Who Is Covered?
Any person that owns or licenses computerized data that includes personal information. N.D. Cent. Code § 51-30-02.
What Information Is Protected?
“Personal information” means an individual’s first name or first initial and last name in combination with any of the following data elements, when the name and the data elements are not encrypted:
- The individual’s social security number;
- The operator’s license number assigned to an individual by the department of transportation under section 39-06-14;
- A nondriver color photo identification card number assigned to the individual by the department of transportation under section 39-06-03.1;
- The individual’s financial institution account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial accounts;
- The individual’s date of birth;
- The maiden name of the individual’s mother;
- Medical information;
- Health insurance information;
- An identification number assigned to the individual by the individual’s employer in combination with any required security code, access code, or password; or
- The individual’s digitized or other electronic signature. N.D. Cent. Code § 51-30-01(4)(a).
What Is A “Breach”?
“Breach of the security system” means unauthorized acquisition of computerized data when access to personal information has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable. N.D. Cent. Code § 51-30-01(1).
What Triggers Notification?
Discovery or notification of the breach in the security of the data involving the unencrypted personal information of any North Dakota resident that was, or is reasonably believed to have been, acquired by an unauthorized person. N.D. Cent. Code § 51-30-02.
How Is Notice Provided To Individuals?
Timing: The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and to restore the integrity of the data system. N.D. Cent. Code § 51-30-02.
Delivery: Notice may be by:
- Written notice;
- Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in section 7001 of title 15 of the United States Code; or
- Substitute notice, if the person demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars, or that the affected class of subject persons to be notified exceeds five hundred thousand, or the person does not have sufficient contact information. Substitute notice consists of the following: a. Electronic mail notice when the person has an electronic mail address for the subject persons; b. Conspicuous posting of the notice on the person’s website page, if the person maintains one; and c. Notification to major statewide media. N.D. Cent. Code § 51-30-03.
Content: None specified.
Is Notice To The Government Required?
Yes. Any person that experiences a breach of the security system as provided in this section shall disclose to the attorney general by mail or electronic mail any breach of the security system which exceeds two hundred fifty individuals. N.D. Cent. Code § 51-30-02.
Is Notice To Credit Reporting Agencies Required?
No.
Are There Security Measure Standards?
No.
What Are The Possible Consequences Of A Violation?
The attorney general may enforce the provisions pursuant to N.D. Cent. Code Ch. 51-15, which provides for injunctive relief and a civil penalty of not more than $5,000 for each violation. N.D. Cent. Code §§ 51-30-02; 51-15-11.
Are There Any Exemptions/Exceptions?
A person that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this chapter is deemed to be in compliance with the notification requirements of this chapter if the person notifies subject individuals in accordance with its policies in the event of a breach of security of the system.
Additionally, a financial institution, trust company, or credit union that is subject to, examined for, and in compliance with the federal interagency guidance on response programs for unauthorized access to customer information and customer notice is in compliance with this chapter. A covered entity, business associate, or subcontractor subject to breach notification requirements under title 45, Code of Federal Regulations, subpart D, part 164, is considered to be in compliance with this chapter. N.D. Cent. Code § 51-30-06.