Ohio Enacts Security Breach Notification Law

Effective February 17, 2006, Ohio will join a growing list of states that require notification of individuals whose electronic personal information has been the subject of a security breach. The new security breach notification law (the "Notification Law") applies to Ohio governmental agencies and to individuals and entities that conduct business in Ohio (each a "Covered Entity"). Although the concept of "conducting business" is not clearly defined in the Notification Law, it appears that a physical presence in Ohio is not required. Thus, any entity that does business in Ohio and collects or maintains personal information will be a Covered Entity unless it is expressly exempted from the Notification Law. After the effective date of the Notification Law, a Covered Entity will be required to notify any Ohio resident whose personal information was acquired, or is reasonably believed to have been acquired, through a "breach of the security of a system" of a Covered Entity’s computerized