What does Virginia's data breach law ask a business to do?

Who does this law apply to?

The law says an individual or entity that owns or licenses computerized personal information must disclose a breach to the Office of the Attorney General and to each affected Virginia resident.

The duty applies when unencrypted or unredacted information was or is reasonably believed to have been accessed and acquired, and the breach has caused or is reasonably believed to cause identity theft or other fraud.

an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay.

What counts as personal information?

Personal information is a person's name linked to a social security number, a driver's licence or state identification number, a financial account or card number with the code that opens the account, a passport number or a military identification number, where those items are neither encrypted nor redacted.

"Personal information" means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted:

How fast must people be told?

The text sets no fixed number of days. It says without unreasonable delay, with time allowed to find the scope of the breach and restore the system, and a delay where law enforcement says notice would impede an investigation.

Notice required by this section may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system.

Who else must be told?

The Office of the Attorney General is told of every breach this section covers. If more than 1,000 people are notified at one time, the Attorney General and the nationwide consumer reporting agencies must also be told of the timing, distribution and content of the notice.

In the event an individual or entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing, distribution, and content of the notice.

Is encrypted information treated differently?

Encrypted information still counts when it is taken in unencrypted form, or when the breach involves someone with access to the encryption key and fraud is reasonably believed to follow.

An individual or entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such a breach has caused or will cause identity theft or other fraud to any resident of the Commonwealth.

What if a vendor holds the data?

An individual or entity that holds personal information it does not own must tell the owner without unreasonable delay after it discovers the breach.

An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system,

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.