Eight States Enact Or Amend Data Breach Notification Laws

Since June 1, several states have enacted or amended their data breach notification laws:

• On June 1, Alabama's new data breach notification law became effective. The law governs data breach notification requirements for entities acquiring or using sensitive personally identifying information of an Alabama resident. The bill requires notification to affected customers in the event of a breach within 45 days of the entity determining that a breach occurred. The law also provides that covered entities and their agents must implement and maintain reasonable security measures to protect sensitive personally identifying information.
• On June 2, amendments to Oregon's data breach notification law became effective. The amendment requires that an entity provide notification of a breach of security not later than 45 days after discovery. If the entity offers to provide credit monitoring services in connection with the notification, it may not condition the provision of