Nevada, Washington And North Dakota Expand Data Breach Definition And Notice Requirements

Continuing the trend of states expanding their data privacy laws, companies that store and transmit personal information about residents of Nevada, Washington and North Dakota must now take note of additional data-element definitions and notice requirements following data breach incidents. In Nevada, the expansion of protected personally identifiable information (PII) now includes medical and health information while Washington sets a 45-day limit for notification and North Dakota removes the limitation to only companies that conduct business in the state. In addition, Washington and North Dakota now require notification of the state attorney general in certain instances.

The end result is an increasingly complex array of laws that can leave companies confused as to how to plan and prepare for a potential incident and scrambling to ensure legal compliance if an incident does occur.