October 23, 2020

Volume X, Number 297


October 22, 2020

Subscribe to Latest Legal News and Analysis

October 21, 2020

Subscribe to Latest Legal News and Analysis

October 20, 2020

Subscribe to Latest Legal News and Analysis

Data Breach Notification Laws Now Enacted in All 50 States

South Dakota and Alabama are the last of the 50 states to have enacted breach notification laws, along with Washington, D.C., Guam, Puerto Rico and the Virgin Islands. South Dakota became the 49th state to enact a data breach notification law when Governor Dennis Daugaard signed Senate Bill 62 into law on March 21. It goes into effect on July 1, 2018. On March 28, 2018, Alabama Governor Kay Ivey signed into law Alabama Senate Bill 318, effective May 1, 2018. Below are the parameters of these new data breach notification laws.

South Dakota

The South Dakota law only applies to computerized data and, like many states’ laws, includes an encryption safe harbor in the definition of “breach.” This means that a breach occurs when there is an unauthorized acquisition (versus access) of unencrypted computerized data or encrypted data with the encryption key. As with the majority of other states, the law includes a risk of harm analysis before affected individuals must be notified.

Notice to the South Dakota Attorney General is required if the breach affects more than 250 state residents – joining 24 other state attorneys general that require specific notice of a breach.   Notification to affected state residents must be made within 60 days of the discovery that a breach has occurred, which is longer than most states that establish a specific timeframe. The new law does not create a private right of action, but authorizes the attorney general to both bring criminal prosecutions and seek up to $10,000 per day per violation, along with attorneys’ fees, in civil suits.


Alabama’s Data Breach Notification Act of 2018 applies only to electronic data, includes an encryption safe harbor in the definition of “breach,” and incorporates a risk of harm analysis before notice to individuals is required. “Covered entities” is broadly defined to include government entities.

If the number of affected individuals exceeds 100,000, or the cost exceeds $500,000, substitute notice is allowed and requires a conspicuous notice on the covered entity’s website for 30 days, as well as notice in print and broadcast media where individuals reside. Notice to the attorney general is required if the number of affected individuals exceeds 1,000 and must be made as expeditiously as possible or within 45 days of the covered entity’s determination that a breach has occurred.

The Alabama law also requires that the consumer reporting agencies be notified if the incident affects more than 1,000 individuals at a single time. In addition, third-party agents who experience breaches are required to notify the covered entity within 10 days. The attorney general can seek civil penalties of up to $5,000 per day that covered entities fail to comply with the notice provision, and covered entities may be subject to up to $500,000 per breach under the Alabama Deceptive Trade Practices Act. Finally, government entities are required to comply with the notice provisions of the act, but are not subject to the monetary penalties. Instead, the attorney general must provide a report annually to the governor and the leaders of the House and Senate describing the nature of any reported breaches relating to government entities or their agents.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume VIII, Number 100



About this Author

Katherine Armstrong, Drinker Biddle Law Firm, Washington DC, Data Privacy Attorney

Katherine E. Armstrong is counsel in the firm’s Government & Regulatory Affairs Practice Group where she focuses her practice on data privacy issues, including law enforcement investigations, and research and analysis of big data information practices including data broker issues.

Katherine has more than 30 years of consumer protection experience at the Federal Trade Commission (FTC), where she served in a variety of roles, including most recently as a Senior Attorney in the Division of Privacy and Identity Protection.  In the Division of...