What does Montana's data breach law ask a business to do?

Who does this law apply to?

A person or business that conducts business in Montana and owns or licenses computerized personal information must disclose a breach to each Montana resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

A breach under this law is one that materially compromises the information and causes, or is reasonably believed to cause, loss or injury to a Montana resident.

Any person or business that conducts business in Montana and that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the data system following discovery or notification of the breach to any resident of Montana whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.

"Breach of the security of the data system" means unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the person or business and causes or is reasonably believed to cause loss or injury to a Montana resident.

What counts as personal information?

Personal information is a person's name together with a Social Security number, a driver's licence, state ID or tribal ID number, an account or card number with any code or password that would open the account, medical record information, a taxpayer identification number, or an IRS identity protection PIN.

(A) social security number; (B) driver's license number, state identification card number, or tribal identification card number; (C) account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account;

(D) medical record information as defined in 33-19-104; (E) a taxpayer identification number; or (F) an identity protection personal identification number issued by the United States internal revenue service.

How fast must people be told?

The law says the disclosure must be made without unreasonable delay.

Room is left for the needs of law enforcement and for the steps needed to find the scope of the breach and restore the system.

The disclosure must be made without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (3), or consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Who else must be told?

At the same time as it notifies residents, the person or business must send the attorney general's consumer protection office an electronic copy of the notice and a statement of the date and method of distribution.

That copy leaves out anything that identifies an individual.

Any person or business that is required to issue a notification pursuant to this section shall simultaneously submit an electronic copy of the notification and a statement providing the date and method of distribution of the notification to the attorney general's consumer protection office, excluding any information that personally identifies any individual who is entitled to receive notification.

Is encrypted information treated differently?

The definition covers a name and data element only when either the name or the data elements are not encrypted.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

What if a vendor holds the data?

A person or business that keeps computerized personal information it does not own must tell the owner or licensee immediately after discovering a breach.

Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data system immediately following discovery if the personal information was or is reasonably believed to have been acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.