Montana, Wyoming, North Dakota, and Washington all recently passed laws amending various aspects of their respective data breach notification laws. On February 27, Montana altered its data breach statute to require breach notification to the Montana attorney general. The change also broadens the definition of "personal information" to include medical record information, taxpayer identification numbers, and identity protection personal identification numbers. On March 2, Wyoming amended its data breach statute to require owners or licensors of personal information to provide "clear and conspicuous" notice of a data breach to consumers and to expand the definition of "personally identifying information" to include unique biometric data or individual taxpayer identification numbers. On April 13, the North Dakota governor signed into law an amendment stating that any individual or business that owns or licenses computerized personal information must disclose a breach of its security system to the North Dakota attorney general if more than 250 individuals are affected. On April 23, Washington's governor signed into law several amendments to Washington's data breach notification law, including mandatory notification to the state attorney general when 500 residents are affected, a 45-day deadline for notification, updated content requirements for notifications, and a safe harbor for personal information that is adequately secured.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
