South Dakota Becomes the Forty-Ninth State to Enact Data Breach Notification Statue

On March 21, 2018, South Dakota became the forty-ninth state to enact a data breach notification statute, which becomes effective July 1, 2018. California was the first state to enact a data breach law in 2002 and, since then, nearly every state has followed suit. Alabama is now the only state to not have enacted such a law.

2018 South Dakota Senate Bill No. 62 (the “Act”), which can be accessed here, will be added as a new section to SD Codified Laws Chapter 22-40. The following addresses what you need to know about the new law.

Who Must Comply?

Any “information holder” must comply. An “Information holder” is any person or business that conducts business in South Dakota and owns or licenses “personal information” or “protected information” of residents of South Dakota.

What Data Is Covered?

“Personal information” and “protected information” are covered. “Personal information” means a person’s first name or first initial and last name, in combination with any one, or more, of the following data:

social security number;
driver license number or other unique identification number created or collected by a government body;
account, credit card, or debit card number, in combination with any required security code, access code, password, routing number, PIN, or any additional information that would permit access to a person’s financial account;
health information as defined in 45 CFR 160.103; or
an identification number assigned to a person by the person’s employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes.

“Personal information” does not include information that is lawfully made available to the general public from federal, state, or local government records or information that has been redacted, or otherwise made unusable.

“Protected information” includes:

a user name or email address, in combination with a password, security question answer, or other information that permits access to an online account; and
account number or credit or debit card number, in combination with any required security code, access code, or password that permits access to a person’s financial account.

What Constitutes A Data Breach?

A data breach means the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder. It does not include the good faith acquisition of personal or protected information maintained by the information holder for the purposes of the information holder if the personal or protected information is not used or subject to further unauthorized disclosure.

Who Must Be Notified?

Any resident of South Dakota whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person through such breach of security must be notified. “Unauthorized person” means any person not authorized to acquire or disclose personal information, or any person authorized by the information holder to access personal information who has acquired or disclosed the personal information outside the guidelines for access of disclosure established by the information holder.

The Attorney General must be notified by mail or electronic mail of any data breach that exceeds 250 residents of South Dakota.

If the information holder discovers circumstances that require notification, the information holder must also notify, without unreasonable delay, all consumer reporting agencies, as defined under 15 USC § 1681a in effect as of January 1, 2018, and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice.

When Must Notice Be Sent?

A disclosure must be made not later than 60 days from the discovery or notification of the data breach, unless a longer period of time is required due to the legitimate needs of law enforcement.

In What Form And Manner Must Notice Be Sent?

Notification may be provided by one of the following methods:

written notice;
electronic notice, if the electronic notice is consistent with the provisions regarding electronic records and signatures set forth in 15 USC § 7001 in effect as of January 1, 2018, or if the information holder’s primary method of communication with the resident of the state has been by electronic means; or
substitute notice, if the information holder demonstrates that the cost of providing notice would exceed $250,000, that the affected class of persons to be notified exceeds 500,000 persons, or that the information holder does not have sufficient contact information and the notice consists of each of the following:
email notice, if the information holder has an email address for the subject persons
conspicuous posting of the notice on the information holder’s website, if the information holder maintains a website page; and
notification to statewide media.

What Must The Notice Say?

There is no required format. The notice must simply carry out its purpose of disclosing the breach.

Are There Any Exemptions?

An information holder is not required to make a disclosure to an affected person if, following an appropriate investigation and notice to the Attorney General, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder must document the determination in writing and maintain the documentation for not less than 3 years.

Further, a required notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. If the notification is delayed, the notification must be made not later than 30 days after the law enforcement agency determines that notification will not compromise the criminal investigation.

Additionally, if an information holder maintains its own notification procedure as part of an information security policy for the treatment of personal or protected information and the policy is otherwise consistent with the timing requirements of the Act, then the information holder is in compliance with the notification requirements of the Act if the information holder notifies each person in accordance with the information holder's policies.

Any information holder that is regulated by federal law or regulation, including the Health Insurance Portability and Accountability Act of 1996 (PL 104-191, as amended) (“HIPAA”) or the Gramm Leach Bliley Act (15 USC § 6801 et seq., as amended), and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator, is deemed to be in compliance with the Act if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.

Who May Enforce And What Penalties May Be Imposed?

The Attorney General may prosecute each failure to disclose under the provisions of the Act as a deceptive act or practice under SD Codified Law § 37-24-6. In addition to any remedy provided under SD Codified Laws Chapter 37-24, the Attorney General may bring an action to recover on behalf of the state a civil penalty of not more than $10,000 per day per violation. The Attorney General may also recover attorney’s fees and any costs associated with any action brought under the Act.