Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: Alaska Stat. Ann. § 45.48.010 et seq.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

(7) The term “personal information” means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of

(A) An individual’s name; and (B) one or more of the following information elements:

(i) The individual’s Social Security number;

(ii) The individual’s driver’s license number or state identification card number;

(iii) Except as provided in (iv) of this subparagraph, the individual’s account number, credit card number, or debit card number;

(iv) If an account can only be accessed with a personal code, the number in (iii) of this subparagraph and the personal code; in this sub-subparagraph, “personal code” means a security code, an access code, a personal identification number, or a password; (v) Passwords, personal identification numbers, or other access codes for financial accounts.

core/separator

The term “breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector.

The term “acquisition” includes acquisition by

(A) photocopying, facsimile, or other paper-based method;

(B) a device, including a computer, that can read, write, or store information that is represented in numerical form; or

(C) a method not identified by (A) or (B) of this paragraph.

The good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose of the information collector is not a breach of the security of the information system if the employee or agent does not use the personal information for a purpose unrelated to a legitimate purpose of the information collector and does not make further unauthorized disclosure of the personal information.

A data breach notification is not required if, after an appropriate investigation and after written notification to the state attorney general, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. The determination shall be documented in writing, and the documentation shall be maintained for five years. The notification required by this subsection may not be considered a public record open to inspection by the public.

An information collector shall make the breach notification disclosure in the most expeditious time possible and without unreasonable delay and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.

An information collector may delay disclosing the breach if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation. However, the information collector shall disclose the breach to the state resident in the most expeditious time possible and without unreasonable delay after the law enforcement agency informs the information collector in writing that disclosure of the breach will no longer interfere with the investigation.

An information collector shall make the breach notification disclosure

(1) by a written document sent to the most recent address the information collector has for the state resident;

(2) by electronic means if the information collector’s primary method of communication with the state resident is by electronic means or if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or

(3) if the information collector demonstrates that the cost of providing notice would exceed $150,000, that the affected class of state residents to be notified exceeds 300,000, or that the information collector does not have sufficient contact information to provide notice, by

(A) electronic mail if the information collector has an electronic mail address for the state resident;

(B) conspicuously posting the disclosure on the internet website of the information collector if the information collector maintains an internet website; and

(C) providing a notice to major statewide media.

core/column

core/columns

(a) If an information collector is required notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies and provide the agencies with the timing, distribution, and content of the notices to state residents.

(b) This section may not be construed to require the information collector to provide the consumer reporting agencies identified under (a) of this section with the names or other personal information of the state residents whose personal information was subject to the breach.

(c) This section does not apply to an information collector who is subject to the Gramm-Leach-Bliley Act.

Immediately after the information recipient discovers the breach, the information recipient shall give notification of the breach to the information distributor who owns the personal information or who licensed the use of the personal information to the information recipient. The information recipient shall cooperate with the information distributor as necessary to allow the information distributor to comply with its legal obligations. In this subsection “cooperate” means sharing with the information distributor information relevant to the breach, except for confidential business information or trade secrets.

Data Disposal and Security: Alaska Stat. Ann. § 45.48.500 et seq.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

(A) the discarding or abandonment of records containing personal information;

(B) the sale, donation, discarding, or transfer of

(i) any medium, including computer equipment or computer media, that contains records of personal information;

(ii) non-paper media, other than that identified under (i) of this subparagraph, on which records of personal information are stored; and

(iii) equipment for non-paper storage of information.

The term “personal information” means: (A) an individual’s passport number, driver’s license number, state identification number, bank account number, credit card number, debit card number, other payment card number, financial account information, or information from a financial application; or (B) a combination of an individual’s (i) name; and (ii) medical information, insurance policy number, employment information, or employment history.

A business or governmental agency shall adopt written policies and procedures that relate to the adequate destruction and proper disposal of records containing personal information.

See Data Disposal (implementing and monitoring compliance with policies and procedures).

When disposing of records that contain personal information, a business and a governmental agency shall take all reasonable measures necessary to protect against unauthorized access to or use of the records.

The measures that may be taken to comply with the data disposal requirements include:

(1) implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of paper documents containing personal information so that the personal information cannot practicably be read or reconstructed;<br>(2) implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed;<br>(3) after due diligence, entering into a written contract with a third party engaged in the business of record destruction to dispose of records containing personal information in a manner consistent with AS 45.48.500-45.48.590. The term “due diligence” ordinarily includes performing one or more of the following:

(i) reviewing an independent audit of the third party’s operations and its compliance with AS 45.48.500-45.48.590;<br>(ii) obtaining information about the third party from several references or other reliable sources and requiring that the third party be certified by a recognized trade association or similar organization with a reputation for high standards of quality review; or<br>(iii) reviewing and evaluating the third party’s information security policies and procedures, or taking other appropriate measures to determine the competency and integrity of the third party.

If a business or governmental agency has otherwise complied with the provisions of AS 45.48.500-45.48.590 in the selection of a third party engaged in the business of record destruction, the business or governmental agency is not liable for the disposal of records under AS 45.48.500-45.48.590 after the business or governmental agency has relinquished control of the records to the third party for the destruction of the records.

A business or governmental agency is not liable for the disposal of records under AS 45.48.500-45.48.590 after the business or governmental agency has relinquished control of the records to the individual to whom the records pertain.