Is The 5th Time The Charm? – Nationalizing Data Breach Notification

Once the smoke and dust clears from the latest enormous data breach, the fried servers are hauled away and the ritual IT department purge takes place, the focus seems to turn to the lack of any comprehensive national data breach law. Although certain sector specific breach notification laws are in place, such as HIPAA/HITECH in the health information realm, most businesses in the U.S. remain subject to a jigsaw puzzle of 46 different state laws.

At present, only Alabama, Kentucky, New Mexico and South Dakota lack a notification law. And even New Mexico and Kentucky are considering dipping their toes in these waters, albeit more reluctantly on the part of Kentucky (since its law would only cover state agencies, not businesses). This thicket of state laws is a huge ordeal for businesses, since the notification triggers, timing and notice content requirements can vary widely.