Delaware

Consumer Data Privacy Law

Consumer Data Privacy and Online Monitoring

Available at: https://legis.delaware.gov/json/BillDetail/GenerateHtmlDocumentEngrossment?engrossmentId=35877&docTypeId=6

Data Breach Requirements: 6 Del. C. § 12B-101 et seq.

The numbering and internal citations herein are derived from the applicable state statute.

Personal Information

(7) a. The term “personal information” means a Delaware resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to that individual:

1. Social Security number.

2. Driver’s license number or state or federal identification card number.

3. Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account.

4. Passport number.

5. A username or email address, in combination with a password or security question and answer that would permit access to an online account.

6. Medical history, medical treatment by a health care professional, diagnosis of mental or physical condition by a health care professional, or deoxyribonucleic acid (DNA) profile.

7. Health insurance policy number, subscriber identification number, or any other unique identifier used by a health insurer to identify the person.

8. Unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes. 9. An individual taxpayer identification number.

Security Breach Definition

A “breach of security” means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information is not a breach of security to the extent that personal information contained therein is encrypted, unless such unauthorized acquisition includes, or is reasonably believed to include, the encryption key and the person that owns or licenses the encrypted information has a reasonable belief that the encryption key could render that personal information readable or useable.

Good Faith Exception

Good faith acquisition of personal information by an employee or agent of any person for the purposes of such person is not a breach of security, provided that the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure.

Risk of Harm Analysis

Any person who conducts business in this state and who owns or licenses computerized data that includes personal information shall provide notice of any breach of security following determination of the breach of security to any resident of this state whose personal information was breached or is reasonably believed to have been breached, unless, after an appropriate investigation, the person reasonably determines that the breach of security is unlikely to result in harm to the individuals whose personal information has been breached.

Notification Timeline

A breach notification must be made without unreasonable delay but not later than 60 days after determination of the breach of security, unless a shorter time is required under federal law or an exception applies. When a person could not, through reasonable diligence, identify within 60 days that the personal information of certain residents of this state was included in a breach of security, such person must provide the breach notice to such residents as soon as practicable after the determination that the breach of security included the personal information of such residents, unless such person provides or has provided substitute notice in accordance with § 12B-101(5)d. of this title.

Security and Investigation Exceptions

A breach notification may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation and such law enforcement agency has made a request of the person that the notice be delayed. Any such delayed notice must be made after such law enforcement agency determines that notice will not compromise the criminal investigation and so notifies the person of such determination.

Notification Content Requirements

See Other Information.

Delivery Methods

A breach notice may be provided by one of the following methods:

a. Written notice.

b. Telephonic notice.

c. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act) or if the person’s primary means of communication with the resident is by electronic means. d. Substitute notice, if the person required to provide notice under this chapter demonstrates that the cost of providing notice will exceed $75,000, or that the affected number of Delaware residents to be notified exceeds 100,000 residents, or that the person does not have sufficient contact information to provide notice.

Substitute Notice

Substitute notice consists of all of the following:

1. Electronic notice if the person has email addresses for the members of the affected class of Delaware residents.

2. Conspicuous posting of the notice on a website page of the person if the person maintains one or more website pages. 3. Notice to major statewide media, including newspapers, radio, and television and publication on the major social media platforms of the person providing notice.

Notice to Government Agencies

If the affected number of Delaware residents to be notified exceeds 500 residents, the person required to provide notice shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the attorney general.

Consumer Reporting Agencies

N/A

Preemption and Compliance

A person that is regulated by state or federal law, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Gramm-Leach-Bliley Act and that maintains procedures for a breach of security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this law if the person notifies affected Delaware residents in accordance with the maintained procedures when a breach of security occurs.

Data Processor Obligations

A person that maintains computerized data that includes personal information that the person does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of security immediately following determination of the breach of security. For purposes of this subsection, “cooperation” includes sharing with the owner or licensee information relevant to the breach.

Other Information

If the breach of security includes a Social Security number, the person shall offer to each resident, whose personal information, including Social Security number, was breached or is reasonably believed to have been breached, credit monitoring services at no cost to such resident for a period of one year. Such person shall provide all information necessary for such resident to enroll in the services and shall include information on how such resident can place a credit freeze on such resident’s credit file. Such services are not required if, after an appropriate investigation, the person reasonably determines that the breach of security is unlikely to result in harm to the individuals whose personal information has been breached.

In the case of a breach of security involving personal information defined in § 12B-101(7)a.5. of this title for login credentials of an email account, if the person cannot comply with this section by providing the security breach notification to such email address, the person may instead comply with this section by providing notice by another method described in § 12B-101(5) of this title or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an internet protocol address or online location from which the person knows the resident customarily accesses the account.

Data Disposal and Security: 6 Del. C. §§ 5001C to 5004C; § 12B-100.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

Key Terms

The term “personal information” means a Delaware resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to that individual:

1. Social Security number.
2. Driver’s license number or state or federal identification card number.
3. Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account.
4. Passport number.
5. A username or email address, in combination with a password or security question and answer that would permit access to an online account.
6. Medical history, medical treatment by a health care professional, diagnosis of mental or physical condition by a health care professional, or deoxyribonucleic acid (DNA) profile.
7. Health insurance policy number, subscriber identification number, or any other unique identifier used by a health insurer to identify the person.
8. Unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes.
9. An individual taxpayer identification number.

The term “personal identifying information” means a consumer’s first name or first initial and last name in combination with any one of the following data elements that relate to the consumer, when either the name or the data elements are not encrypted: Social Security number; passport number; driver’s license or state identification card number; insurance policy number; financial services account number; bank account number; credit card number; debit card number; tax or payroll information; or confidential health-care information, including all information relating to a patient’s health care history, diagnosis, condition, and treatment, or evaluation obtained from a health care provider who has treated the patient, that explicitly or by implication identifies a particular patient.

The term “record” means information that is inscribed on a tangible medium, or that is stored in an electronic or other medium and is retrievable in perceivable form on which personal identifying information is recorded or preserved. “Record” does not include publicly available directories or sources containing information a consumer has voluntarily consented to have publicly disseminated or listed, or that is disseminated as provided for by applicable law or regulation, such as name, address, or telephone number, or other directories or sources as are derived solely from such directories or sources.

Security Requirements

Any person who conducts business in Delaware and owns, licenses, or maintains personal information shall implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information collected or maintained in the regular course of business.

Data Disposal

In the event that a commercial entity seeks permanently to dispose of records containing consumers’ personal identifying information within its custody or control, such commercial entity shall take reasonable steps to destroy or arrange for the destruction of each such record by shredding, erasing, or otherwise destroying or modifying the personal identifying information in those records to make it unreadable or indecipherable.