What does South Carolina's data breach law ask a business to do?

Who does this law apply to?

The law applies to a person conducting business in South Carolina that owns or licenses computerized or other data with personal identifying information. The duty to tell a resident applies when illegal use has occurred or is reasonably likely, or when use of the information creates a material risk of harm to that resident.

A person conducting business in this State, and owning or licensing computerized data or other data that includes personal identifying information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of this State whose personal identifying information that was not rendered unusable through encryption, redaction, or other methods was, or is reasonably believed to have been, acquired by an unauthorized person when the illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to the resident.

What counts as personal information?

Personal identifying information is a first name or first initial and last name linked to another listed item, when that item is neither encrypted nor redacted. The list in the text includes a social security number, a driver's licence or state ID number, a financial account or card number with the code that opens it, and other numbers or information that can open a financial account or that a government body issues to identify a person.

"Personal identifying information" means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of this State, when the data elements are neither encrypted nor redacted:

How fast must people be told?

The text sets no fixed number of days. Notice must be given in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and for the steps needed to find the scope of the breach and restore the system.

The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (C), or with measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Who else must be told?

When a business notifies more than one thousand people at one time, it must also tell the Consumer Protection Division of the Department of Consumer Affairs and the nationwide consumer reporting agencies about the timing, distribution and content of the notice.

If a business provides notice to more than one thousand persons at one time pursuant to this section, the business shall notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs and all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice.

Is encrypted information treated differently?

Yes. A breach covers data that was not made unusable through encryption, redaction or other methods.

"Breach of the security of the system" means unauthorized access to and acquisition of computerized data that was not rendered unusable through encryption, redaction, or other methods that compromises the security, confidentiality, or integrity of personal identifying information maintained by the person, when illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to a resident.

What if a vendor holds the data?

A person that keeps personal identifying information it does not own must tell the owner or licensee immediately after discovering the breach.

A person conducting business in this State and maintaining computerized data or other data that includes personal identifying information that the person does not own shall notify the owner or licensee of the information of a breach of the security of the data immediately following discovery, if the personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.