Data Breach Notification Laws Flashcards

Which US federal agency serves as the primary enforcer of financial institution data breach obligations under the GLBA Safeguards Rule?

Answer: FTC (for non-bank financial institutions)

The FTC enforces the GLBA Safeguards Rule for non-bank financial institutions, while banking regulators enforce it for banks.

Under the 2023 FTC Safeguards Rule amendment, non-banking financial institutions must notify the FTC of breaches affecting how many customers?

Answer: 500 or more customers

The 2023 amendment requires non-banking financial institutions to notify the FTC within 30 days of discovering a breach involving 500 or more customers.

What is the primary criticism of having 50 different state breach notification laws instead of a single federal law?

Answer: Compliance complexity and inconsistent requirements across states

Fifty separate state laws create compliance burdens for organizations operating nationally due to varying definitions, timelines, and requirements.

Which type of information was added to many states' breach notification laws following high-profile biometric data breaches?

Answer: Biometric data (fingerprints, facial recognition)

Following high-profile biometric data breaches, many states expanded breach notification laws to include biometric identifiers as covered personal information.

Under HIPAA's Breach Notification Rule, which standard determines whether an incident is a 'breach' requiring notification?

Answer: Whether the PHI was accessed in an unauthorized manner posing low probability of compromise

HIPAA uses a 'low probability of compromise' standard—if a risk assessment shows low probability that PHI was compromised, it is not a reportable breach.

Which US state law requires notification to the state attorney general before or simultaneously with notifying consumers?

Answer: New York SHIELD Act

New York's SHIELD Act requires businesses to notify the NY Attorney General, the Department of State, and other agencies concurrently with consumer notifications.