Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: Ariz. R.S. § 18-551 et seq.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

(7) The term “personal information” (a) means any of the following: (i) An individual’s first name or first initial and last name in combination with one or more specified data elements. (ii) An individual’s username or email address, in combination with a password or security question and answer, that allows access to an online account.

core/separator

core/list

The term “breach” or “security system breach”: (a) means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

A “security incident” means an event that creates reasonable suspicion that a person’s information systems or computerized data may have been compromised or that measures put in place to protect the person’s information systems or computerized data may have failed.

A “breach” or “security system breach” does not include a good faith acquisition of personal information by a person’s employee or agent for the purposes of the person if the personal information is not used for a purpose unrelated to the person and is not subject to further unauthorized disclosure.

A person is not required to make a breach notification if the person, an independent third-party forensic auditor, or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals.

If a person that conducts business in this state and who owns, maintains, or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach. If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data shall provide the breach notification within forty-five days after the determination.

The breach notification may be delayed if a law enforcement agency advises the person that the notifications will impede a criminal investigation. On being informed by the law enforcement agency that the notifications no longer compromise the investigation, the person shall make the required notifications, as applicable, within forty-five days.

The breach notification shall include at least the following:

The breach notification shall be provided by one of the following methods:

Substitute notice consists of all of the following:

(a) A written letter to the attorney general that demonstrates the facts necessary for substitute notice.

(b) Conspicuous posting of the notice for at least forty-five days on the website of the person if the person maintains one.

If the breach requires notification of more than 1,000 individuals, the affected person must notify the <a>attorney general and the director of the Arizona </a>department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or by providing the attorney general with a copy of the notification provided pursuant to paragraph 1 of this subsection.

If the breach requires notification of more than one thousand individuals, the affected person must notify the three largest nationwide consumer reporting agencies.

A person who complies with the notification requirements or security system breach procedures pursuant to the rules, regulations, procedures, guidance, or guidelines established by the person’s primary or functional federal regulator is deemed to be in compliance with these breach notification requirements.

The breach notification requirements do not apply to either of the following:

A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee. The person that maintains the data under an agreement with the owner or licensee is not required to provide the notifications required by subsection B of this section unless the agreement stipulates otherwise.

If a breach involves personal information as prescribed in § 18-551, paragraph 7, subdivision (a), item (ii) for an online account (i.e., an individual’s username or email address, in combination with a password or security question and answer, that allows access to an online account) and does not involve personal information as defined in § 18-551, paragraph 7, subdivision (a), item (i), the person may comply with this law by providing the notification in an electronic or other form. The notification should direct the individual whose personal information has been breached to promptly change the individual’s password and security question or answer, as applicable, or to take other steps that are appropriate to protect the online account of the person and all other online accounts for which the individual whose personal information has been breached uses the same username and email address and password or security question or answer.

If the breach of personal information as prescribed in § 18-551, paragraph 7, subdivision (a), item (ii) is for login credentials of an email account furnished by the person, the person is not required to comply with this section by providing the notification to that email address, but may comply with this section by providing notification by another method described in this subsection or by providing clear and conspicuous notification delivered to the individual online when the individual is connected to the online account from an internet protocol address or online location from which the person knows the individual customarily accesses the account. The person satisfies the notification requirement with regard to the individual’s account by requiring the individual to reset the individual’s password or security question and answer for that account if the person also notifies the individual to change the same password or security question and answer for all other online accounts for which the individual uses the same username or email address and password or security question or answer.

Data Disposal and Security: Ariz. R.S. § 44-7601.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

A. An entity shall not knowingly discard or dispose of records or documents without redacting the information or destroying the records or documents if the records or documents contain an individual’s first and last name or first initial and last name in combination with a corresponding complete:

An entity that maintains and complies with the entity’s own procedures for the discarding or disposing of records or documents containing the information listed in Subsection A of this section that is consistent with the requirements of this section shall be deemed to be in compliance with this section.

The data disposal requirements only apply to paper records and paper documents.