1E9Ct5D

E. Data Breach Notification Statutes.Kentucky recently became the 47th state to enact a data breach notification lawconcerning government and/or consumer notification when there is a data breachinvolving personal information, which generally includes information such as namescoupled with social security numbers, birth dates, and financial information. 42The hodgepodge landscape of state notification laws is confusing and inconsistent. 43This past year, Florida adopted expansive changes to its breach notification law with theFlorida Information Protection Act of 2014 (“FIPA”). Among other things, the law,effective July 1, 2014, imposed a 30-day requirement to notify individuals of a breach,which is one of the quickest timelines in the country. 44If a breach will not likely result inidentity theft or financial harm to affected individuals, no notification is required.However, that determination must be documented in writing, kept for five years, andsubmitted to the attorney general in thirty days. If the breach affects five hundredindividuals or more in Florida, FIPA also requires notification to the State Department ofLegal Affairs of the attorney general.In many states, encryption and/or redaction will limit state law statutory exposure andavoid notification requirements altogether. For instance, S.C. Code Ann. § 39-1-90requires that in certain circumstances an entity suffering a data breach involving42 The states without a data breach notification law are Alabama, New Mexico, and South Dakota.43 Security Breach Notification Laws (last update October 2013),www.beazley.com/our_business/professional_liability/tmb/data_breach_map.html (Interactive Map ofState data breach statutory requirements) (last visited Jan. 13, 2015).44 Fla. Stat. § 501.171.March 6, 2015 24 © 3-6-2015 ALFA International Business Litigation P.G.