Who Is Covered?
An “information collector” is a covered person who owns or licenses personal information in any form if the personal information includes personal information on a state resident; A “covered person” is a:
- Person doing business;
- Governmental agency; or
- Person with more than 10 employees. Alaska Stat. § 45.48.090(2)
What Information Is Protected?
“Personal information” means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of an individual’s first name or first initial and last name, and:
- The individual’s social security number;
- The individual’s driver’s license number or state identification card number;
- Except as provided in (4) of this subparagraph, the individual’s account number, credit card number, or debit card number;
- If an account can only be accessed with a personal code, the number in (3) of this subparagraph and the personal code; in this sub-subparagraph, “personal code” means a security code, an access code, a personal identification number, or a password;
- Passwords, personal identification numbers, or other access codes for financial accounts. Alaska Stat. § 45.48.090(7).
What Is A “Breach”?
“Breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector; in this paragraph, “acquisition” includes acquisition by:
- Photocopying, facsimile, or other paper-based method;
- A device, including a computer, that can read, write, or store information that is represented in numerical form; or
- A method not identified by [1] or [2] of this paragraph.
What Triggers Notification?
Discovery or notification of a breach of the security of the information system that contains personal information. Alaska Stat. § 45.48.010(a).
How Is Notice Provided To Individuals?
Timing: Disclosure must be made in the most expeditious time possible and without unreasonable delay, subject to exceptions related to law enforcement or restoring the integrity of the information system. Alaska Stat. § 45.48.010(b).
However, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. Alaska Stat. § 45.48.010(c).
Delivery: An information collector must make the disclosure:
- By a written document sent to the most recent address the information collector has for the state resident;
- By electronic means if the information collector’s primary method of communication with the state resident is by electronic means or if making the disclosure by the electronic means is consistent with the E-Sign Act; or
- If the information collector demonstrates that the cost of providing notice would exceed $150,000, that the affected class of state residents to be notified exceeds 300,000, or that the information collector does not have sufficient contact information to provide notice, by: a) electronic mail if the information collector has an electronic mail address for the state resident; b) conspicuously posting the disclosure on the Internet website of the information collector if the information collector maintains an Internet website; and c) providing a notice to major statewide media. Alaska Stat. § 45.48.030.
Content: None specified.
Is Notice To The Government Required?
No, except as described above to establish there is no reasonable likelihood of harm. Alaska Stat. § 45.48.010(c).
Is Notice To Consumer Reporting Agencies Required?
Yes. If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis and provide the agencies with the timing, distribution, and content of the notices to state residents. This requirement does not apply to an information collector who is subject to the GLBA. Alaska Stat. § 45.48.040(a), (b).
Are There Security Measure Standards?
No.
What Are The Possible Consequences Of A Violation?
An information collector is liable to the state for a civil penalty of up to $500 for each state resident who was not notified, except that the total civil penalty may not exceed $50,000. Alaska Stat. § 45.48.080(b)
Additionally, a violation by an information collector with regard to the personal information of a state resident is an unfair or deceptive act or practice under Alaska Stat. § 45.50.471 – § 45.50.561, allowing for actual economic damages not to exceed $500, whichever is greater, and attorney fees and costs. Alaska Stat. § 45.48.080(b).
Are There Any Exemptions?
No, except as described above regarding notice to CRAs.