What does Washington's data breach law ask a business to do?

Who does this law apply to?

The law says a person or business that does business in Washington and owns or licenses personal information must tell each resident whose unsecured personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

No notice is owed when the breach is not reasonably likely to subject consumers to a risk of harm.

Any person or business that conducts business in this state and that owns or licenses data that includes personal information shall disclose any breach of the security of the system to any resident of this state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the personal information was not secured.

Notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm.

What counts as personal information?

Personal information is a person's name together with items such as a social security number, a driver's licence or Washington identification number, account or card numbers with access codes, full date of birth, passport or student numbers, health insurance numbers, medical information or biometric data.

A user name or email address together with a password or security questions and answers that open an online account counts on its own.

An individual's first name or first initial and last name in combination with any one or more of the following data elements:

User name or email address in combination with a password or security questions and answers that would permit access to an online account;

How fast must people be told?

Affected consumers are told in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered.

Notification to affected consumers under this section must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered,

Who else must be told?

If more than five hundred Washington residents are notified as a result of a single breach, the attorney general must be told no more than thirty days after the breach was discovered.

Any person or business that is required to issue a notification pursuant to this section to more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered.

Is encrypted information treated differently?

The duty to notify applies to information that was not secured. Secured means encrypted to the national standard or otherwise made unreadable; secured information must still be disclosed if the key or other means to decipher it was also acquired.

"Secured" means encrypted in a manner that meets or exceeds the national institute of standards and technology standard or is otherwise modified so that the personal information is rendered unreadable, unusable, or undecipherable by an unauthorized person.

What if a vendor holds the data?

A person or business that holds personal information it does not own must tell the owner immediately after it discovers the breach.

Any person or business that maintains or possesses data that may include personal information that the person or business does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery,

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.