What does Ohio's data breach law ask a business to do?

Who does this law apply to?

The duty falls on any person that owns or licenses computerized data that includes personal information. A breach is unauthorized access to and acquisition of that data when it causes, or reasonably is believed will cause, a material risk of identity theft or other fraud to an Ohio resident. The person must disclose it to every resident whose personal information was, or reasonably is believed to have been, accessed and acquired.

"Breach of the security of the system" means unauthorized access to and acquisition of computerized data that compromises the security or confidentiality of personal information owned or licensed by a person and that causes, reasonably is believed to have caused, or reasonably is believed will cause a material risk of identity theft or other fraud to the person or property of a resident of this state.

Any person that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system, following its discovery or notification of the breach of the security of the system, to any resident of this state whose personal information was, or reasonably is believed to have been, accessed and acquired by an unauthorized person if the access and acquisition by the unauthorized person causes or reasonably is believed will cause a material risk of identity theft or other fraud to the resident.

What counts as personal information?

Personal information is a first name or first initial and last name together with a Social Security number, a driver's license or state identification card number, or an account, credit or debit card number with the code or password that opens the account. Elements that are encrypted or redacted so that they are unreadable are left out.

"Personal information" means an individual's name, consisting of the individual's first name or first initial and last name, in combination with and linked to any one or more of the following data elements, when the data elements are not encrypted, redacted, or altered by any method or technology in such a manner that the data elements are unreadable:

How fast must people be told?

Notice must be made in the most expedient time possible and not later than forty-five days after discovery or notification of the breach. The text allows for the needs of law enforcement and for the measures needed to find the scope of the breach and restore the data system.

The person shall make the disclosure described in division (B)(1) of this section in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach in the security of the system, subject to the legitimate needs of law enforcement activities described in division (D) of this section and consistent with any measures necessary to determine the scope of the breach, including which residents' personal information was accessed and acquired, and to restore the reasonable integrity of the data system.

Who else must be told?

When more than one thousand Ohio residents are told in a single occurrence, the person must also tell, without unreasonable delay, the consumer reporting agencies that keep files on consumers nationwide. The section asks for no notice to the attorney general, who may investigate and bring a civil action where a person does not comply.

If a person discovers circumstances that require disclosure under this section to more than one thousand residents of this state involved in a single occurrence of a breach of the security of the system, the person shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the disclosure given by the person to the residents of this state.

The attorney general may conduct pursuant to sections 1349.191 and 1349.192 of the Revised Code an investigation and bring a civil action upon an alleged failure by a person to comply with the requirements of this section.

Is there a rule for a business with ten employees or fewer?

Yes. A business entity with ten employees or fewer that shows the cost of individual notices would exceed ten thousand dollars may give substitute notice instead: a paid advertisement in a local newspaper for three consecutive weeks, a conspicuous posting on its website if it has one, and notice to the major media outlets in its area.

Substitute notice in accordance with this division, if the person required to disclose demonstrates that the person is a business entity with ten employees or fewer and that the cost of providing the disclosures or notices to residents to whom disclosure or notification is required will exceed ten thousand dollars.

What if a vendor holds the data?

A person that stores computerized personal information on behalf of or at the direction of another person must tell that other person about a breach in an expeditious manner, on the same material-risk test.

Any person that, on behalf of or at the direction of another person or on behalf of or at the direction of any governmental entity, is the custodian of or stores computerized data that includes personal information shall notify that other person or governmental entity of any breach of the security of the system in an expeditious manner,

Who is exempt?

A financial institution, trust company or credit union that must tell its customers about a breach under federal law and is examined by its federal regulator for that duty is exempt. So is a covered entity under the federal health privacy rule, so a clinic or practice covered by HIPAA follows the federal rule instead.

This section does not apply to any person or entity that is a covered entity as defined in 45 C.F.R. 160.103, as amended.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.