Data Breach Requirements: Ala. Code 1975 § 8-38-1 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
(6) The term “sensitive personally identifying information” means:
a. Except as provided in paragraph b., an Alabama resident’s first name or first initial and last name in combination with one or more of the following with respect to the same Alabama resident:
- A non-truncated Social Security number or tax identification number.
- A non-truncated driver’s license number, state-issued identification card number, passport number, military identification number, or other unique identification number issued on a government document used to verify the identity of a specific individual.
- A financial account number, including a bank account number, credit card number, or debit card number, in combination with any security code, access code, password, expiration date, or PIN, that is necessary to access the financial account or to conduct a transaction that will credit or debit the financial account.
- Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
- An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
- A username or email address, in combination with a password or security question and answer that would permit access to an online account affiliated with the covered entity that is reasonably likely to contain or is used to obtain sensitive personally identifying information.
Security Breach Definition
The term “breach of security” or “breach” means the unauthorized acquisition of data in electronic form containing sensitive personally identifying information. Acquisition occurring over a period of time committed by the same entity constitutes one breach.
Good Faith Exception
A “breach of security” or “breach” does not include any of the good faith acquisition of sensitive personally identifying information by an employee or agent of a covered entity, unless the information is used for a purpose unrelated to the business or subject to further unauthorized use.
Risk of Harm Analysis
A covered entity that determines that sensitive personally identifying information has been acquired or is reasonably believed to have been acquired by an unauthorized person, and is reasonably likely to cause substantial harm to the individuals to whom the information relates, must give notice of the breach to each impacted individual.
Notification Timeline
A breach notice shall be made as expeditiously as possible and without unreasonable delay, taking into account the time necessary to allow the covered entity to conduct an investigation. The breach notification must be provided within 45 days of identifying that a breach has occurred and is reasonably likely to cause substantial harm to the individuals to whom the information relates.
Security and Investigation Exceptions
If a federal or state law enforcement agency determines that a breach notice to individuals would interfere with a criminal investigation or national security, the notice shall be delayed upon the receipt of written request of the law enforcement agency for a period that the law enforcement agency determines is necessary. A law enforcement agency, by a subsequent written request, may revoke the delay as of a specified date or extend the period set forth in the original request made under this section if further delay is necessary.
Notification Content Requirements
The breach notice shall include, at a minimum, all of the following:
(1) The date, estimated date, or estimated date range of the breach.
(2) A description of the sensitive personally identifying information that was acquired by an unauthorized person as part of the breach.
(3) A general description of the actions taken by a covered entity to restore the security and confidentiality of the personal information involved in the breach.
(4) A general description of steps an affected individual can take to protect himself or herself from identity theft.
(5) Information that the individual can use to contact the covered entity to inquire about the breach.
Delivery Methods
A breach notice shall be given in writing and sent to the mailing address of the individual in the records of the covered entity or sent to the email address of the individual in the records of the covered entity.
A covered entity required to provide a breach notice to any individual may provide substitute notice in lieu of direct notice, if direct notice is not feasible due to any of the following:
a. Excessive cost: (1) Excessive cost to the covered entity relative to the resources of the covered entity. (2) The cost to the covered entity exceeds $500,000.
b. Lack of sufficient contact information for the individual required to be notified.
c. The affected individuals exceed 100,000 persons.
Substitute Notice
Substitute notice shall include both of the following:
- A conspicuous notice on the internet website of the covered entity, if the covered entity maintains a website, for a period of 30 days.
- Notice in print and in broadcast media, including major media in urban and rural areas where the affected individuals reside.
b. An alternative form of substitute notice may be used with the approval of the attorney general.
Notice to Government Agencies
If the number of individuals a covered entity is required to notify of a breach exceeds 1,000, the entity shall provide written notice of the breach to the attorney general as expeditiously as possible and without unreasonable delay, and within 45 days of identifying a breach has occurred and is reasonably likely to cause substantial harm to the individuals to whom the information relates. Written notice to the attorney general shall include all of the following:
(1) A synopsis of the events surrounding the breach at the time that notice is provided.
(2) The approximate number of individuals in the state who were affected by the breach.
(3) Any services related to the breach being offered or scheduled to be offered, without charge, by the covered entity to individuals and instructions on how to use the services.
(4) The name, address, telephone number, and email address of the employee or agent of the covered entity from whom additional information may be obtained about the breach.
A covered entity may provide the attorney general with supplemental or updated information regarding a breach at any time.
Consumer Reporting Agencies
If a covered entity discovers circumstances requiring notice of the breach to more than 1,000 individuals at a single time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies and provide the timing, distribution, and content of the breach notices.
Preemption and Compliance
An entity subject to or regulated by federal laws, rules, regulations, procedures, or guidance on data breach notification established or enforced by the federal government is exempt from this law, as long as the entity does all of the following:
(1) Maintains procedures pursuant to those laws, rules, regulations, procedures, or guidance.
(2) Provides notice to affected individuals pursuant to those laws, rules, regulations, procedures, or guidance.
(3) Provides a copy of the notice to the attorney general in a timely manner when the number of individuals the entity notified exceeds 1,000.
Data Processor Obligations
In the event a third-party agent has experienced a breach of security in the system maintained by the agent, the agent shall notify the covered entity of the breach of security as expeditiously as possible and without unreasonable delay, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred.
A third-party agent, in cooperation with a covered entity, shall provide information in the possession of the third-party agent so that the covered entity can comply with its notice requirements.
A covered entity may enter into a contractual agreement with a third-party agent whereby the third-party agent agrees to handle notifications required under this law.
Other Information
If a covered entity determines that a breach of security has or may have occurred in relation to sensitive personally identifying information that is accessed, acquired, maintained, stored, utilized, or communicated by, or on behalf of, the covered entity, the covered entity shall conduct a good faith and prompt investigation that includes all of the following:
(1) An assessment of the nature and scope of the breach.
(2) Identification of any sensitive personally identifying information that may have been involved in the breach and the identity of any individuals to whom that information relates.
(3) A determination of whether the sensitive personally identifying information has been acquired or is reasonably believed to have been acquired by an unauthorized person and is reasonably likely to cause substantial harm to the individuals to whom the information relates.
(4) Identification and implementation of measures to restore the security and confidentiality of the systems compromised in the breach.
In determining whether sensitive personally identifying information has been acquired or is reasonably believed to have been acquired by an unauthorized person without valid authorization, the following factors may be considered:
(1) Indications that the information is in the physical possession and control of a person without valid authorization, such as a lost or stolen computer or other device containing information.
(2) Indications that the information has been downloaded or copied.
(3) Indications that the information was used by an unauthorized person, such as fraudulent accounts opened or instances of identity theft reported.
(4) Whether the information has been made public.
If a covered entity determines that notice is not required under this section, the entity shall document the determination in writing and maintain records concerning the determination for no less than five years.
Data Disposal and Security: Ala. Code 1975 § 8-38-2, -3, -10.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
The term “sensitive personally identifying information” means
a. Except as provided in paragraph b, an Alabama resident’s first name or first initial and last name in combination with one or more of the following with respect to the same Alabama resident:
- A non-truncated Social Security number or taxpayer identification number.
- A non-truncated driver’s license number, state-issued identification card number, passport number, military identification number, or other unique identification number issued on a government document used to verify the identity of a specific individual.
- A financial account number, including a bank account number, credit card number, or debit card number, in combination with any security code, access code, password, expiration date, or PIN, that is necessary to access the financial account or to conduct a transaction that will credit or debit the financial account.
- Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
- An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
- A username or email address, in combination with a password or security question and answer that would permit access to an online account affiliated with the covered entity that is reasonably likely to contain or is used to obtain sensitive personally identifying information.
b. The term does not include either of the following: - Information about an individual which has been lawfully made public by a federal, state, or local government record or a widely distributed media.
- Information that is truncated, encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable, including encryption of the data, document, or device containing the sensitive personally identifying information, unless the covered entity knows or has reason to know that the encryption key or security credential that could render the personally identifying information readable or useable has been breached together with the information.
Security Requirements
Each covered entity and third-party agent shall implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security.
(b) Reasonable security measures means security measures practicable for the covered entity subject to subsection (c), to implement and maintain, including consideration of all of the following:
(1) Designation of an employee or employees to coordinate the covered entity’s security measures to protect against a breach of security. An owner or manager may designate himself or herself.
(2) Identification of internal and external risks of a breach of security.
(3) Adoption of appropriate information safeguards to address identified risks of a breach of security and assess the effectiveness of such safeguards.
(4) Retention of service providers, if any, that are contractually required to maintain appropriate safeguards for sensitive personally identifying information.
(5) Evaluation and adjustment of security measures to account for changes in circumstances affecting the security of sensitive personally identifying information.
(6) Keeping the management of the covered entity, including its board of directors, if any, appropriately informed of the overall status of its security measures; provided, however, that the management of a government entity subject to this subdivision may be appropriately informed of the status of its security measures through a properly convened executive session under the Open Meetings Act pursuant to Section 36-25A-7.
An assessment of a covered entity’s security shall be based upon the entity’s reasonable security measures as a whole and shall place an emphasis on data security failures that are multiple or systemic, including consideration of all the following:
(1) The size of the covered entity.
(2) The amount of sensitive personally identifying information and the type of activities for which the sensitive personally identifying information is accessed, acquired, maintained, stored, utilized, or communicated by, or on behalf of, the covered entity.
(3) The covered entity’s cost to implement and maintain the reasonable security measures to protect against a breach of security relative to its resources.
Data Disposal
A covered entity or third-party agent shall take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control when the records are no longer to be retained pursuant to applicable law, regulations, or business needs. Disposal shall include shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any reasonable means consistent with industry standards.