46 states (including California) have enacted laws requiring those who maintain personal information of others to protect that information and to notify the owners of that information of any security breaches. These laws and related regulations usually include an account-holder notification requirement when security breaches occur.
The laws require persons who “own or license” such certain specified personal information to meet minimum standards to safeguard the info. Any firm would “own or license” personal information it stores or maintains in connection both with its clients and its employees.
The “personal information” to which these statutes apply is generally limited to government identification numbers such as social security numbers and financial account information, but don’t take chances. Information such as home addresses and phone numbers, and a wide variety of other information, may be entitled to protection as well, under various “expectation of privacy” laws and regulations.
In the event of a security breach, those individuals whose personal information has been breached must be notified as soon without delay. The notice should include any specific use made of the data, the approximate date of the security breach, and any steps that the owner/licensee of the information has taken or plans to take relating to the incident. The notification requirement also includes informing the applicable state government, typically the attorney general’s office, of these same facts.
The details of what kind of security program is required, which is appropriate to the size, scope and type of business, the amount of data stored, the need for security and confidentiality and the amount of resources available to such business, is beyond the scope of this brief article. Information and assistance is available to our clients if you contact us and identify your particular concerns or general needs.
The information presented is not intended to be, and does not constitute, “legal advice.” Because each situation varies, and only brief summary information is provided here, you should not use this information as a basis for action unless you have independently verified with your own counsel that it applies to your particular situation.