iSouth Dakota and Alabama are the last of the 50 states to have enacted breach notification laws, along with Washington, D.C., Guam, Puerto Rico and the Virgin Islands. South Dakota became the 49th state to enact a data breach notification law when Governor Dennis Daugaard signed Senate Bill 62 into law on March 21. It goes into effect on July 1, 2018. On March 28, 2018, Alabama Governor Kay Ivey signed into law Alabama Senate Bill 318, effective May 1, 2018. Below are the parameters of these new data breach notification laws.
The South Dakota law only applies to computerized data and, like many states’ laws, includes an encryption safe harbor in the definition of “breach.” This means that a breach occurs when there is an unauthorized acquisition (versus access) of unencrypted computerized data or encrypted data with the encryption key. As with the majority of other states, the law includes a risk of harm analysis before affected individuals must be notified.
Notice to the South Dakota Attorney General is required if the breach affects more than 250 state residents – joining 24 other state attorneys general that require specific notice of a breach. Notification to affected state residents must be made within 60 days of the discovery that a breach has occurred, which is longer than most states that establish a specific timeframe. The new law does not create a private right of action, but authorizes the attorney general to both bring criminal prosecutions and seek up to $10,000 per day per violation, along with attorneys’ fees, in civil suits.
Alabama’s Data Breach Notification Act of 2018 applies only to electronic data, includes an encryption safe harbor in the definition of “breach,” and incorporates a risk of harm analysis before notice to individuals is required. “Covered entities” is broadly defined to include government entities.
If the number of affected individuals exceeds 100,000, or the cost exceeds $500,000, substitute notice is allowed and requires a conspicuous notice on the covered entity’s website for 30 days, as well as notice in print and broadcast media where individuals reside. Notice to the attorney general is required if the number of affected individuals exceeds 1,000 and must be made as expeditiously as possible or within 45 days of the covered entity’s determination that a breach has occurred.
The Alabama law also requires that the consumer reporting agencies be notified if the incident affects more than 1,000 individuals at a single time. In addition, third-party agents who experience breaches are required to notify the covered entity within 10 days. The attorney general can seek civil penalties of up to $5,000 per day that covered entities fail to comply with the notice provision, and covered entities may be subject to up to $500,000 per breach under the Alabama Deceptive Trade Practices Act. Finally, government entities are required to comply with the notice provisions of the act, but are not subject to the monetary penalties. Instead, the attorney general must provide a report annually to the governor and the leaders of the House and Senate describing the nature of any reported breaches relating to government entities or their agents.
