More Breach Law Changes: Arizona Updates Notice Law

Arizona's Governor recently signed HB2154, which expands Arizona's data breach notice law. The law was effective upon signing, and now requires companies to notify the state attorney general when more than 1,000 individuals have been impacted. It also allows email notice if the company has the individual's email address.  This removes the need to have email be the "primary method of communication" or be consistent with the eSign Act. Timing of notice has also changed, and must occur within 45 days instead of "in the most expedient time necessary and without unreasonable delay." Notice in Arizona now also needs to include specific information, including the date of the breach, type of information impacted, as well as consumer reporting agencies' and FTC contact information.  In another change, companies do not need to notify under the law if an independent forensic firm or law enforcement determine that there has been no risk of "substantial economic loss."