State Of The (State) Data Breach Laws: 2017 Legislative Update, Part II

As we noted in Part I of our series, state legislatures across the country continued to refine and reshape their respective data breach notification requirements during the 2017 legislative session. While a handful of states were successful in passing new data breach notification legislation, some of those states significantly revised just when, how, and under what circumstances an entity has to notify affected consumers of a data breach. For instance, Maryland amended its Personal Information Protection Act to require consumer notification to be made within 45 days of an entity concluding that residents' personal information was affected by a breach, while Tennessee passed a bill to restore the encryption safe harbor to its breach notification statute, a provision that was arguably eliminated from its statute in 2016.