Part 1: Research State Data Security Breach Notification Laws

Note: If reading statutory law text makes your eyes hurt, you are not alone. Laws and regulatory texts are known to be challenging to read and understand. Typically, the texts are very structured and organized and laid out logically in nested divisions. The increasingly narrow divisions start from the top as titles, chapters, parts, and sections and go down to paragraphs and clauses. Each of those divisions can be broken into subdivisions, for example, a paragraph of three subparagraphs, with one subparagraph containing 10 clauses. Laws are broken down this way on purpose, to provide the reader with increasingly clear definitions of a narrow topic. You should also be aware that, sometimes, important definitions for one law are included in the text for another law. The best approach to reading statutory law is to start at the top of a law and keep reading.

1. In your browser, navigate to https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.

Note: The National Conference of State Legislatures (NCSL) website tracks and organizes telecommunication and information technology state legislation. The NCSL is a reliable resource from which to research the laws affecting all 50 states and U.S. territories.

1. Scroll down to the list of states and select a state to review. You may pick the state in which you live or any other state that interests you.

2. Read the state data security breach notification law that you chose.

3. Download the data security breach notification law for the state that you chose.

Part 2: Analyze State Data Security Breach Notification Laws (0/5 completed)

Note: In this part of the lab, you will analyze the data security breach notification law for the state that you chose by answering a series of questions. When working with complex texts such as statutory laws, putting key elements of the law into your own words is an excellent way to increase your comprehension.

1. What personal information/data does the law cover?

2. What activities constitute a data or security breach?

3. How fast must an entity give notice to affected individuals following a data breach?

4. Can notification to affected individuals be delayed at the request of law enforcement?

5. Can entities avoid giving notification to affected individuals if the data that was breached was encrypted?

Challenge Exercise (0/6 completed)

Note: The following exercise is provided to allow independent, unguided worksimilar to what you will encounter in a real situation.

Select another state data breach notification law in addition to the law that you already reviewed in the Guided Exercises. Compare and contrast the two state laws by answering the following questions.

1. What personal information/data does the second law cover?

2. Under the second law, what activities constitute a data or security breach?

3. Under the second law, how fast must an entity give notice to affected individuals following a data breach?

4. Under the second law, can notification to affected individuals be delayed at the request of law enforcement?

5. Under the second law, can entities avoid giving notification to affected individuals if the data that was breached was encrypted?

6. Which law do you think provides an affected individual with more protection in the event of a data security breach? Why?