Data Breach Requirements: Ariz. R.S. § 18-551 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
(7) The term “personal information” (a) means any of the following: (i) An individual’s first name or first initial and last name in combination with one or more specified data elements. (ii) An individual’s username or email address, in combination with a password or security question and answer, that allows access to an online account.
- The term “specified data element” means any of the following:
(a) An individual’s Social Security number.
(b) The number on an individual’s driver’s license issued pursuant to § 28-3166 or nonoperating identification license issued pursuant to § 28-3165.
(c) A private key that is unique to an individual and that is used to authenticate or sign an electronic record.
(d) An individual’s financial account number or credit or debit card number in combination with any required security code, access code, or password that would allow access to the individual’s financial account.
(e) An individual’s health insurance identification number.
(f) Information about an individual’s medical or mental health treatment or diagnosis by a health care professional.
(g) An individual’s passport number.
(h) An individual’s taxpayer identification number or an identity protection personal identification number issued by the United States Internal Revenue Service.
(i) Unique biometric data generated from a measurement or analysis of human body characteristics to authenticate an individual when the individual accesses an online account.
Security Breach Definition
The term “breach” or “security system breach”: (a) means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.
A “security incident” means an event that creates reasonable suspicion that a person’s information systems or computerized data may have been compromised or that measures put in place to protect the person’s information systems or computerized data may have failed.
Good Faith Exception
A “breach” or “security system breach” does not include a good faith acquisition of personal information by a person’s employee or agent for the purposes of the person if the personal information is not used for a purpose unrelated to the person and is not subject to further unauthorized disclosure.
Risk of Harm Analysis
A person is not required to make a breach notification if the person, an independent third-party forensic auditor, or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals.
Notification Timeline
If a person that conducts business in this state and who owns, maintains, or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach. If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data shall provide the breach notification within forty-five days after the determination.
Security and Investigation Exceptions
The breach notification may be delayed if a law enforcement agency advises the person that the notifications will impede a criminal investigation. On being informed by the law enforcement agency that the notifications no longer compromise the investigation, the person shall make the required notifications, as applicable, within forty-five days.
Notification Content Requirements
The breach notification shall include at least the following:
- The approximate date of the breach.
- A brief description of the personal information included in the breach.
- The toll-free numbers and addresses for the three largest nationwide consumer reporting agencies.
- The toll-free number, address, and website address for the Federal Trade Commission or any federal agency that assists consumers with identity theft matters.
Delivery Methods
The breach notification shall be provided by one of the following methods:
- Written notice.
- An email notice if the person has email addresses for the individuals who are subject to the notice.
- Telephonic notice, if telephonic contact is made directly with the affected individuals and is not through a prerecorded message.
- Substitute notice if the person demonstrates that the cost of providing notice pursuant to paragraphs 1, 2, or 3 would exceed $50,000, that the affected class of subject individuals to be notified exceeds one hundred thousand (100,000) individuals, or that the person does not have sufficient contact information.
Substitute Notice
Substitute notice consists of all of the following:
(a) A written letter to the attorney general that demonstrates the facts necessary for substitute notice.
(b) Conspicuous posting of the notice for at least forty-five days on the website of the person if the person maintains one.
Notice to Government Agencies
If the breach requires notification of more than 1,000 individuals, the affected person must notify the attorney general and the director of the Arizona department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or by providing the attorney general with a copy of the notification provided pursuant to paragraph 1 of this subsection.
Consumer Reporting Agencies
If the breach requires notification of more than one thousand individuals, the affected person must notify the three largest nationwide consumer reporting agencies.
Preemption and Compliance
A person who complies with the notification requirements or security system breach procedures pursuant to the rules, regulations, procedures, guidance, or guidelines established by the person’s primary or functional federal regulator is deemed to be in compliance with these breach notification requirements.
The breach notification requirements do not apply to either of the following:
- A person that is subject to Title V of the Gramm-Leach-Bliley Act.
- A covered entity or business associates as defined under regulations implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 Code of Federal Regulations section 160.103 (2013), or a charitable fund-raising foundation or nonprofit corporation whose primary purpose is to support a specified covered entity, if the charitable fund-raising foundation or nonprofit corporation complies with any applicable provision of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.
Data Processor Obligations
A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee. The person that maintains the data under an agreement with the owner or licensee is not required to provide the notifications required by subsection B of this section unless the agreement stipulates otherwise.
Other Information
If a breach involves personal information as prescribed in § 18-551, paragraph 7, subdivision (a), item (ii) for an online account (i.e., an individual’s username or email address, in combination with a password or security question and answer, that allows access to an online account) and does not involve personal information as defined in § 18-551, paragraph 7, subdivision (a), item (i), the person may comply with this law by providing the notification in an electronic or other form. The notification should direct the individual whose personal information has been breached to promptly change the individual’s password and security question or answer, as applicable, or to take other steps that are appropriate to protect the online account of the person and all other online accounts for which the individual whose personal information has been breached uses the same username and email address and password or security question or answer.
If the breach of personal information as prescribed in § 18-551, paragraph 7, subdivision (a), item (ii) is for login credentials of an email account furnished by the person, the person is not required to comply with this section by providing the notification to that email address, but may comply with this section by providing notification by another method described in this subsection or by providing clear and conspicuous notification delivered to the individual online when the individual is connected to the online account from an internet protocol address or online location from which the person knows the individual customarily accesses the account. The person satisfies the notification requirement with regard to the individual’s account by requiring the individual to reset the individual’s password or security question and answer for that account if the person also notifies the individual to change the same password or security question and answer for all other online accounts for which the individual uses the same username or email address and password or security question or answer.
Data Disposal and Security: Ariz. R.S. § 44-7601.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
See Data Disposal.
Data Disposal
A. An entity shall not knowingly discard or dispose of records or documents without redacting the information or destroying the records or documents if the records or documents contain an individual’s first and last name or first initial and last name in combination with a corresponding complete:
- Social Security number.
- Credit card, charge card, or debit card number.
- Retirement account number.
- Savings, checking, or securities entitlement account number.
- Driver’s license number or nonoperating identification license number.
An entity that maintains and complies with the entity’s own procedures for the discarding or disposing of records or documents containing the information listed in Subsection A of this section that is consistent with the requirements of this section shall be deemed to be in compliance with this section.
Other Information
The data disposal requirements only apply to paper records and paper documents.