What does Arizona's data breach law ask a business to do?

Who does this law apply to?

The law applies to a person that conducts business in Arizona and owns, maintains or licenses unencrypted and unredacted computerized personal information.

When such a person becomes aware of a security incident, it must investigate promptly to determine whether there has been a security system breach.

If a person that conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach.

What counts as personal information?

Personal information is a person's first name or first initial and last name joined with a specified data element, such as a Social Security number, a driver license number, a financial account or card number with its access code, health insurance or medical information, a passport number or biometric data.

A user name or email address with the password or security question and answer for an online account is covered on its own.

(i) An individual's first name or first initial and last name in combination with one or more specified data elements. (ii) An individual's user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account.

How fast must people be told?

The person that owns or licenses the data must notify the affected individuals within forty-five days after determining there has been a breach.

No notice is due if the person, an independent third-party auditor or a law enforcement agency determines after a reasonable investigation that the breach has not resulted in, and is not reasonably likely to result in, substantial economic loss to affected individuals.

If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall: 1. Notify the individuals affected pursuant to subsection E of this section and subject to the needs of law enforcement as provided in subsection D of this section.

A person is not required to make the notification required by subsection B of this section if the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals.

Who else must be told?

If more than one thousand individuals must be notified, the person must also notify the three largest nationwide consumer reporting agencies, and, in writing, the attorney general and the director of the Arizona department of homeland security.

If the breach requires notification of more than one thousand individuals, notify both: (a) The three largest nationwide consumer reporting agencies. (b) The attorney general and the director of the Arizona department of homeland security, in writing,

Is encrypted information treated differently?

A breach under this law is about unencrypted and unredacted computerized personal information, so information that is encrypted or redacted is outside it.

Means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

What if a vendor holds the data?

A person that maintains the information for someone else must tell the owner or licensee as soon as practicable after discovering a breach, and share information relevant to it.

A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.