Security Breach Notification Laws Security breach notification laws have been enacted in most U.S. states since 2002. These laws were enacted in response to an escalating number of breaches of consumer databases containing personally identifiable information. Personal Identifying Information Broad definition of Personal Identifying Information in Information Practices Act (IPA): "any information that is maintained by an agency that identifies or describes an individual," including, but not limited to Name, Social Security number, physical description, home address, home telephone number, education, financial matters, medical or employment history. IPA (Civil Code 1798.3) Agencies must notify customers promptly if certain personal information is "acquired by unauthorized person/persons." Personal info triggering notice: Name plus one of the following: Social Security number, Driver License number/State ID number, Financial account number, medical or health insurance information. The first such law, the Data Security Breach Notification Law, Civil Code 1798.82 and 1798.29, was enacted in 2002 and became effective on July 1, 2003. As related in the bill statement, law requires "a state agency, or a person or business that conducts business in the State, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident whose unencrypted personal informati