Careers

Diversity

Experience

Innovation

interactiveMaps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

Data Breach Requirements: N.D.C.C. § 51-30-01 et seq.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

The term “personal information” means an individual’s first name or first initial and last name in combination with any of the following data elements, when the name and the data elements are not encrypted: (1) The individual’s Social Security number; (2) The operator’s license number assigned to an individual by the department of transportation under Section 39-06-14; (3) A nondriver color photo identification card number assigned to the individual by the Department of Transportation under Section 39-06-03.1; (4) The individual’s financial institution account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial accounts; (5) The individual’s date of birth; (6) The maiden name of the individual’s mother; (7) Medical information; (8) Health insurance information; (9) An identification number assigned to the individual by the individual’s employer in combination with any required security code, access code, or password; or (10) The individual’s digitized or other electronic signature.

core/separator

The term “breach of the security system” means unauthorized acquisition of computerized data when access to personal information has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable.

Good-faith acquisition of personal information by an employee or agent of the person is not a breach of the security of the system, if the personal information is not used or subject to further unauthorized disclosure.

The breach notification must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and to restore the integrity of the data system.

The breach notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The breach notification must be made after the law enforcement agency determines that the notification will not compromise the investigation.

A breach notice may be provided by one of the following methods:

core/list

Substitute notice consists of the following: a. Email notice when the person has an email address for the subject persons; b. Conspicuous posting of the notice on the person’s website page, if the person maintains one; and c. Notification to major statewide media.

Any person that experiences a breach of the security system shall disclose to the attorney general by mail or email any breach which exceeds 250 individuals.

A financial institution, trust company, or credit union that is subject to, examined for, and in compliance with the federal interagency guidance on response programs for unauthorized access to customer information and customer notice is in compliance with this chapter. A covered entity, business associate, or subcontractor subject to breach notification requirements under Title 45, Code of Federal Regulations, Subpart D, Part 164 (HIPAA), is considered to be in compliance with this chapter.

Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following the discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

North Dakota