Data Breach Notification Laws Flashcards

Which type of data is most commonly excluded from triggering state breach notification requirements?

Answer: Encrypted data where the key was not compromised

Most state breach notification laws include a safe harbor for encrypted data when the encryption key was not also compromised in the breach.

What is the primary purpose of a 'risk of harm' threshold in breach notification laws?

Answer: To require notification only when there is meaningful risk of harm to individuals

Risk of harm thresholds help ensure notification obligations are triggered only when the breach poses meaningful risk to individuals, reducing unnecessary notifications.

Under FTC authority, breach notification for certain health apps is governed by what rule?

Answer: Health Breach Notification Rule

The FTC's Health Breach Notification Rule covers vendors of personal health records and related entities not covered by HIPAA.

Which notification recipient is often required when a breach affects 500 or more residents of a single state?

Answer: Prominent media outlets in that state

HIPAA requires notifying prominent media outlets serving a state or jurisdiction when a breach affects 500 or more residents of that state.

What does the term 'personal information' most commonly refer to in US state breach notification laws?

Answer: Name combined with SSN, financial account, or medical information

Most state laws define personal information as an individual's name combined with sensitive identifiers like SSN, financial account numbers, or medical data.

Which best describes a 'substitute notice' under state breach notification laws?

Answer: Notice via website posting and statewide media when direct contact is too costly

Substitute notice is permitted when direct notification is too costly or contact information is insufficient, typically involving website posting and statewide media.