What does District of Columbia's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person or entity that conducts business in the District and owns or licenses computerized or other electronic data that includes personal information.

On discovering a breach, it must promptly notify each District resident whose personal information was included.

Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach.

What counts as personal information?

Personal information is a name or other personal identifier joined with items such as a Social Security, taxpayer, passport or driver's license number, an account or card number with a code, medical, genetic or health insurance information, or biometric data.

A user name or email address with a password, security question and answer or other means of authentication that permits access to an email account is covered on its own.

An individual's first name, first initial and last name, or any other personal identifier, which, in combination with any of the following data elements, can be used to identify a person or the person's information:

A user name or e-mail address in combination with a password, security question and answer, or other means of authentication, or any combination of data elements included in sub-sub-subparagraphs (I) through (VI) of sub-subparagraph (i) that permits access to an individual's e-mail account.

How fast must people be told?

The text sets no fixed number of days. It says notification must be made in the most expedient time possible and without unreasonable delay.

It is not a breach where the person or entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement, that the acquisition will likely not result in harm.

The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (d) of this section, and with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Acquisition of personal information of an individual that the person or entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General for the District of Columbia and federal law enforcement agencies, will likely not result in harm to the individual.

Who else must be told?

If the breach affects 50 or more District residents, the Office of the Attorney General for the District of Columbia must receive prompt written notice.

If more than 1,000 persons must be notified, the nationwide consumer reporting agencies must be told as well.

In addition to giving the notification required under subsection (a) of this section, and subject to subsection (d) of this section, the person or entity required to give notice shall promptly provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia if the breach affects 50 or more District residents.

If any person or entity is required by subsection (a) or (b) of this section to notify more than 1,000 persons of a breach of security pursuant to this subsection, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis,

Is encrypted information treated differently?

Acquiring data made secure through encryption or redaction is not a breach, unless the information obtained could compromise the security protection itself.

Acquisition of data that has been rendered secure, including through encryption or redaction of such data, so as to be unusable by an unauthorized third party unless any information obtained has the potential to compromise the effectiveness of the security protection preventing unauthorized access;

What if a vendor holds the data?

A person or entity that holds the data for someone else must tell the owner or licensee in the most expedient time possible after discovering a breach.

Any person or entity who maintains, handles, or otherwise possesses computerized or other electronic data that includes personal information that the person or entity does not own shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.