Two Cyber Laws Go Into Effect Over Us Labor Day Weekend

On September 1, the Colorado breach notification statute update became effective, the first of two developments that occurred over the weekend. As we wrote about when the modification was passed, Colorado's updated statute expands the definition of "personal information" to include ID numbers, medical information, and biometric information and places a proactive obligation on companies to investigate potential breaches. If notification is required, it will now have to be provided within 30 days of the company determining that the breach has occurred, and Colorado now joins many other states in having content requirements for breach notices. In addition to the data breach notification changes, the law also creates a requirement to "reasonably" protect personal information.