

Information that is truncated, encrypted or otherwise made unusable falls outside the definition, unless the entity knows or has reason to know that the key or credential that could make it readable was breached together with it.

Information that is truncated, encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable, including encryption of the data, document, or device containing the sensitive personally identifying information, unless the covered entity knows or has reason to know that the encryption key or security credential that could render the personally identifying information readable or useable has been breached together with the information.

What if a vendor holds the data?

A third-party agent that holds or processes the information for a covered entity must tell that entity of a breach no later than 10 days after determining it or having reason to believe it occurred.

In the event a third-party agent has experienced a breach of security in the system maintained by the agent, the agent shall notify the covered entity of the breach of security as expeditiously as possible and without unreasonable delay, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.