On March 26, 2020 Washington D.C significantly amended its Data Breach Notification Law (D.C. Act 23-268), to expand the definition of personal information and require businesses obtaining such information to implement “reasonable security safeguards”. The new law took effect on May 19, 2020 in the midst of dramatic societal change. Indeed, COVID-19 has accelerated the digital transition and hastened the need for security and privacy issues to be at the forefront of state legislature. So, what are the major changes and updates under the D.C Act 23-268?
A broader definition of personal information
The definition of personal information has been significantly expanded and includes several new elements. Previously, the law only considered personal information to be a person’s first name (or initial) and surname and sensitive identifying numbers i.e. social security number, driver’s license number, D.C identification card number or credit card number. Personal information also included a combination of a person’s name and any codes that would enable access to a person’s individual financial or credit account. The current update expands the definition of what is classified as personal information to the following:
Unique identification numbers: passport number, taxpayer identification number or any other identification number issued on a government document.
Medical Information: DNA profile or genetic, biometric or health insurance information.
Financial information: Account number or any numbers or codes allowing access to an individual’s financial or credit account.
Other data: Any listed data that would allow an individual to carry out identity theft. The new legal definition also includes any username or email address combined with any information allowing access to another’s personal account.
Mandatory Breach Notification
D.C Attorney General Notification Notices:
The law previously only required the D.C Attorney General to be notified if over 1,000 residents were affected by a data security breach. It now requires the D.C Attorney General to be notified when a qualifying data breach affects 50 D.C residents or more. The notice must include the nature and cause of the data breach, the number of affected residents, types of personal information compromised and corrective steps that have been taken.
Individual Breach Notification Notices:
Affected residents must also be notified ‘’in the most expedient manner possible, without unreasonable delay’’. New content requirements for individual breach notification notices include the types of data compromised and toll-free numbers for credit reporting agencies and the D.C Attorney General.
Business and Service Provider Security Requirements
Businesses and service providers are now subject to more stringent security protection requirements. Any organization handling D.C residents’ personal information must “implement and maintain reasonable security safeguards”. The amended law also stipulates that any entity using a third-party service provider must have a written agreement in place requiring the latter to “implement and maintain reasonable security safeguards”.
Failure to comply with the new legal requirement to implement and ensure “reasonable security safeguards’’, could result in significant economic and reputational loss.
To assist you in identifying the extent to which your organization is at risk of a data breach, we are offering a FREE Organization Assessment to assess your company’s specific vulnerabilities and risk exposure to cyber crime. This will ensure you have the best possible insight and protection as you guide your company into the digital future.