What does North Dakota's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person that owns or licenses computerized data that includes personal information. That person must tell any North Dakota resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Any person that owns or licenses computerized data that includes personal information, shall disclose any breach of the security system following discovery or notification of the breach in the security of the data to any resident of the state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What counts as personal information?

Personal information is a first name or first initial and last name together with another listed item, when the name and that item are not encrypted. The list in the text includes a social security number, a driver's licence or state ID number, a financial account or card number with the code that opens it, date of birth, the mother's maiden name, medical and health insurance information, an employer ID number with its code, and an electronic signature.

"Personal information" means an individual's first name or first initial and last name in combination with any of the following data elements, when the name and the data elements are not encrypted:

How fast must people be told?

The text sets no fixed number of days. Notice must be given in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and for the steps needed to find the scope of the breach and restore the system.

The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in section 51-30-04, or any measures necessary to determine the scope of the breach and to restore the integrity of the data system.

Who else must be told?

The attorney general must be told, by mail or email, of any breach that exceeds two hundred fifty individuals.

In addition, any person that experiences a breach of the security system as provided in this section shall disclose to the attorney general by mail or electronic mail any breach of the security system which exceeds two hundred fifty individuals.

Is encrypted information treated differently?

Yes. A breach is an unauthorized acquisition of data that was not secured by encryption or another method that makes the files unreadable or unusable.

"Breach of the security system" means unauthorized acquisition of computerized data when access to personal information has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable.

What if a vendor holds the data?

A person that keeps personal information it does not own must tell the owner or licensee immediately after discovering the breach.

Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following the discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.