State Of The (State) Data Breach Laws: 2017 Legislative Update, Part I

With the summer winding down and children already heading back to school, most state legislators have already said "sine die" to the 2017 legislative session. And like in legislative sessions over the past few years, data security and data breach notification continued to occupy the legislative calendars of state houses across the country in 2017. During the past session, a myriad of bills affecting breach notification requirements were proposed in numerous state legislatures. While most did not become law, several states made important changes to their data breach notification statutes: for instance, Delaware and Maryland substantially redefined what "personal information" is under their respective statutes (among other important changes), while New Mexico passed its first-ever data breach notification statute, leaving Alabama and South Dakota as the only states without such laws on their books.