What does Missouri's data breach law ask a business to do?

Who does this law apply to?

A person that owns or licenses personal information of Missouri residents, or that conducts business in Missouri and owns or licenses such information, must tell the affected consumer about a breach of security.

No notice is owed if, after an appropriate investigation or after speaking with law enforcement, the person decides identity theft or other fraud is not reasonably likely. The text says that decision is to be documented in writing.

Any person that owns or licenses personal information of residents of Missouri or any person that conducts business in Missouri that owns or licenses personal information in any form of a resident of Missouri shall provide notice to the affected consumer that there has been a breach of security following discovery or notification of the breach.

notification is not required if, after an appropriate investigation by the person or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determines that a risk of identity theft or other fraud to any consumer is not reasonably likely to occur as a result of the breach.

What counts as personal information?

Personal information is a person's name together with a Social Security number, a driver's licence or other government ID number, a financial account or card number with any code or password that would open the account, an electronic identifier or routing code with such a code, medical information, or health insurance information.

(a) Social Security number; (b) Driver's license number or other unique identification number created or collected by a government body; (c) Financial account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account;

(d) Unique electronic identifier or routing code, in combination with any required security code, access code, or password that would permit access to an individual's financial account; (e) Medical information; or (f) Health insurance information.

How fast must people be told?

The law says the notice must be made without unreasonable delay.

It also allows for the needs of law enforcement and for the steps needed to find contact details, find the scope of the breach and restore the system.

The disclosure notification shall be: (a) Made without unreasonable delay;

Who else must be told?

When a person notifies more than one thousand consumers at one time, it must also notify the attorney general's office and the nationwide consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notice.

In the event a person provides notice to more than one thousand consumers at one time pursuant to this section, the person shall notify, without unreasonable delay, the attorney general's office and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice.

Is encrypted information treated differently?

The definition covers a name and data element only where one of the elements is not encrypted, redacted or otherwise altered so that it is unreadable or unusable.

"Personal information", an individual's first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or unusable:

What if a vendor holds the data?

A person that keeps or holds personal information of Missouri residents that it does not own or license must tell the owner or licensee immediately after discovering a breach.

Any person that maintains or possesses records or data containing personal information of residents of Missouri that the person does not own or license, or any person that conducts business in Missouri that maintains or possesses records or data containing personal information of a resident of Missouri that the person does not own or license, shall notify the owner or licensee of the information of any breach of security immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in this section.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.