Who Is Covered?
Any person who conducts business in this state and who, in the ordinary course of the person’s business functions, owns, licenses or maintains personal information of any resident of this state. Miss. Code Ann. § 75-24-29(1).
What Information Is Protected?
“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements:
- Social security number;
- Driver’s license number or state identification card number; or
- An account number or credit or debit card number in combination with any required security code, access code or password that would permit access to an individual’s financial account. Miss. Code Ann. § 75-24-29(2)(b).
What Is A “Breach”?
“Breach of security” means unauthorized acquisition of electronic files, media, databases or computerized data containing personal information of any resident of this state when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. Miss. Code Ann. § 75-24-29(2)(a).
What Triggers Notification?
Knowledge of a breach of security. Miss. Code Ann. § 75-24-29(3).
Likelihood of Harm Standard: Notification shall not be required if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the affected individuals. Miss. Code Ann. § 75-24-29(3).
How Is Notice Provided To Individuals?
Timing: The disclosure shall be made without unreasonable delay, subject to [criminal investigations] and the completion of an investigation by the person to determine the nature and scope of the incident, to identify the affected individuals, or to restore the reasonable integrity of the data system. Miss. Code Ann. § 75-24-29(3).
Delivery: Notice may be by:
- Written notice;
- Telephone notice;
- Electronic notice, if the person’s primary means of communication with the affected individuals is by electronic means or if the notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C 7001; or
- Substitute notice, provided the person demonstrates that the cost of providing notice in accordance with paragraphs 1, 2 or 3 above of this subsection would exceed $5,000, that the affected class of subject persons to be notified exceeds 5,000 individuals or the person does not have sufficient contact information. Miss. Code Ann. § 75-24-29(6).
Content: None specified.
Is Notice To The Government Required?
No.
Is Notice To Credit Reporting Agencies Required?
No.
Are There Security Measure Standards?
No.
What Are The Possible Consequences Of A Violation?
Failure to comply with the requirements of this section shall constitute an unfair trade practice and shall be enforced by the Attorney General; however, nothing in this section may be construed to create a private right of action. Miss. Code Ann. § 75-24-29(8).
Are There Any Exemptions/Exceptions?
Any person who conducts business in this state that maintains its own security breach procedures as part of an information security policy for the treatment of personal information, and otherwise complies with the timing requirements of this section, shall be deemed to be in compliance with the security breach notification requirements of this section if the person notifies affected individuals in accordance with the person’s policies in the event of a breach of security. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or federal functional regulator, as defined in 15 U.S.C. 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided the person notifies affected individuals in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or federal functional regulator in the event of a breach of security of the system. Miss. Code Ann. § 75-24-29(7).