What does West Virginia's data breach law ask a business to do?

Who does this law apply to?

The law says an individual or entity that owns or licenses computerized personal information must tell each West Virginia resident whose unencrypted and unredacted information was, or is reasonably believed to have been, accessed and acquired, where the breach has caused or is reasonably believed to cause identity theft or other fraud.

An individual or entity that owns or licenses computerized data that includes personal information shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state.

What counts as personal information?

Personal information is a person's name linked to a social security number, a driver's licence or state identification number, or a financial account or card number with the code that opens the account, where those items are neither encrypted nor redacted.

"Personal information" means the first name or first initial and last name linked to any one or more of the following data elements that relate to a resident of this state, when the data elements are neither encrypted nor redacted:

How fast must people be told?

The text sets no fixed number of days. It says without unreasonable delay, with time allowed to find the scope of the breach and restore the system, and a delay where law enforcement says notice would impede an investigation.

Except as provided in subsection (e) of this section or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the notice shall be made without unreasonable delay.

Who else must be told?

If more than one thousand people must be notified, the nationwide consumer reporting agencies must also be told of the timing, distribution and content of the notices.

If an entity is required to notify more than one thousand persons of a breach of security pursuant to this article, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined by 15 U.S.C. §1681a (p), of the timing, distribution and content of the notices.

Is encrypted information treated differently?

Encrypted information still counts when it is taken in unencrypted form, or when the breach involves someone with access to the encryption key and fraud is reasonably believed to follow.

An individual or entity must give notice of the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state.

What if a vendor holds the data?

An individual or entity that holds personal information it does not own must tell the owner as soon as practicable after it discovers the breach.

An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery,

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.