What does Kansas's data breach law ask a business to do?

Who does this law apply to?

The law applies to a person doing business in Kansas, and to a government body, that owns or licenses computerized personal information. On learning of a breach it must investigate promptly and in good faith.

Notice to the affected Kansas resident is due when the investigation finds misuse has occurred or is reasonably likely.

A person that conducts business in this state, or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information shall, when it becomes aware of any breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused.

If the investigation determines that the misuse of information has occurred or is reasonably likely to occur, the person or government, governmental subdivision or agency shall give notice as soon as possible to the affected Kansas resident.

What counts as personal information?

Personal information is a first name or first initial and last name linked to a Social Security number, a driver's licence or state identification card number, or a financial account or card number.

"Personal information" means a consumer's first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted:

How fast must people be told?

The text sets no number of days. Notice must be made in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and the time needed to find the scope of the breach and restore the system.

Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Who else must be told?

When more than 1,000 consumers must be notified at one time, the person must also tell the nationwide consumer reporting agencies, without unreasonable delay, about the timing, distribution and content of the notices.

the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. § 1681a(p), of the timing, distribution and content of the notices.

Is encrypted information treated differently?

A security breach under this law is unauthorized access to and acquisition of unencrypted or unredacted data that causes, or is reasonably believed to cause, identity theft. Data that is encrypted or redacted falls outside it.

"Security breach" means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or a commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer.

What if a vendor holds the data?

An individual or business that keeps personal information it does not own or license must tell the owner or licensee of a breach after finding it, when the information was or is reasonably believed to have been taken by an unauthorized person.

An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the data following discovery of a breach, if the personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.