What does Indiana's data breach law ask a business to do?

Who does this law apply to?

The law places the duty on a data base owner: a person that owns or licenses computerized data that includes personal information. The owner must tell an Indiana resident about a breach when it knows, should know, or should have known that the breach has resulted in or could result in identity deception, identity theft or fraud affecting that resident.

"Data base owner" means a person that owns or licenses computerized data that includes personal information.

if the data base owner knows, should know, or should have known that the unauthorized acquisition constituting the breach has resulted in or could result in identity deception (as defined in IC 35-43-5-3.5), identity theft, or fraud affecting the Indiana resident.

What counts as personal information?

Personal information is a Social Security number on its own, or a first name or first initial and last name together with a driver's licence number, a state identification card number, a credit card number, or a financial account or debit card number with the code or password that opens the account.

"Personal information" means: (1) a Social Security number that is not encrypted or redacted; (2) an individual's first and last names, or first initial and last name, and one (1) or more of the following data elements that are not encrypted or redacted:

How fast must people be told?

Notice must be made without unreasonable delay and not more than forty-five (45) days after the discovery of the breach. The text lists the reasons a delay may be reasonable, such as finding the scope of the breach or a request from law enforcement.

A person required to make a disclosure or notification under this chapter shall make the disclosure or notification without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach.

Who else must be told?

A data base owner that tells residents about a breach must also tell the attorney general. When more than one thousand consumers are told, the owner must also give each consumer reporting agency the information it needs to help prevent fraud.

If a data base owner makes a disclosure described in subsection (a), the data base owner shall also disclose the breach to the attorney general.

A data base owner required to make a disclosure under subsection (a) to more than one thousand (1,000) consumers shall also disclose to each consumer reporting agency (as defined in 15 U.S.C. 1681a(p)) information necessary to assist the consumer reporting agency in preventing fraud, including personal information of an Indiana resident affected by the breach of the security of a system.

Is encrypted information treated differently?

Encrypted personal information counts when the person who took it had access to the encryption key. Otherwise the duty covers unencrypted information.

encrypted personal information was or may have been acquired by an unauthorized person with access to the encryption key;

What if a vendor holds the data?

A person that keeps computerized data but is not the data base owner must tell the owner if it finds that personal information was or may have been taken by an unauthorized person.

A person that maintains computerized data but that is not a data base owner shall notify the data base owner if the person discovers that personal information was or may have been acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.