Louisiana Adds Data Security Requirements To Breach Notice Law

Louisiana's breach notice law has been amended to require companies to protect personal information. The definition of personal information matches that which -if breached- would give rise to a duty to notify. This includes name combined with social security numbers, drivers' license (and state ID/passport numbers) or financial account numbers. The law applies to companies that "maintain computerized information" and require that entities (1) have reasonable security procedures and practices "appropriate to the nature of the information" that protects against unauthorized access, destruction, use, modification and disclosure and (2) destroy personal information or make it unreadable when it is no longer needed by "shredding, erasing" or making the information otherwise unreadable.  Louisiana joins a growing list of states that have such data protection requirements, including California, Connecticut, Delaware, Florida, Massachusetts, Nevada, and New Jersey to name but