What does Louisiana's data breach law ask a business to do?

Who does this law apply to?

The law says a person or agency that owns or licenses computerized personal information must notify any Louisiana resident whose information was, or is reasonably believed to have been, taken by an unauthorized person.

Notice is not needed if, after a reasonable investigation, the person or business finds there is no reasonable likelihood of harm to Louisiana residents.

Any person that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information, shall, following discovery of a breach in the security of the system containing such data, notify any resident of the state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Notification as provided in this Section shall not be required if after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to the residents of this state.

What counts as personal information?

Personal information is a first name or first initial and last name together with a Social Security number, a driver's licence or state identification card number, a financial account or card number with its code or password, a passport number, or biometric data, when the name or the data element is not encrypted or redacted.

"Personal information" means the first name or first initial and last name of an individual resident of this state in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted:

How fast must people be told?

Notice must be made in the most expedient time possible and without unreasonable delay, and not later than sixty days from the discovery of the breach, allowing for the needs of law enforcement.

The notification required pursuant to Subsections C and D of this Section shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach, consistent with the legitimate needs of law enforcement, as provided in Subsection F of this Section, or any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system.

Who else must be told?

When notice is delayed for law enforcement or to find the scope of the breach, the person or agency must give the attorney general the reasons for the delay in writing within the sixty day period.

When notification required pursuant to Subsections C and D of this Section is delayed pursuant to Subsection F of this Section or due to a determination by the person or agency that measures are necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system, the person or agency shall provide the attorney general the reasons for the delay in writing within the sixty day notification period provided in this Subsection.

What if a vendor holds the data?

A person or agency that keeps personal information it does not own must tell the owner or licensee of a breach after finding it, when the information was or is reasonably believed to have been taken by an unauthorized person.

Any agency or person that maintains computerized data that includes personal information that the agency or person does not own shall notify the owner or licensee of the information if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person through a breach of security of the system containing such data, following discovery by the agency or person of a breach of security of the system.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.