Who Is Covered?

“Information holder,” any person or business that conducts business in this state, and that owns or licenses computerized personal or protected information of residents of this state; S.D. Codified Laws § 22-40-19(3).

What Information Is Protected?

“Personal information” is a person’s first name or first initial and last name, in combination with any one or more of the following data elements:

1. Social security number;
2. Driver license number or other unique identification number created or collected by a government body;
3. Account, credit card, or debit card number, in combination with any required security code, access code, password, routing number, PIN, or any additional information that would permit access to a person’s financial account;
4. Health information as defined in 45 CFR 160.103; or
5. An identification number assigned to a person by the person’s employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes. S.D. Codified Laws § 22-40-19(4).

“Protected information” includes:

1. A user name or email address, in combination with a password, security question answer, or other information that permits access to an online account; and
2. Account number or credit or debit card number, in combination with any required security code, access code, or password that permits access to a person’s financial account. S.D. Codified Laws § 22-40-19(5).

What Is A “Breach”?

“Breach of system security,” the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder. The term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the information holder if the personal or protected information is not used or subject to further unauthorized disclosure S.D. Codified Laws § 22-40-19(1).

What Triggers Notification?

Discovery by or notification to an information holder of a breach of system security where personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person. S.D. Codified Laws § 22-40-20.

An information holder is not required to make a disclosure under this section if, following an appropriate investigation and notice to the attorney general, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder shall document the determination under this section in writing and maintain the documentation for not less than three years. S.D. Codified Laws § 22-40-20.

How Is Notice Provided To Individuals?

Timing: The disclosure must be made not later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement. S.D. Codified Laws § 22-40-20.

Delivery: The disclosure may be provided by:

1. Written notice;
2. Electronic notice, if the electronic notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. Section 7001 in effect as of January 1, 2018, or if the information holder’s primary method of communication with the resident of this state has been by electronic means; or
3. Substitute notice, if the information holder demonstrates that the cost of providing notice would exceed 250,000, that the affected class of persons to be notified exceeds five hundred thousand persons, or that the information holder does not have sufficient contact information and the notice consists of each of the following: (a) Email notice, if the information holder has an email address for the subject persons; (b) Conspicuous posting of the notice on the information holder’s website, if the information holder maintains a website page; and (c) Notification to statewide media. S.D. Codified Laws § 22-40-22.

Content: None specified.

Is Notice To The Government Required?

Yes. Any information holder that experiences a breach of system security under this section shall disclose to the attorney general by mail or electronic mail any breach of system security that exceeds 250 residents of this state. S.D. Codified Laws § 22-40-20.

Is Notice To Credit Reporting Agencies Required?

Yes. If an information holder discovers circumstances that require notification, the information holder shall also notify, without unreasonable delay, all consumer reporting agencies and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice. S.D. Codified Laws § 22-40-24.

Are There Security Measure Standards?

No.

What Are The Possible Consequences Of A Violation?

The attorney general may prosecute each failure to disclose under the provisions of this Act as a deceptive act or practice under Section 37-24-6. In addition to any remedy provided under chapter 37-24, the attorney general may bring an action to recover on behalf of the state a civil penalty of not more than $10,000 per day per violation. The attorney general may recover attorney’s fees and any costs associated with any action brought under this section. S.D. Codified Laws § 22-40-25.

Are There Any Exemptions/Exceptions?

Notwithstanding any other provisions in this Act, any information holder that is regulated by federal law or regulation, including the Health Insurance Portability and Accountability Act or the Gramm Leach Bliley Act and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator is deemed to be in compliance with this chapter if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation. S.D. Codified Laws § 22-40-26.