South Dakota Notice of Breach
SD Codified Laws § 22-40-19 - § 22-40-26
SUMMARY:
EFFECTIVE. July 1, 2018
WHO DOES THIS LAW APPLY TO.
WHAT IS A BREACH. A breach is an unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder. The term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the information holder if the personal or protected information is not used or subject to further unauthorized disclosure
WHAT IS PERSONAL INFORMATION. A person's first name or first initial and last name, in combination with any one or more of the following data elements:
-
Social security number.
-
Driver license number or other unique identification number created or collected by a government body.
-
Account, credit card, or debit card number, in combination with any required security code, access code, password, routing number, PIN, or any additional information that would permit access to a person's financial account.
-
Health information as defined in 45 CFR 160.103.
-
Identification number assigned by the person's employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes.
-
A username or email address, in combination with a password, security question answer, or other information that permits access to an online account.
Personal information does not include information that is lawfully made available to the public from federal, state, or local government records or information that has been redacted, or otherwise made unusable.
WHO TO NOTIFY OF THE BREACH. Notice to residents shall be made following the discovery by or notification to an information holder of a breach of system security whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person, but not later than sixty days from the discovery or notification of the breach of system security. If notice is to be sent to more than 250 residents, then notice must be sent to the attorney general by mail or electronic mail.
Information holder shall also notify, without unreasonable delay, all consumer reporting agencies, as defined under 15 U.S.C. § 1681a in effect as of January 1, 2018, and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice.
EXCEPTION. This Section does not apply to the following:
-
An information holder is not required to make a disclosure under this section if, following an appropriate investigation and notice to the attorney general, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder shall document the determination under this section in writing and maintain the documentation for not less than three years.
-
Does not apply to information that is encrypted or otherwise rendered unusable, unreadable, or indecipherable, as long as the encryption key is not acquired, or in accordance with the Federal Information Processing Standard 140-2.
-
An information holder maintains its own notification procedure as part of an information security policy for the treatment of personal or protected information and the policy is otherwise consistent with the timing requirements of this section, the information holder is in compliance with the notification requirements if the information holder notifies each person in accordance with the information holder's policies in the event of a breach of system security.
-
Any information holder that is regulated by federal law or regulation, including the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, as amended) or the Gramm Leach Bliley Act (15 U.S.C. § 6801 et seq., as amended) and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator is deemed to be in compliance with this chapter if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.
WHEN TO NOTIFY OF THE BREACH. Following the discovery by or notification to an information holder of a breach of system security an information holder shall disclose the breach of system security to any resident of this state whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person, but not later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement. If the notification is delayed due to law enforcement, then the notification shall be made not later than thirty days after the law enforcement agency determines that notification will not compromise the criminal investigation.
HOW TO NOTIFY OF THE BREACH. Notice may be provided by one of the following methods:
-
Written notice.
-
Electronic notice (if it is the primary means of communication or notice is consistent with the provisions regarding electronic records and signatures in 15 U.S.C. § 7001).
-
Substitute notice as provided below.
SUBSTITUTE NOTICE AVAILABLE. Substitute notice, if the information holder demonstrates that the cost of providing notice would exceed $250,000, that the affected class of persons to be notified exceeds 500,000 persons, or that the information holder does not have sufficient contact information. The notice consists of each of the following:
-
Email notice if the information holder has an email address for the subject persons.
-
Conspicuous posting of the notice on the information holder's website if the information holder maintains a website page.
-
Notification to statewide media.
NOTICE TO THIRD-PARTIES. Statute does not have third-party notice requirements.
CONSEQUENCES FOR FAILING TO NOTIFY. The attorney general may prosecute each failure to disclose, inclusive, as a deceptive act or practice. In addition to any remedy provided by the statute, the attorney general may bring an action to recover on behalf of the state a civil penalty of not more than $10,000 per day per violation. The attorney general may recover attorney's fees and any costs associated with any action brought under this section.
PRIVATE RIGHT OF ACTION. None provided in the statute.
REQUIREMENTS OF REASONABLE SECURITY MEASURES.
DATA DISPOSAL PROVISIONS. None.
LEGISLATIVE UPDATES.
S.B. 62 – signed into law on 3/12/2018, Effective 7/1/2018.
For more information, see here: https://sdlegislature.gov/Statutes/Codified_Laws/2047710
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.