1E9Ct5D

“personal identifying data” (e.g., social security numbers, driver’s license numbers, bankaccount numbers, credit card numbers, checking account numbers, dates of birth) ofSouth Carolinians notify the persons whose data has been compromised. In the case ofunintentional data breach, notification must occur quickly: “[t]he disclosure must bemade in the most expedient time possible without unreasonable delay….” 45In the caseof theft, notification must occur “immediately.” 46However, if the data was “renderedunusable through encryption, redaction, or other methods,” no notification is required. 47F. Other Obligations and Exposure.Following a data breach, a company should consider what liability it may have underfederal law, applicable state unfair business practice laws, privacy laws, e-transactionlaws, general security laws and regulations, sector-specific regulations, 48 industry selfregulation,and common law. Relatedly, a company should look at its own policies todetermine whether it acted consistently with any self-imposed obligations.45 S.C. Code Ann. § 39-1-90(A).46 Id at (B).47 Id.48 See, e.g., The Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191, 110 Stat.1936) (“HIPPA”) and The Health Information Technology for Economic and Clinical Health Act(“HITECH Act), enacted under Title XIII of the American Recovery and Reinvestment Act of 2009 (Pub.L. 111-5).March 6, 2015 25 © 3-6-2015 ALFA International Business Litigation P.G.