What does New Hampshire's data breach law ask a business to do?

Who does this law apply to?

A person doing business in New Hampshire who owns or licenses computerized personal information must, on learning of a security breach, promptly decide how likely it is that the information has been or will be misused.

Any person doing business in this state who owns or licenses computerized data that includes personal information shall, when it becomes aware of a security breach, promptly determine the likelihood that the information has been or will be misused.

What counts as personal information?

Personal information is a person's name together with a Social Security number, a driver's licence or other government ID number, or an account or card number with any code or password that would open the financial account.

"Personal information" means an individual's first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (1) Social security number. (2) Driver's license number or other government identification number.

How fast must people be told?

If misuse has happened, is reasonably likely, or cannot be ruled out, the affected individuals must be notified as soon as possible.

The text says the disclosure is made as quickly as possible after that determination.

If the determination is that misuse of the information has occurred or is reasonably likely to occur, or if a determination cannot be made, the person shall notify the affected individuals as soon as possible as required under this subdivision.

The disclosure shall be made to affected individuals as quickly as possible, after the determination required under this section.

Who else must be told?

A business subject to RSA 358-A:3, I notifies its primary regulator. Everyone else notifies the New Hampshire attorney general's office.

When more than 1,000 consumers must be notified, the nationwide consumer reporting agencies must also be told, without unreasonable delay.

Any person engaged in trade or commerce that is subject to RSA 358-A:3, I shall also notify the regulator which has primary regulatory authority over such trade or commerce. All other persons shall notify the New Hampshire attorney general's office.

If a person is required to notify more than 1,000 consumers of a breach of security pursuant to this section, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. section 1681a(p), of the anticipated date of the notification to the consumers, the approximate number of consumers who will be notified, and the content of the notice.

Is encrypted information treated differently?

The definition covers a name and data element when either is not encrypted. Data does not count as encrypted if it was acquired together with a key, code or password that would open it.

Data shall not be considered to be encrypted for purposes of this subdivision if it is acquired in combination with any required key, security code, access code, or password that would permit access to the encrypted data.

What if a vendor holds the data?

A person or business that keeps computerized personal information it does not own must notify and cooperate with the owner or licensee immediately after discovering a breach.

Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify and cooperate with the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.