State Breach Notification Laws: When a Dark Force Prevails
With 2024 National Cybersecurity Awareness Month (NCSAM) now in the books, it appears NCSAM is continuing gain more traction on the 20th Anniversary of its 2004 creation. Formed in the U.S., concept has become an international initiative observed on a global scale since October was designated as European Cybersecurity Month in 2012.
Perhaps the most important outcome of this increased focus is that executive leaders understand that cyber threats are a fundamental business risk and not simply ‘an IT issue’. A true understanding that “If there is a catastrophic cyberattack, the damage will likely reach higher on the organizational chart than the CIO and CISO.”
Specifically for the higher education sector, there are multiple outlets beyond just the campus IT department reinforcing safe computing practices, spotlighting the perils of cyber threats.
This increased visibility has been a long time coming and is long overdue.
Consider the Melissa Virus, which led to the FBI creating a ‘Cyber Division’, occurred in 1999. It has taken a quarter century to transform what was once a quiet little cybersecurity cottage industry into a computing behemoth.
But history tells us even the most prestigious academic institutions cannot prevent all cyberattacks and that some of these attacks produce catastrophic impacts. All the spending for the software, the hiring, and the training has not come close to defeating the ominous reality still staring at the industry.
Sometimes, dark forces simply ‘win’.
Among the countless attempts to use public policy as a weapon against these forces, perhaps it is time for state data breach notification laws to receive added focus. While federal rules and laws like GLBA, FERPA and HIIPPA are more universally known, compliance with state laws is a critical part of data breach incident response and understanding the laws prior to an incident is vital.
California became the first state with a notification law that took effect in 2003 before NCSAM even existed. The other 49 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have each followed suit by enacting laws during the ensuing years.
Not surprisingly, these laws tend to change as cyberthreats evolve and massive cyberattacks catch the public’s attention. The potential identity theft and exposure of personal, confidential information for millions of constituents builds demand for action from elected officials.
One example is the Commonwealth of Pennsylvania, which made important changes in both 2023 and 2024. The most high-profile change is that an entity that has a breach involving certain data elements impacting more than 500 state residents must inform the state’s Attorney General’s Office and notify consumer reporting agencies.
Intermittent changes like these are a complicating factor because the rules are often not static and might not be the same as they were the last time an institution fell victim to a breach. Furthermore, the laws – while generally similar – are a patchwork across the country and have important differences in some cases.
Based on a small, informal sample of state laws, a general key is that an individual’s last name – if combined with first name and/or middle initial - is a trigger point to examine what other data items were compromised in the event of a breach. Some states have exceptions where the law can be triggered even without the name under certain conditions.
The breach of data in three key areas - social security numbers, driver’s license numbers and/or fiscal information – appear to be universally accepted as being part of personal information, especially when paired with name. But definitions are broader in some laws. Dates of birth, student Id numbers, health insurance policy numbers, passport Id numbers, and biometric data are just some examples of what is included based on state.
The amount of time permitted to provide breach notifications, the number of breached records needed to trigger certain steps, and the penalties for non-compliance are also state-specific. Even the names of the laws differ by state.
Fortunately, there are many websites that can assist in the learning process. Among the comprehensive options is The National Conference of State Legislatures, which provides links to many state laws via its Security Breach Notification Laws webpage (https://www.ncsl.org/technology-and-communication/security-breach-notification-laws).
There are also numerous comprehensive commercial websites – such as those created by law firms or other entities that track public policy – where state laws can quickly be compared for informational purposes. However, a best practice is to review state-specific deep dive websites that offer nuances and even advice on how to apply a state’s law.
Bill Balint is the owner of Haven Hill Services LLC, contracted as the Advisory CIO for Education at Trivigil.
