What does New Jersey's data breach law ask a business to do?

Who does this law apply to?

A business that conducts business in New Jersey, or a public entity, that compiles or maintains computerized records with personal information must disclose a breach to each New Jersey resident customer whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person.

No disclosure is owed if the business or public entity establishes that misuse of the information is not reasonably possible. The text says that decision is documented in writing.

Any business that conducts business in New Jersey, or any public entity that compiles or maintains computerized records that include personal information, shall disclose any breach of security of those computerized records following discovery or notification of the breach to any customer who is a resident of New Jersey whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person.

Disclosure of a breach of security to a customer shall not be required under this section if the business or public entity establishes that misuse of the information is not reasonably possible.

What counts as personal information?

Personal information is a person's name linked with a Social Security number, a driver's licence or State ID number, or an account or card number with any code or password that would open the account.

A user name, email address or other account holder identifier together with a password or security question and answer that would open an online account also counts.

"Personal information" means an individual's first name or first initial and last name linked with any one or more of the following

(1) Social Security number; (2) driver's license number or State identification card number;

(4) user name,email address, or any other account holder identifying information, in combination with any password or security question and answer that would permit access to an online account.

How fast must people be told?

The law says the disclosure must be made in the most expedient time possible and without unreasonable delay.

Room is left for the needs of law enforcement and for the steps needed to find the scope of the breach and restore the system.

The disclosure to a customer shall be made in the most expedient time possible and without unreasonable delay,

Who else must be told?

Before telling customers, the business or public entity must report the breach to the Division of State Police in the Department of Law and Public Safety.

When more than 1,000 people must be notified at one time, the nationwide consumer reporting agencies must also be told, without unreasonable delay.

Any business or public entity required under this section to disclose a breach of security of a customer's personal information shall, in advance of the disclosure to the customer, report the breach of security and any information pertaining to the breach to the Division of State Police in the Department of Law and Public Safety for investigation or handling, which may include dissemination or referral to other appropriate law enforcement entities.

in the event that a business or public entity discovers circumstances requiring notification pursuant to this section of more than 1,000 persons at one time, the business or public entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile or maintain files on consumers on a nationwide basis,

Is encrypted information treated differently?

A breach of security means access to personal information that had not been secured by encryption, or by another method that makes it unreadable or unusable.

"Breach of security" means unauthorized access to electronic files, media or data containing personal information that compromises the security, confidentiality or integrity of personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable.

What if a vendor holds the data?

A business or public entity that keeps computerized records for another must tell that business or public entity immediately after discovering a breach, and that business or public entity then notifies its New Jersey customers.

Any business or public entity that compiles or maintains computerized records that include personal information on behalf of another business or public entity shall notify that business or public entity, who shall notify its New Jersey customers, as provided in subsection a. of this section, of any breach of security of the computerized records immediately following discovery, if the personal information was, or is reasonably believed to have been, accessed by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.