Who Is Covered?
Any person who conducts business in Delaware and who owns or licenses computerized data that includes personal information. 6 Del. C. § 12B-102(a).
What Information Is Protected?
“Personal information” means a Delaware resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to that individual:
- Social security number.
- Driver’s license number or state or federal identification card number.
- Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account.
- Passport number.
- A username or email address, in combination with a password or security question and answer that would permit access to an online account.
- Medical history, medical treatment by a health-care professional, diagnosis of mental or physical condition by a health care professional, or deoxyribonucleic acid profile.
- Health insurance policy number, subscriber identification number, or any other unique identifier used by a health insurer to identify the person.
- Unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes.
- An individual taxpayer identification number. 6 Del. C. § 12B-101(7).
What Is A “Breach”?
“Breach of security” means:
- The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. Good faith acquisition of personal information by an employee or agent of any person for the purposes of such person is not a breach of security, provided that the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure.
- The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information is not a breach of security to the extent that personal information contained therein is encrypted, unless such unauthorized acquisition includes, or is reasonably believed to include, the encryption key and the person that owns or licenses the encrypted information has a reasonable belief that the encryption key could render that personal information readable or useable. 6 Del. C. § 12B-101(1).
What Triggers Notification?
The determination of a breach of security involving the personal information of a resident of Delaware. “Determination of the breach of security” means the point in time at which a person who owns, licenses, or maintains computerized data has sufficient evidence to conclude that a breach of security of such computerized data has taken place. 6 Del. C. §§ 12B-102(a); 12B-101(2).
Likelihood of Harm Analysis: Notice is not required if, after an appropriate investigation, it is reasonably determined that a breach of security is unlikely to result in harm to any individuals whose personal information has been breached. 6 Del. C. § 12B-102(a).
How Is Notice Provided To Individuals?
Timing: Notice must be made without unreasonable delay but not later than 60 days after determination of the breach of security, subject to certain exceptions. 6 Del. C. § 12B-102(c).
Delivery: Notice may be made by:
- Written notice;
- Telephonic notice;
- Electronic notice if consistent with the E-Sign Act;
- Substitute notice, in certain circumstances. 6 Del. C. § 12B-101(5).
Content: None specified unless the breach includes a social security number, in which case the person shall offer to each resident, whose personal information, including social security number, was breached or is reasonably believed to have been breached, credit monitoring services at no cost to such resident for a period of one year. Such person shall provide all information necessary for such resident to enroll in such services and shall include information on how such resident can place a credit freeze on such resident’s credit file. 6 Del. C. § 12B-102(e).
Is Notice To The Government Required?
The Attorney General must be notified if the number of affected residents exceeds 500. 6 Del. C. § 12B-102(d).
Is Notice To Credit Reporting Agencies Required?
No.
Are There Security Measure Standards?
Yes. Any person who conducts business in Delaware and owns, licenses, or maintains personal information shall implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information collected or maintained in the regular course of business. 6 Del. C. § 12B-100.
What Are The Possible Consequences Of A Violation?
The Attorney General may bring an action in law or equity to address the violations of this chapter and for other relief that may be appropriate to ensure proper compliance with this chapter or to recover direct economic damages resulting from a violation, or both. 6 Del. C. § 12B-104.
Are There Any Exemptions/Exceptions?
A person that maintains its own notice procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of this chapter is deemed to be in compliance with the notice requirements of this chapter if the person notifies affected Delaware residents in accordance with its policies in the event of a breach of security. 6 Del. C. § 12B-103(a).
Additionally, a person that is regulated by state or federal law, including HIPAA and GLBA ,and that maintains procedures for a breach of security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this chapter if the person notifies affected Delaware residents in accordance with the maintained procedures when a breach of security occurs. 6 Del. C. § 12B-103(b).