What does Nebraska's data breach law ask a business to do?

Who does this law apply to?

An individual or commercial entity that conducts business in Nebraska and owns or licenses computerized personal information about a Nebraska resident must, on learning of a breach, run a reasonable and prompt investigation in good faith.

If that investigation finds that the information has been used, or is reasonably likely to be used, for an unauthorized purpose, the affected Nebraska residents must be notified.

An individual or a commercial entity that conducts business in Nebraska and that owns or licenses computerized data that includes personal information about a resident of Nebraska shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose.

If the investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur, the individual or commercial entity shall give notice to the affected Nebraska resident.

What counts as personal information?

Personal information is a resident's name together with a Social Security number, a driver's licence or state ID number, an account or card number with any code or password that would open the account, or other listed identifiers such as biometric data.

A user name or email address together with a password or security question and answer that would open an online account also counts.

(i) Social security number; (ii) Motor vehicle operator's license number or state identification card number; (iii) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident's financial account;

(b) A user name or email address, in combination with a password or security question and answer, that would permit access to an online account.

How fast must people be told?

The law says notice must be made as soon as possible and without unreasonable delay.

Room is left for the needs of law enforcement and for the steps needed to find the scope of the breach and restore the system.

Notice shall be made as soon as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Who else must be told?

When residents must be notified, the Attorney General must also be told, no later than the time the residents are.

If notice of a breach of security of the system is required by subsection (1) of this section, the individual or commercial entity shall also, not later than the time when notice is provided to the Nebraska resident, provide notice of the breach of security of the system to the Attorney General.

Is encrypted information treated differently?

A breach under this law is the unauthorized acquisition of unencrypted data. Data does not count as encrypted if the key or confidential process was, or is reasonably believed to have been, acquired in the breach.

Breach of the security of the system means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or a commercial entity.

Data shall not be considered encrypted if the confidential process or key was or is reasonably believed to have been acquired as a result of the breach of the security of the system;

What if a vendor holds the data?

An individual or commercial entity that keeps computerized personal information it does not own or license must notify and cooperate with the owner or licensee when it learns of a breach, where misuse has happened or is reasonably likely.

An individual or a commercial entity that maintains computerized data that includes personal information that the individual or commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system when it becomes aware of a breach if use of personal information about a Nebraska resident for an unauthorized purpose occurred or is reasonably likely to occur.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.