Client Alerts & Newsletters

To Notify, or not to Notify? Trend Towards Security Breach Notification Laws Continues

December 1, 2005

Since our last update in September of this year, four additional states have enacted security breach notification laws and similar laws are still pending in several states. New York, New Jersey, North Carolina and Ohio have all joined the fray, increasing the pressure on the federal government to pass a uniform federal security breach notification law. 

Each of the recently enacted laws, like the California law, generally require entities to promptly notify the residents of that state if the security, confidentiality or integrity of their personal information (defined similarly by most states with some notable exceptions) has been compromised.

The new state security laws don't just require notification of breaches after the fact. Some states require businesses to take measures now to prevent the occurrence of breaches. Depending on where your corporation does business, you could now be required by state law to:

  • Implement and maintain security procedures and practices to protect personal information.
  • Adopt measures to ensure transfers of personal information to third parties are subject to contractual safeguards.
  • Review existing document destruction policies to ensure appropriate methods for the destruction of personal information.
  • Utilize encryption to ensure the safe transfer of personal information to third parties.

The best way to avoid disclosure under the new laws is to avoid the breach in the first place. Therefore, we recommend that corporations adopt procedures for handling the security of personal information generally, and prepare a response plan which includes an established method for notifying individuals when and if their personal information is compromised. Furthermore, most states will accept an existing information security policy if it contains notification provisions that meet the timing requirements of the new laws. If you already have an information security policy, you may wish to review it to ensure it comports with new applicable state law.

For more information, please contact the professional(s) listed below, or your regular Crowell & Moring contact.

Kris D. Meade
Partner – Washington, D.C.
Phone: +1.202.624.2854

Crowell & Moring LLP is an international law firm with offices in the United States, Europe, MENA, and Asia that represents clients in litigation and arbitration, regulatory and policy, and transactional and corporate matters. The firm is internationally recognized for its representation of Fortune 500 companies in high-stakes litigation and government-facing matters, as well as its ongoing commitment to pro bono service and diversity, equity, and inclusion.

View Desktop Site | Mobile Sitemap |

Contact | Subscribe | Terms of Use | Privacy Statement | Alumni

© Crowell & Moring LLP 2023
Attorney advertising - prior results do not guarantee a similar outcome.