Who Is Covered?
Any person or business that: (a) acquires, owns, or licenses unencrypted computerized data that includes personal information of Arkansas residents; or (b) maintains unencrypted computerized data that includes personal information of Arkansas residents that the person or business does not own. Ark. Code Ann. § 4-110-105(a), (b).
What Information Is Protected?
“Personal information” means an individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements when either the name or the data element is not encrypted or redacted:
- Social security number;
- Driver’s license number or Arkansas identification card number;
- Account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account;
- Medical information; and
- Biometric data.
What Is A “Breach”?
“Breach of the security of the system” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business. Ark. Code Ann. § 4-110-103(1)(A).
What Triggers Notification?
Discovery or notification of a breach of the security of the system involving the unencrypted personal information of an Arkansas resident. Ark. Code Ann. § 4-110-105(a)(1).
However, notification is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers. Ark. Code Ann. § 4-110-105(d).
How Is Notice Provided To Individuals?
Timing: A person or business that acquires, owns, or licenses computerized data that includes personal information must provide disclosure in the most expedient time and manner possible and without unreasonable delay. Ark. Code Ann. § 4-110-105(a)(2).
A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee that there has been a breach of the security of the system immediately following discovery. Ark. Code Ann. § 4-110-105(b)(1).
Delivery: Notice may be provided by one of the following methods:
- Written notice;
- Electronic mail notice if the notice provided is consistent with the provisions of the E-Sign Act;
- Substitute notice under certain circumstances. Ark. Code Ann. § 4-110-105(e).
Content: None specified.
Is Notice To The Government Required?
Yes, if the breach of the security of a system affects the personal information of more than 1,000 individuals. Ark. Code Ann. § 4-110-105(b)(2).
Is Notice To Credit Reporting Agencies Required?
No.
Are There Security Measure Standards?
Yes. A person or business shall take all reasonable steps to destroy or arrange for the destruction of a customer’s records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means. Additionally, it is a requirement to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Ark. Code Ann. § 4-110-104.
What Are The Possible Consequences Of A Violation?
Any violation of this chapter is punishable by action of the Attorney General under the provisions of Arkansas Deceptive Trade Practices Act, Ark. Code Ann. § 4-88-101 et seq., which provides, in part, for restitution and penalties not to exceed $10,000 per violation. Ark. Code Ann. § 4-110-108.
Are There Any Exemptions?
Yes. The provisions of this chapter do not apply to a person or business that is regulated by a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breaches of the security of personal information than that provided by this chapter. Compliance with the state or federal law shall be deemed compliance with this chapter with regard to the subjects covered by this chapter. Ark. Code Ann. § 4-110-106(a)(1), (2).