Privacy & Information Security Law Blog

On March 26, 2020, Washington D.C. enacted bill number B23-0215, amending D.C.’s data breach notification law (the “Bill”). Among other requirements, the Bill requires the provision of identity theft prevention services in certain data breaches, establishes a new regulatory reporting requirement in the event of a cognizable data breach affecting 50 or more residents of D.C., and imposes certain data security requirements on covered businesses.

Key provisions of the Bill include the following:

• Revised Definition of Personal Information. The Bill defines personal information as an individual’s name in combination with any of the following data elements:
  • Social Security number, individual taxpayer identification number, passport number, driver’s license number, D.C. identification card number, military identification number, or other unique identification number on a government-issued document;
  • account number, credit card or debit card number, or any other number or code or combination of numbers or codes, such as an identification number, security code, access code, or password, that allows access to or use of an individual’s financial or credit account;
  • medical information;
  • genetic information and DNA profile;
  • health insurance information, including a policy number, subscriber information number, or any unique identifier used by a health insurer that permits access to an individual’s health and billing information;
  • biometric data; and
  • any combination of data elements listed in 1-6, above, that would enable a person to commit identity theft without reference to the individual’s name.

The Bill also defines personal information to include “a user name or email address in combination with a password, security question and answer, or other means of authentication, or any combination of data elements [listed above] that permits access to an individual’s email account.”

• Harm Threshold. The Bill establishes a harm threshold for breach notification pursuant to which notice is not required if the entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General for the District of Columbia and federal law enforcement agencies, that the breach likely will not result in harm to affected individuals. Under this standard, to rely on the harm threshold, an entity will need to consult with the D.C. Attorney General and federal law enforcement authorities regarding its determination of the likelihood of harm.
• Regulator Notification. The Bill establishes a new regulator notification requirement in D.C. In the event a breach affects 50 or more D.C. residents, the entity must provide notice to the Office of the Attorney General for the District of Columbia no later than when notice is provided to affected individuals. The Bill also sets forth content requirements for the notice to the D.C. Attorney General.
• Credit Monitoring. In addition to imposing certain content requirements for breach notification letters to affected individuals, the Bill requires an entity to provide at least 18 months of free identity theft protection services to affected individuals in the event the breach affects Social Security numbers or taxpayer identification numbers.
• Partial GLB/HIPAA Pre-Emption. The Bill partially exempts entities subject to the Gramm-Leach-Bliley (“GLB”) Act or Health Insurance Portability and Accountability Act (“HIPAA”) from the notification requirements, but requires an entity subject to those laws’ breach notification requirements to also notify the D.C. Attorney General of a breach if notifying affected individuals pursuant to GLB or HIPAA.

In addition to the amendments to the District’s breach notification law, the Bill also establishes certain data security requirements for businesses that own, license, maintain, handle or otherwise possess personal information of D.C. residents. The Bill requires such businesses to “implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and nature and size of the entity of the operation.” The Bill also requires covered businesses to enter into written agreements with third party service providers that require the service provider to implement and maintain similar security procedures and practices. Finally, the Bill includes certain requirements for the secure destruction of records that contain personal information. Entities subject to the security requirements of GLB or HIPAA are exempt from the Bill’s data security requirements. The Bill is scheduled to take effect 30 days from the date of approval by the Mayor, following publication in the District of Columbia Register.