House Bill 2154, enacted earlier this year by Gov. Doug Ducey, has significantly expanded Arizona’s current data breach notification law effective Aug. 1, 2018.
Changes include a more expansive definition of “personal information” that was formerly one of the narrowest in the country, according to Ballard Spahr’s Privacy and Data Security Group.
The new definition includes certain data such as:
- information about an individual’s medical or mental health treatment or diagnosis by a healthcare professional;
- a private key, unique to an individual used to authenticate or sign an electronic record;
- an individual health insurance identification number;
- a passport number;
- a taxpayer identification number or an identity protection personal identification number issued by the IRS;
- unique biometric data used for online authentication purposes; or
- an individual’s username or email address, in combination with password or security question and answer, that allows access to an online account.
Previously, “personal information” was identical to many other states’ definition, consisting of the individuals first and last name accompanied by their social security number, driver’s license number, and bank account or credit card number in combination with the necessary security code or password.
Consumers affected by a breach must now be notified within 45-days via written notice, e-mail or telephone if applicable. A notification sent to a victim is required to contain an approximate date, a brief description of the personal information that was breached, toll-free contact numbers and addresses for the three largest consumer reporting agencies in the nation and the necessary contact information of the Federal Trade Commission.
The Attorney General is also able to impose civil penalties for violators of up to a max of $500,000 from a breach or series of related breaches.
Click here to view the document with all amendments to House Bill 2154.
Read the Ballard Spahr article here.
To read more from the Lexology website, click here.