What does Idaho's data breach law ask a business to do?

Who does this law apply to?

The law applies to a city, county or state agency, an individual, or a commercial entity doing business in Idaho that owns or licenses computerized personal information about Idaho residents. On learning of a breach it must investigate promptly and in good faith.

Notice to residents is due when that investigation finds misuse has occurred or is reasonably likely.

A city, county or state agency, individual or a commercial entity that conducts business in Idaho and that owns or licenses computerized data that includes personal information about a resident of Idaho shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused.

If the investigation determines that the misuse of information about an Idaho resident has occurred or is reasonably likely to occur, the agency, individual or the commercial entity shall give notice as soon as possible to the affected Idaho resident.

What counts as personal information?

Personal information is an Idaho resident's first name or first initial and last name together with a Social Security number, a driver's licence or Idaho identification card number, or a financial account or card number with the code or password that opens the account.

"Personal information" means an Idaho resident's first name or first initial and last name in combination with any one (1) or more of the following data elements that relate to the resident, when either the name or the data elements are not encrypted:

How fast must people be told?

The text sets no number of days for residents. Notice must be made in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and the time needed to find the scope of the breach and the people affected.

Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach, to identify the individuals affected, and to restore the reasonable integrity of the computerized data system.

Who else must be told?

A public agency that learns of a breach must notify the office of the Idaho attorney general within twenty-four (24) hours of such discovery. For businesses, the text we read names no one else.

When an agency becomes aware of a breach of the security of the system, it shall, within twenty-four (24) hours of such discovery, notify the office of the Idaho attorney general.

Is encrypted information treated differently?

A breach under this law is the illegal acquisition of unencrypted computerized data. Information that is encrypted falls outside that definition.

"Breach of the security of the system" means the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information for one (1) or more persons maintained by an agency, individual or a commercial entity.

What if a vendor holds the data?

An agency, individual or business that keeps personal information it does not own or license must tell the owner or licensee immediately after finding a breach, when misuse occurred or is reasonably likely, and must cooperate with them.

An agency, individual or a commercial entity that maintains computerized data that includes personal information that the agency, individual or the commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system immediately following discovery of a breach if misuse of personal information about an Idaho resident occurred or is reasonably likely to occur.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.