What does Mississippi's data breach law ask a business to do?

Who does this law apply to?

The law covers any person who conducts business in Mississippi and, in the ordinary course of business, owns, licenses or maintains personal information of a Mississippi resident.

A person who conducts business in Mississippi must disclose a breach of security to every affected resident.

No notice is owed if, after an appropriate investigation, the person reasonably decides the breach will not likely harm the affected individuals.

This section applies to any person who conducts business in this state and who, in the ordinary course of the person's business functions, owns, licenses or maintains personal information of any resident of this state.

A person who conducts business in this state shall disclose any breach of security to all affected individuals.

Notification shall not be required if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the affected individuals.

What counts as personal information?

Personal information is a person's name together with a Social Security number, a driver's licence or state ID card number, or an account or card number with any code or password that would open the financial account.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements:

An account number or credit or debit card number in combination with any required security code, access code or password that would permit access to an individual's financial account;

How fast must people be told?

The law says the disclosure must be made without unreasonable delay.

That is subject to any law enforcement delay and to the investigation needed to find the nature and scope of the incident, identify the people affected or restore the system.

The disclosure shall be made without unreasonable delay, subject to the provisions of subsections (4) and (5) of this section and the completion of an investigation by the person to determine the nature and scope of the incident, to identify the affected individuals, or to restore the reasonable integrity of the data system.

Who else must be told?

The text we read names no one else.

Is encrypted information treated differently?

A breach of security means personal information was acquired where access to it had not been secured by encryption, or by another method that makes it unreadable or unusable.

"Breach of security" means unauthorized acquisition of electronic files, media, databases or computerized data containing personal information of any resident of this state when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable;

What if a vendor holds the data?

A person that keeps computerized personal information it does not own or license must tell the owner or licensee as soon as practicable after discovering a breach, where the information was, or is reasonably believed to have been, acquired for fraudulent purposes.

Any person who conducts business in this state that maintains computerized data which includes personal information that the person does not own or license shall notify the owner or licensee of the information of any breach of the security of the data as soon as practicable following its discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person for fraudulent purposes.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.