California And Illinois Data Breach Notification Amendments Take Effect

On January 1, 2017, amendments to the data breach notification laws in California and Illinois went into effect. California's amendment requires notification of a security breach when: (i) there is unauthorized acquisition of both encrypted personal information and the encryption key or security credential; and (ii) the business has a reasonable belief that the encryption key or security credential could render such personal information readable or useable. The Illinois amendment expands the definition of "personal information" to include medical and health insurance information, unique biometric information, and a username or email address in combination with a password or security question and answer to access an account. It also clarifies the encryption safe harbor provision, amends the notice requirements, creates requirements to maintain reasonable safeguards to protect information for Illinois residents, and exempts from certain compliance requirements entities