What does Delaware's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person who conducts business in Delaware and owns or licenses computerized data that includes personal information.

That person must notify each affected Delaware resident, unless an appropriate investigation leads it to reasonably determine that the breach is unlikely to result in harm.

Any person who conducts business in this State and who owns or licenses computerized data that includes personal information shall provide notice of any breach of security following determination of the breach of security to any resident of this State whose personal information was breached or is reasonably believed to have been breached, unless, after an appropriate investigation, the person reasonably determines that the breach of security is unlikely to result in harm to the individuals whose personal information has been breached.

What counts as personal information?

Personal information is a Delaware resident's first name or first initial and last name joined with items such as a Social Security number, a driver's license or identification card number, a financial account or card number with its access code, a passport number, medical or health insurance information, biometric data or an individual taxpayer identification number.

A username or email address with the password or security question and answer for an online account is on the list too.

"Personal information" means a Delaware resident's first name or first initial and last name in combination with any 1 or more of the following data elements that relate to that individual:

A username or email address, in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The text says notice must be made without unreasonable delay and not later than 60 days after determination of the breach, with exceptions such as a shorter federal deadline or a law enforcement request for delay.

Notice required by subsection (a) of this section must be made without unreasonable delay but not later than 60 days after determination of the breach of security, except in the following situations:

Who else must be told?

If more than 500 Delaware residents are to be notified, the Attorney General must also be told no later than the time notice goes to residents.

If the affected number of Delaware residents to be notified exceeds 500 residents, the person required to provide notice shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General.

Is encrypted information treated differently?

Acquiring encrypted information is not a breach of security, unless the encryption key was taken too, or is reasonably believed to have been, and the owner reasonably believes the key could make the information readable.

The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information is not a breach of security to the extent that personal information contained therein is encrypted, unless such unauthorized acquisition includes, or is reasonably believed to include, the encryption key and the person that owns or licenses the encrypted information has a reasonable belief that the encryption key could render that personal information readable or useable.

What if a vendor holds the data?

A person that maintains the data for someone else must notify and cooperate with the owner or licensee immediately after determining there was a breach.

A person that maintains computerized data that includes personal information that the person does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of security immediately following determination of the breach of security.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.