What does Alaska's data breach law ask a business to do?

Who does this law apply to?

The law applies to a covered person: a person doing business, a governmental agency, or a person with more than 10 employees.

A covered person that owns or licenses personal information on an Alaska resident must disclose a breach to each resident whose information was subject to it.

If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.

"covered person" means a (A) person doing business; (B) governmental agency; or (C) person with more than 10 employees;

What counts as personal information?

Personal information is a person's first name or first initial and last name joined with items such as a Social Security number, a driver's license or state identification card number, or an account, credit card or debit card number.

Information that is encrypted or redacted falls outside the definition, unless the encryption key has been accessed or acquired.

"personal information" means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of (A) an individual's name;

(i) the individual's social security number; (ii) the individual's driver's license number or state identification card number; (iii) except as provided in (iv) of this subparagraph, the individual's account number, credit card number, or debit card number;

How fast must people be told?

The text sets no fixed number of days. It says the disclosure must be made in the most expeditious time possible and without unreasonable delay.

A delay is allowed for a law enforcement investigation and as needed to find the scope of the breach and restore the system.

An information collector shall make the disclosure required by (a) of this section in the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.

Who else must be told?

A covered person may skip disclosure only after an appropriate investigation and written notice to the Alaska attorney general, and only if it finds no reasonable likelihood of harm.

If more than 1,000 residents must be notified, the nationwide consumer credit reporting agencies must also be told.

Notwithstanding (a) of this section, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach.

If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis and provide the agencies with the timing, distribution, and content of the notices to state residents.

What if a vendor holds the data?

An information recipient that holds information it does not own must tell the owner or licensor immediately after discovering a breach, and cooperate so that the owner can notify residents.

However, immediately after the information recipient discovers the breach, the information recipient shall notify the information distributor who owns the personal information or who licensed the use of the personal information to the information recipient about the breach and cooperate with the information distributor as necessary to allow the information distributor to comply with (b) of this section.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.