Alabama Data Breach Notification Act for County Governments
A
l
a
b
a
m
a
D
a
t
a
B
r
e
a
c
h
N
o
t
i
f
i
c
a
t
i
o
n
A
c
t
:
W
h
a
t
C
o
u
n
t
y
G
o
v
e
r
n
m
e
n
t
s
N
e
e
d
t
o
K
n
o
w
Morgan Arrington, General Counsel
Association of County Commissions of Alabama
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
A
l
a
b
a
m
a
r
e
c
e
n
t
l
y
b
e
c
a
m
e
t
h
e
5
0
t
h
s
t
a
t
e
t
o
e
n
a
c
t
a
d
a
t
a
b
r
e
a
c
h
n
o
t
i
f
i
c
a
t
i
o
n
l
a
w
.
•
A
c
t
2
0
1
8
-
3
9
6
w
i
l
l
g
o
i
n
t
o
e
f
f
e
c
t
o
n
J
u
n
e
1
,
2
0
1
8
•
I
n
c
l
u
d
e
s
s
e
v
e
r
a
l
r
e
q
u
i
r
e
m
e
n
t
s
t
h
a
t
c
o
v
e
r
e
d
e
n
t
i
t
i
e
s
a
r
e
e
x
p
e
c
t
e
d
t
o
a
s
s
e
s
s
a
n
d
i
m
p
l
e
m
e
n
t
i
n
a
v
e
r
y
s
h
o
r
t
t
i
m
e
f
r
a
m
e
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
W
h
o
n
e
e
d
s
t
o
b
e
i
n
c
o
m
p
l
i
a
n
c
e
w
i
t
h
t
h
i
s
l
a
w
?
–
All county governments;
–
All departments of county government;
–
All instrumentalities of the county; and
–
All third-party agents of the county…
…that maintain electronic records containing sensitive
information about Alabama residents.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
While the nuances of the law are extensive, it includes
three basic requirements:
1.
C
o
v
e
r
e
d
e
n
t
i
t
i
e
s
a
n
d
t
h
e
i
r
t
h
i
r
d
-
p
a
r
t
y
s
e
r
v
i
c
e
p
r
o
v
i
d
e
r
s
a
r
e
r
e
q
u
i
r
e
d
t
o
i
m
p
l
e
m
e
n
t
a
n
d
m
a
i
n
t
a
i
n
r
e
a
s
o
n
a
b
l
e
s
e
c
u
r
i
t
y
m
e
a
s
u
r
e
s
t
o
p
r
o
t
e
c
t
s
e
n
s
i
t
i
v
e
i
n
f
o
r
m
a
t
i
o
n
2.
C
o
v
e
r
e
d
e
n
t
i
t
i
e
s
m
u
s
t
c
o
n
d
u
c
t
a
p
r
o
m
p
t
i
n
v
e
s
t
i
g
a
t
i
o
n
u
p
o
n
t
h
e
d
i
s
c
o
v
e
r
y
o
f
a
p
o
s
s
i
b
l
e
s
e
c
u
r
i
t
y
b
r
e
a
c
h
.
3.
C
o
v
e
r
e
d
e
n
t
i
t
i
e
s
m
u
s
t
p
r
o
v
i
d
e
p
r
o
p
e
r
n
o
t
i
f
i
c
a
t
i
o
n
o
f
a
s
e
c
u
r
i
t
y
b
r
e
a
c
h
t
o
t
h
e
f
o
l
l
o
w
i
n
g
:
a
)
i
m
p
a
c
t
e
d
A
l
a
b
a
m
a
r
e
s
i
d
e
n
t
s
,
b
)
t
h
e
A
l
a
b
a
m
a
A
t
t
o
r
n
e
y
G
e
n
e
r
a
l
’
s
O
f
f
i
c
e
,
a
n
d
c
)
c
o
n
s
u
m
e
r
r
e
p
o
r
t
i
n
g
a
g
e
n
c
i
e
s
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
W
h
a
t
i
s
a
“
b
r
e
a
c
h
o
f
s
e
c
u
r
i
t
y
”
?
–
T
h
e
l
a
w
d
e
f
i
n
e
s
i
t
a
s
t
h
e
“
u
n
a
u
t
h
o
r
i
z
e
d
a
c
q
u
i
s
i
t
i
o
n
o
f
d
a
t
a
i
n
e
l
e
c
t
r
o
n
i
c
f
o
r
m
c
o
n
t
a
i
n
i
n
g
s
e
n
s
i
t
i
v
e
p
e
r
s
o
n
a
l
l
y
i
d
e
n
t
i
f
y
i
n
g
i
n
f
o
r
m
a
t
i
o
n
.
”
T
h
e
A
c
t
o
n
l
y
a
p
p
l
i
e
s
t
o
i
n
c
i
d
e
n
t
s
i
n
v
o
l
v
i
n
g
1
)
e
l
e
c
t
r
o
n
i
c
r
e
c
o
r
d
s
t
h
a
t
2
)
c
o
n
t
a
i
n
s
e
n
s
i
t
i
v
e
p
e
r
s
o
n
a
l
l
y
i
d
e
n
t
i
f
y
i
n
g
i
n
f
o
r
m
a
t
i
o
n
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
W
h
a
t
i
s
c
o
n
s
i
d
e
r
e
d
“
s
e
n
s
i
t
i
v
e
p
e
r
s
o
n
a
l
l
y
i
d
e
n
t
i
f
y
i
n
g
i
n
f
o
r
m
a
t
i
o
n
”
?
S
u
c
h
s
e
n
s
i
t
i
v
e
i
s
d
e
f
i
n
e
d
a
s
a
n
A
l
a
b
a
m
a
r
e
s
i
d
e
n
t
’
s
f
i
r
s
t
n
a
m
e
o
r
f
i
r
s
t
i
n
i
t
i
a
l
a
n
d
l
a
s
t
n
a
m
e
,
i
n
c
o
m
b
i
n
a
t
i
o
n
w
i
t
h
a
n
y
o
n
e
o
f
t
h
e
f
o
l
l
o
w
i
n
g
:
•
A social security number or tax identification number;
•
A driver’s license number or any other unique, government-issued
identification number used to verify identity;
•
Any financial account number in combination with access information (i.e. a
security code, expiration date, or PIN);
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
O
v
e
r
v
i
e
w
o
f
L
a
w
:
“
S
e
n
s
i
t
i
v
e
p
e
r
s
o
n
a
l
l
y
i
d
e
n
t
i
f
y
i
n
g
i
n
f
o
r
m
a
t
i
o
n
”
,
c
o
n
t
i
n
u
e
d
:
•
Any information regarding a person’s medical, mental or physical history,
condition or treatment;
•
A person’s health insurance policy number or subscriber identification
number and unique identifier;
•
A username or email address, in combination with a password or security
question and answer.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
1
D
O
E
S
Y
O
U
R
C
O
U
N
T
Y
H
A
V
E
A
N
Y
W
R
I
T
T
E
N
P
O
L
I
C
I
E
S
O
R
P
R
O
C
E
D
U
R
E
S
I
N
P
L
A
C
E
R
E
L
A
T
E
D
T
O
C
Y
B
E
R
S
E
C
U
R
I
T
Y
?
Y
E
S
o
r
N
O
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
2
W
H
I
C
H
D
E
P
A
R
T
M
E
N
T
(
S
)
M
A
I
N
T
A
I
N
“
S
E
N
S
I
T
I
V
E
P
E
R
S
O
N
A
L
L
Y
I
D
E
N
T
I
F
Y
I
N
G
I
N
F
O
R
M
A
T
I
O
N
”
I
N
E
L
E
C
T
R
O
N
I
C
F
O
R
M
?
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
_
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
•
SSN or TIN
•
DL or other gov’t ID #
•
Financial account # + security code,
expiration date, PIN, etc.
•
Medical history, mental/physical condition,
medical treatment or diagnosis
•
Health insurance policy # or subscriber
number + unique identifier
•
User name or email + password or security
question/answer
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
A
l
a
b
a
m
a
r
e
s
i
d
e
n
t
’
s
f
i
r
s
t
n
a
m
e
o
r
f
i
r
s
t
i
n
i
t
i
a
l
a
n
d
l
a
s
t
n
a
m
e
S
e
n
s
i
t
i
v
e
P
e
r
s
o
n
a
l
l
y
I
d
e
n
t
i
f
y
i
n
g
I
n
f
o
r
m
a
t
i
o
n
“
R
e
a
s
o
n
a
b
l
e
S
e
c
u
r
i
t
y
M
e
a
s
u
r
e
s
”
•
A
l
l
c
o
v
e
r
e
d
e
n
t
i
t
i
e
s
m
u
s
t
t
a
k
e
m
e
a
s
u
r
e
d
a
c
t
i
o
n
t
o
p
r
e
v
e
n
t
a
d
a
t
a
b
r
e
a
c
h
b
y
i
m
p
l
e
m
e
n
t
i
n
g
a
n
d
m
a
i
n
t
a
i
n
i
n
g
“
r
e
a
s
o
n
a
b
l
e
s
e
c
u
r
i
t
y
m
e
a
s
u
r
e
s
”
t
o
p
r
o
t
e
c
t
a
l
l
s
e
n
s
i
t
i
v
e
i
n
f
o
r
m
a
t
i
o
n
i
n
t
h
e
i
r
p
o
s
s
e
s
s
i
o
n
.
•
T
h
e
l
a
w
i
n
c
l
u
d
e
s
a
n
u
m
b
e
r
o
f
r
e
q
u
i
r
e
m
e
n
t
s
t
o
h
e
l
p
c
o
v
e
r
e
d
e
n
t
i
t
i
e
s
i
d
e
n
t
i
f
y
i
n
t
e
r
n
a
l
a
n
d
e
x
t
e
r
n
a
l
r
i
s
k
s
t
o
s
e
n
s
i
t
i
v
e
i
n
f
o
r
m
a
t
i
o
n
b
e
f
o
r
e
a
d
a
t
a
b
r
e
a
c
h
e
v
e
r
t
a
k
e
s
p
l
a
c
e
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
“
R
e
a
s
o
n
a
b
l
e
S
e
c
u
r
i
t
y
M
e
a
s
u
r
e
s
”
Counties must consider taking the following actions to
ensure their security measures meet the “reasonable”
standard in the law:
1.
Designating an employee(s) to coordinate security
measures to protect against a potential breach
2.
Identifying internal and external risks of security breach
3.
Adopting and regularly assessing information safeguards
to address identified risks of security breach
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
“
R
e
a
s
o
n
a
b
l
e
S
e
c
u
r
i
t
y
M
e
a
s
u
r
e
s
”
C
o
n
t
i
n
u
e
d
:
4.
Retaining any service providers that are contractually obligated to
maintain appropriate safeguards for sensitive information
5.
Evaluating and adjusting security measures to account for changes
that could affect the security of sensitive information
6.
Keeping management informed on the overall status of the entities
security measures.
However, even with consideration of these factors, what actually constitutes
“reasonable” security measures will vary from county to county.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
“
R
e
a
s
o
n
a
b
l
e
S
e
c
u
r
i
t
y
M
e
a
s
u
r
e
s
”
W
h
e
t
h
e
r
a
c
o
v
e
r
e
d
e
n
t
i
t
y
h
a
s
i
n
s
t
i
t
u
t
e
d
“
r
e
a
s
o
n
a
b
l
e
s
e
c
u
r
i
t
y
m
e
a
s
u
r
e
s
”
w
i
l
l
b
e
a
s
s
e
s
s
e
d
a
s
f
o
l
l
o
w
s
:
1)
the size of the county,
2)
the amount of sensitive personally identifying information on file
with the county, and the county’s use of the information, and
3)
the cost of implementing and maintaining reasonable security
measures relative to the county’s available resources
.
“
a
s
a
w
h
o
l
e
”
w
i
t
h
a
n
e
m
p
h
a
s
i
s
o
n
d
a
t
a
s
e
c
u
r
i
t
y
f
a
i
l
u
r
e
s
t
h
a
t
a
r
e
“
m
u
l
t
i
p
l
e
o
r
s
y
s
t
e
m
i
c
”
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
3
D
O
E
S
Y
O
U
R
C
O
U
N
T
Y
R
E
T
A
I
N
A
N
Y
S
E
R
V
I
C
E
P
R
O
V
I
D
E
R
S
O
R
T
H
I
R
D
P
A
R
T
Y
E
N
T
I
T
I
E
S
T
H
A
T
M
A
I
N
T
A
I
N
S
E
N
S
I
T
I
V
E
I
N
F
O
R
M
A
T
I
O
N
O
N
C
O
U
N
T
Y
R
E
S
I
D
E
N
T
S
?
Y
E
S
o
r
N
O
I
F
Y
E
S
,
D
O
E
S
T
H
E
I
R
C
O
N
T
R
A
C
T
R
E
Q
U
I
R
E
T
H
E
M
T
O
M
A
I
N
T
A
I
N
S
A
F
E
G
U
A
R
D
S
T
O
P
R
O
T
E
C
T
S
U
C
H
I
N
F
O
R
M
A
T
I
O
N
?
Y
E
S
o
r
N
O
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
4
A
P
P
R
O
X
I
M
A
T
E
L
Y
H
O
W
M
A
N
Y
P
E
O
P
L
E
D
O
E
S
Y
O
U
R
C
O
U
N
T
Y
E
M
P
L
O
Y
?
A.
Less than 50
B.
51 to 100
C.
100 to 250
D.
More than 250*
*If more than 250, then how many?_________________
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
5
W
H
A
T
I
S
T
H
E
E
S
T
I
M
A
T
E
D
P
O
P
U
L
A
T
I
O
N
O
F
Y
O
U
R
C
O
U
N
T
Y
?
A
.
2
0
,
0
0
0
o
r
l
e
s
s
B.
20,001 to 49,999
C.
50,000 to 99,999
D.
100,000 to 199,999
E.
Over 200,000
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
6
H
O
W
O
F
T
E
N
I
S
T
H
E
C
O
U
N
T
Y
C
O
M
M
I
S
S
I
O
N
U
P
D
A
T
E
D
O
N
T
H
E
C
O
U
N
T
Y
’
S
D
A
T
A
S
E
C
U
R
I
T
Y
P
L
A
N
S
/
P
R
O
C
E
D
U
R
E
S
?
A
.
N
e
v
e
r
.
B.
Rarely, once each fiscal year.
C.
Sometimes, as the need arises or upon request.
D.
Regularly, at each commission meeting.
E.
Other (please specify)
__________________________________________________
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
C
o
n
d
u
c
t
i
n
g
a
P
r
o
m
p
t
I
n
v
e
s
t
i
g
a
t
i
o
n
•
Even a county with the best-laid security plan could find
itself at the center of a data breach.
•
I
f
a
c
o
u
n
t
y
d
e
t
e
r
m
i
n
e
s
t
h
a
t
a
b
r
e
a
c
h
o
f
s
e
n
s
i
t
i
v
e
i
n
f
o
r
m
a
t
i
o
n
h
a
s
o
c
c
u
r
r
e
d
,
o
r
i
s
e
v
e
n
l
i
k
e
l
y
t
o
o
c
c
u
r
,
t
h
e
l
a
w
r
e
q
u
i
r
e
s
i
t
t
o
c
o
n
d
u
c
t
a
“
g
o
o
d
f
a
i
t
h
a
n
d
p
r
o
m
p
t
i
n
v
e
s
t
i
g
a
t
i
o
n
”
o
f
t
h
e
m
a
t
t
e
r
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
C
o
n
d
u
c
t
i
n
g
a
P
r
o
m
p
t
I
n
v
e
s
t
i
g
a
t
i
o
n
T
h
e
i
n
v
e
s
t
i
g
a
t
i
o
n
s
h
o
u
l
d
i
n
c
l
u
d
e
t
h
e
f
o
l
l
o
w
i
n
g
a
c
t
i
o
n
s
:
•
An assessment of the nature and scope of the breach
•
Identification of any sensitive information that may have been involved in
the breach, and the identity of the persons to whom it relates
•
A determination of whether the sensitive information has been, or is
believed to have been, acquired by an unauthorized person, and is likely to
cause harm to the individual to whom it relates
•
Identification and implementation of measure to restore the security and
confidentiality of the compromised systems.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
7
D
O
E
S
Y
O
U
R
C
O
U
N
T
Y
C
U
R
R
E
N
T
L
Y
H
A
V
E
A
D
E
S
I
G
N
A
T
E
D
E
M
P
L
O
Y
E
E
(
S
)
T
O
H
A
N
D
L
E
B
R
E
A
C
H
E
S
O
F
S
E
N
S
I
T
I
V
E
D
A
T
A
?
A
.
Y
e
s
,
w
e
h
a
v
e
a
d
e
s
i
g
n
a
t
e
d
e
m
p
l
o
y
e
e
t
o
s
p
e
a
r
h
e
a
d
o
u
r
r
e
s
p
o
n
s
e
t
o
a
d
a
t
a
b
r
e
a
c
h
.
B.
Y
e
s
,
w
e
h
a
v
e
a
d
e
s
i
g
n
a
t
e
d
d
e
p
a
r
t
m
e
n
t
t
o
s
p
e
a
r
h
e
a
d
o
u
r
r
e
s
p
o
n
s
e
t
o
a
d
a
t
a
b
r
e
a
c
h
.
C.
No, we do not have a designated person or department to spearhead
our response to a data breach.
D.
Other (please specify)
______________________________________________________
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
8
D
O
E
S
Y
O
U
R
C
O
U
N
T
Y
H
A
V
E
A
P
R
O
C
E
D
U
R
E
I
N
P
L
A
C
E
F
O
R
T
H
E
I
N
V
E
S
T
I
G
A
T
I
O
N
O
F
A
N
A
C
T
U
A
L
O
R
S
U
S
P
E
C
T
E
D
D
A
T
A
B
R
E
A
C
H
?
Y
E
S
o
r
N
O
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
s
•
The notification component of the law is arguably the most
important, and most cumbersome part of the law.
•
T
h
e
n
o
t
i
f
i
c
a
t
i
o
n
o
b
l
i
g
a
t
i
o
n
s
u
n
d
e
r
t
h
e
l
a
w
a
r
e
t
r
i
g
g
e
r
e
d
o
n
l
y
w
h
e
n
t
h
e
i
n
v
e
s
t
i
g
a
t
i
o
n
i
n
d
i
c
a
t
e
s
t
h
a
t
s
e
n
s
i
t
i
v
e
i
n
f
o
r
m
a
t
i
o
n
h
a
s
b
e
e
n
(
o
r
i
s
b
e
l
i
e
v
e
d
t
o
h
a
v
e
b
e
e
n
)
a
c
q
u
i
r
e
d
b
y
a
n
u
n
a
u
t
h
o
r
i
z
e
d
p
e
r
s
o
n
a
n
d
i
s
l
i
k
e
l
y
t
o
c
a
u
s
e
s
u
b
s
t
a
n
t
i
a
l
h
a
r
m
t
o
t
h
e
i
n
d
i
v
i
d
u
a
l
s
w
h
o
t
h
e
s
u
b
j
e
c
t
o
f
t
h
e
i
n
f
o
r
m
a
t
i
o
n
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
s
T
h
e
r
e
i
s
n
o
s
t
a
n
d
a
r
d
i
n
t
h
e
l
a
w
f
o
r
d
e
t
e
r
m
i
n
i
n
g
i
f
a
b
r
e
a
c
h
i
s
l
i
k
e
l
y
t
o
c
a
u
s
e
s
u
b
s
t
a
n
t
i
a
l
h
a
r
m
t
o
t
h
e
i
n
d
i
v
i
d
u
a
l
s
w
h
o
a
r
e
t
h
e
s
u
b
j
e
c
t
o
f
t
h
e
i
n
f
o
r
m
a
t
i
o
n
.
–
The law leaves it up to the covered entity to make a
determination of whether notice is required.
–
I
f
a
c
o
u
n
t
y
d
e
t
e
r
m
i
n
e
s
t
h
a
t
t
h
e
n
o
t
i
c
e
r
e
q
u
i
r
e
m
e
n
t
i
s
n
o
t
t
r
i
g
g
e
r
e
d
,
t
h
e
n
i
t
m
u
s
t
d
o
c
u
m
e
n
t
t
h
a
t
d
e
t
e
r
m
i
n
a
t
i
o
n
i
n
w
r
i
t
i
n
g
a
n
d
m
a
i
n
t
a
i
n
r
e
c
o
r
d
s
r
e
l
a
t
e
d
t
o
t
h
e
d
e
c
i
s
i
o
n
f
o
r
a
t
l
e
a
s
t
f
i
v
e
y
e
a
r
s
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
s
•
I
f
t
h
e
c
o
u
n
t
y
’
s
i
n
v
e
s
t
i
g
a
t
i
o
n
i
n
d
i
c
a
t
e
s
t
h
a
t
t
h
a
t
t
h
e
n
o
t
i
c
e
r
e
q
u
i
r
e
m
e
n
t
s
h
a
v
e
b
e
e
n
m
e
t
,
t
h
e
n
a
l
l
i
n
d
i
v
i
d
u
a
l
s
a
f
f
e
c
t
e
d
b
y
a
d
a
t
a
b
r
e
a
c
h
m
u
s
t
b
e
d
i
r
e
c
t
l
y
n
o
t
i
f
i
e
d
i
n
w
r
i
t
i
n
g
a
s
q
u
i
c
k
l
y
a
s
p
o
s
s
i
b
l
e
–
b
u
t
n
o
l
a
t
e
r
t
h
a
n
4
5
d
a
y
s
a
f
t
e
r
m
a
k
i
n
g
t
h
e
d
e
t
e
r
m
i
n
a
t
i
o
n
t
h
a
t
n
o
t
i
c
e
i
s
r
e
q
u
i
r
e
d
o
r
r
e
c
e
i
v
i
n
g
n
o
t
i
c
e
o
f
f
r
o
m
a
t
h
i
r
d
-
p
a
r
t
y
a
g
e
n
t
t
h
a
t
a
b
r
e
a
c
h
h
a
s
o
c
c
u
r
r
e
d
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
T
h
e
l
a
w
r
e
q
u
i
r
e
s
t
h
e
n
o
t
i
f
i
c
a
t
i
o
n
b
e
s
e
n
t
t
o
m
a
i
l
i
n
g
a
d
d
r
e
s
s
o
r
e
m
a
i
l
a
d
d
r
e
s
s
t
h
e
c
o
u
n
t
y
h
a
s
o
n
f
i
l
e
f
o
r
t
h
e
i
n
d
i
v
i
d
u
a
l
,
a
n
d
t
o
i
n
c
l
u
d
e
t
h
e
f
o
l
l
o
w
i
n
g
i
n
f
o
r
m
a
t
i
o
n
:
•
The date, or estimated date of the breach
•
A description of the sensitive information that was acquired from the breach
•
A general description of the actions taken by the county to restore the
security and confidentiality of the personal information subject to the breach
•
A general description of the steps affected individuals can take to protect
themselves from identity theft
•
Contact information for the county’s point of contact related to the breach
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
T
h
e
l
a
w
p
e
r
m
i
t
s
c
o
v
e
r
e
d
e
n
t
i
t
i
e
s
t
o
g
i
v
e
s
u
b
s
t
i
t
u
t
e
n
o
t
i
c
e
i
n
l
i
e
u
o
f
d
i
r
e
c
t
n
o
t
i
c
e
i
f
a
t
l
e
a
s
t
o
n
e
o
f
t
h
e
f
o
l
l
o
w
i
n
g
c
i
r
c
u
m
s
t
a
n
c
e
s
a
r
e
m
e
t
:
•
The cost of providing direct notice would exceed $500,000
or is an excessive amount relative to the resources of the
covered entity;
•
There is insufficient contact information for the individuals
requiring notification; or
•
Over 100,000 people were affected by the data breach.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
•
S
u
b
s
t
i
t
u
t
e
n
o
t
i
c
e
,
w
h
e
n
a
l
l
o
w
a
b
l
e
,
c
a
n
b
e
s
a
t
i
s
f
i
e
d
b
y
p
l
a
c
i
n
g
i
t
i
n
a
c
o
n
s
p
i
c
u
o
u
s
l
o
c
a
t
i
o
n
o
n
c
o
u
n
t
y
’
s
w
e
b
s
i
t
e
,
i
f
a
v
a
i
l
a
b
l
e
,
f
o
r
3
0
d
a
y
s
o
r
t
h
r
o
u
g
h
p
r
i
n
t
a
n
d
b
r
o
a
d
c
a
s
t
m
e
d
i
a
o
u
t
l
e
t
s
.
•
The law also provides that, with approval from the
Attorney General’s Office, alternative forms of substitute
notice may be permitted.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Q
U
E
S
T
I
O
N
9
B
A
S
E
D
O
N
Y
O
U
R
C
O
U
N
T
Y
’
S
C
U
R
R
E
N
T
R
E
S
O
U
R
C
E
S
,
W
H
A
T
W
O
U
L
D
B
E
T
H
E
M
O
S
T
E
F
F
I
C
I
E
N
T
W
A
Y
T
O
N
O
T
I
F
Y
R
E
S
I
D
E
N
T
S
,
I
N
T
H
E
E
V
E
N
T
O
F
A
N
A
C
T
U
A
L
O
R
S
U
S
P
E
C
T
E
D
D
A
T
A
B
R
E
A
C
H
?
A.
U.S. Mail
B.
C.
Via the county website
D.
Local newspaper
E.
Other (please specify)
________________________________________________
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
•
I
f
a
d
a
t
a
b
r
e
a
c
h
i
m
p
a
c
t
s
m
o
r
e
t
h
a
n
1
,
0
0
0
p
e
o
p
l
e
,
t
h
e
l
a
w
r
e
q
u
i
r
e
s
t
h
e
c
o
u
n
t
y
t
o
n
o
t
i
f
y
t
h
e
A
t
t
o
r
n
e
y
G
e
n
e
r
a
l
n
o
l
a
t
e
r
t
h
a
n
4
5
d
a
y
s
a
f
t
e
r
m
a
k
i
n
g
t
h
e
d
e
t
e
r
m
i
n
a
t
i
o
n
t
h
a
t
n
o
t
i
c
e
i
s
r
e
q
u
i
r
e
d
o
r
r
e
c
e
i
v
i
n
g
n
o
t
i
c
e
o
f
f
r
o
m
a
t
h
i
r
d
-
p
a
r
t
y
a
g
e
n
t
t
h
a
t
a
b
r
e
a
c
h
h
a
s
o
c
c
u
r
r
e
d
.
•
Any information provided to the Attorney General that is
marked as being confidential will not be subject to any
requests under the open records or freedom of
information laws.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
T
h
e
l
a
w
r
e
q
u
i
r
e
s
c
o
v
e
r
e
d
e
n
t
i
t
i
e
s
t
o
p
r
o
v
i
d
e
t
h
e
A
t
t
o
r
n
e
y
G
e
n
e
r
a
l
w
i
t
h
:
–
A summary of the events surrounding the breach;
–
The estimated number of Alabama residents impacted by the breach;
–
A list of any free services the entity is offering to individuals affected by
the breach along with instructions on how to use the services; and
–
The contact information of the designated employee from whom
additional information may be obtained about the breach.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
N
o
t
i
f
i
c
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
•
I
f
a
t
h
i
r
d
-
p
a
r
t
y
a
g
e
n
t
e
x
p
e
r
i
e
n
c
e
s
a
s
e
c
u
r
i
t
y
b
r
e
a
c
h
i
n
i
t
s
s
y
s
t
e
m
,
t
h
e
a
g
e
n
t
m
u
s
t
n
o
t
i
f
y
t
h
e
c
o
u
n
t
y
a
b
o
u
t
t
h
e
b
r
e
a
c
h
n
o
l
a
t
e
r
t
h
a
n
1
0
d
a
y
s
f
o
l
l
o
w
i
n
g
t
h
e
d
e
t
e
r
m
i
n
a
t
i
o
n
o
r
r
e
a
s
o
n
a
b
l
e
b
e
l
i
e
f
t
h
a
t
a
s
e
c
u
r
i
t
y
b
r
e
a
c
h
h
a
s
o
c
c
u
r
r
e
d
.
•
A
f
t
e
r
r
e
c
e
i
v
i
n
g
s
u
c
h
n
o
t
i
c
e
f
r
o
m
t
h
e
t
h
i
r
d
-
p
a
r
t
y
,
t
h
e
c
o
u
n
t
y
(
n
o
t
t
h
e
a
g
e
n
t
)
i
s
r
e
q
u
i
r
e
d
t
o
m
e
e
t
a
l
l
o
f
t
h
e
n
o
t
i
c
e
r
e
q
u
i
r
e
m
e
n
t
s
u
n
d
e
r
t
h
e
l
a
w
;
–
The agent must provide any information in its possession that will aid
the county in meeting the notice requirements.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
V
i
o
l
a
t
i
o
n
o
f
N
o
t
i
c
e
R
e
q
u
i
r
e
m
e
n
t
s
The Act prohibits the Attorney General from bringing civil
penalties against government entities for violations of the
notification provisions of this law.
T
h
e
l
a
w
d
o
e
s
a
u
t
h
o
r
i
z
e
t
h
e
A
t
t
o
r
n
e
y
G
e
n
e
r
a
l
t
o
b
r
i
n
g
a
n
a
c
t
i
o
n
a
g
a
i
n
s
t
a
n
y
s
t
a
t
e
,
c
o
u
n
t
y
o
r
c
i
t
y
o
f
f
i
c
i
a
l
o
r
e
m
p
l
o
y
e
e
i
n
h
i
s
o
r
h
e
r
o
f
f
i
c
i
a
l
c
a
p
a
c
i
t
y
t
o
a
c
c
o
m
p
l
i
s
h
a
n
y
o
f
t
h
e
f
o
l
l
o
w
i
n
g
:
•
Compel performance of his or her duties or ministerial acts under the law; or
•
Enjoin him or her from acting in bad faith or beyond his or her authority
under the law.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
V
i
o
l
a
t
i
o
n
o
f
N
o
t
i
c
e
R
e
q
u
i
r
e
m
e
n
t
s
•
The law requires the Attorney General to submit an annual
report to the Governor, Senate Pro Tem, and Speaker of
the House describing any reported security breaches of
governmental entities or their third-party agents.
•
T
h
e
r
e
p
o
r
t
m
u
s
t
i
d
e
n
t
i
f
y
a
n
y
g
o
v
e
r
n
m
e
n
t
e
n
t
i
t
y
t
h
a
t
v
i
o
l
a
t
e
d
A
N
Y
o
f
t
h
e
r
e
q
u
i
r
e
m
e
n
t
s
i
n
t
h
i
s
l
a
w
i
n
t
h
e
p
r
e
c
e
d
i
n
g
y
e
a
r
.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
V
i
o
l
a
t
i
o
n
o
f
N
o
t
i
c
e
R
e
q
u
i
r
e
m
e
n
t
s
•
Entities that are already subject to federal or state rules,
regulations, or guidelines that maintain procedures
regarding data breach and notification pursuant to those
requirements (i.e., financial institutions and healthcare
entities) are exempt from the requirements of this Act.
•
Such entities must still provide timely notice to the Attorney
General’s Office when the breach impacts 1,000 people or
more.
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
A
l
a
b
a
m
a
D
a
t
a
B
r
e
a
c
h
N
o
t
i
f
i
c
a
t
i
o
n
A
c
t
o
f
2
0
1
8
:
Q
U
E
S
T
I
O
N
S
w
w
w
.
a
l
a
b
a
m
a
c
o
u
n
t
i
e
s
.
o
r
g
Alabama's Data Breach Notification Act requires all county governments and related entities to comply with specific security measures to protect sensitive information of residents. The law mandates prompt investigation and notification in case of a breach, defining what constitutes a breach and sensitive personally identifying information. This overview provides essential details and requirements for counties to understand and implement the law effectively.
Uploaded on Sep 14, 2024 | 1 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Alabama Data Breach Notification Act: What County Governments Need to Know Morgan Arrington, General Counsel Association of County Commissions of Alabama www.alabamacounties.org
Overview of Law: Alabama recently became the 50th state to enact a data breach notification law. Act 2018-396 will go into effect on June 1, 2018 Includes several requirements that covered entities are expected to assess and implement in a very short time frame. www.alabamacounties.org
Overview of Law: Who needs to be in compliance with this law? All county governments; All departments of county government; All instrumentalities of the county; and All third-party agents of the county that maintain electronic records containing sensitive information about Alabama residents. www.alabamacounties.org
Overview of Law: While the nuances of the law are extensive, it includes three basic requirements: 1. Covered entities and their third-party service providers are required to implement and maintain reasonable security measures to protect sensitive information Covered entities must conduct a prompt investigation upon the discovery of a possible security breach. Covered entities must provide proper notification of a security breach to the following: a) impacted Alabama residents, b) the Alabama Attorney General s Office, and c) consumer reporting agencies. 2. 3. www.alabamacounties.org
Overview of Law: What is a breach of security ? The law defines it as the unauthorized acquisition of data in electronic form containing sensitive personally identifying information. The Act only applies to incidents involving 1) electronic records that 2) contain sensitive personally identifying information. www.alabamacounties.org
Overview of Law: What is considered sensitive personally identifying information ? Such sensitive is defined as an Alabama resident s first name or first initial and last name, in combination with any one of the following: A social security number or tax identification number; A driver s license number or any other unique, government-issued identification number used to verify identity; Any financial account number in combination with access information (i.e. a security code, expiration date, or PIN); www.alabamacounties.org
Overview of Law: Sensitive personally identifying information , continued: Any information regarding a person s medical, mental or physical history, condition or treatment; A person s health insurance policy number or subscriber identification number and unique identifier; A username or email address, in combination with a password or security question and answer. www.alabamacounties.org
QUESTION 1 DOES YOUR COUNTY HAVE ANY WRITTEN POLICIES OR PROCEDURES IN PLACE RELATED TO CYBERSECURITY? YES or NO www.alabamacounties.org
QUESTION 2 WHICH DEPARTMENT(S) MAINTAIN SENSITIVE PERSONALLY IDENTIFYING INFORMATION IN ELECTRONIC FORM? ___________________________ ______________________________________________ ______________________________________________ ______________________________________________ ______________________________________________ ______________________________________________ ______________________________________________ _____________________________________________ www.alabamacounties.org
Sensitive Personally Identifying Information SSN or TIN DL or other gov t ID # Financial account # + security code, expiration date, PIN, etc. Medical history, mental/physical condition, medical treatment or diagnosis Health insurance policy # or subscriber number + unique identifier User name or email + password or security question/answer Alabama resident s first name or first initial and last name www.alabamacounties.org
Reasonable Security Measures All covered entities must take measured action to prevent a data breach by implementing and maintaining reasonable security measures to protect all sensitive information in their possession. The law includes a number of requirements to help covered entities identify internal and external risks to sensitive information before a data breach ever takes place. www.alabamacounties.org
Reasonable Security Measures Counties must consider taking the following actions to ensure their security measures meet the reasonable standard in the law: 1. Designating an employee(s) to coordinate security measures to protect against a potential breach 2. Identifying internal and external risks of security breach 3. Adopting and regularly assessing information safeguards to address identified risks of security breach www.alabamacounties.org
Reasonable Security Measures Continued: 4. Retaining any service providers that are contractually obligated to maintain appropriate safeguards for sensitive information 5. Evaluating and adjusting security measures to account for changes that could affect the security of sensitive information 6. Keeping management informed on the overall status of the entities security measures. However, even with consideration of these factors, what actually constitutes reasonable security measures will vary from county to county. www.alabamacounties.org
Reasonable Security Measures Whether a covered entity has instituted reasonable security measures will be assessed as follows: 1) 2) the size of the county, the amount of sensitive personally identifying information on file with the county, and the county s use of the information, and the cost of implementing and maintaining reasonable security measures relative to the county s available resources. 3) as a whole with an emphasis on data security failures that are multiple or systemic www.alabamacounties.org
QUESTION 3 DOES YOUR COUNTY RETAIN ANY SERVICE PROVIDERS OR THIRD PARTY ENTITIES THAT MAINTAIN SENSITIVE INFORMATION ON COUNTY RESIDENTS? YES or NO IF YES, DOES THEIR CONTRACT REQUIRE THEM TO MAINTAIN SAFEGUARDS TO PROTECT SUCH INFORMATION? YES or NO www.alabamacounties.org
QUESTION 4 APPROXIMATELY HOW MANY PEOPLE DOES YOUR COUNTY EMPLOY? A. Less than 50 B. 51 to 100 C. 100 to 250 D. More than 250* *If more than 250, then how many?_________________ www.alabamacounties.org
QUESTION 5 WHAT IS THE ESTIMATED POPULATION OF YOUR COUNTY? A. 20,000 or less B. 20,001 to 49,999 C. 50,000 to 99,999 D. 100,000 to 199,999 E. Over 200,000 www.alabamacounties.org
QUESTION 6 HOW OFTEN IS THE COUNTY COMMISSION UPDATED ON THE COUNTY S DATA SECURITY PLANS/PROCEDURES? A. Never. B. Rarely, once each fiscal year. C. Sometimes, as the need arises or upon request. D. Regularly, at each commission meeting. E. Other (please specify) __________________________________________________ www.alabamacounties.org
Conducting a Prompt Investigation Even a county with the best-laid security plan could find itself at the center of a data breach. If a county determines that a breach of sensitive information has occurred, or is even likely to occur, the law requires it to conduct a good faith and prompt investigation of the matter. www.alabamacounties.org
Conducting a Prompt Investigation The investigation should include the following actions: An assessment of the nature and scope of the breach Identification of any sensitive information that may have been involved in the breach, and the identity of the persons to whom it relates A determination of whether the sensitive information has been, or is believed to have been, acquired by an unauthorized person, and is likely to cause harm to the individual to whom it relates Identification and implementation of measure to restore the security and confidentiality of the compromised systems. www.alabamacounties.org
QUESTION 7 DOES YOUR COUNTY CURRENTLY HAVE A DESIGNATED EMPLOYEE(S) TO HANDLE BREACHES OF SENSITIVE DATA? A. Yes, we have a designated employee to spearhead our response to a data breach. B. Yes, we have a designated department to spearhead our response to a data breach. C. No, we do not have a designated person or department to spearhead our response to a data breach. D. Other (please specify) ______________________________________________________ www.alabamacounties.org
QUESTION 8 DOES YOUR COUNTY HAVE A PROCEDURE IN PLACE FOR THE INVESTIGATION OF AN ACTUAL OR SUSPECTED DATA BREACH? YES or NO www.alabamacounties.org
Notification Requirements The notification component of the law is arguably the most important, and most cumbersome part of the law. The notification obligations under the law are triggered only when the investigation indicates that sensitive information has been (or is believed to have been) acquired by an unauthorized person and is likely to cause substantial harm to the individuals who the subject of the information. www.alabamacounties.org
Notification Requirements There is no standard in the law for determining if a breach is likely to cause substantial harm to the individuals who are the subject of the information. The law leaves it up to the covered entity to make a determination of whether notice is required. If a county determines that the notice requirement is not triggered, then it must document that determination in writing and maintain records related to the decision for at least five years. www.alabamacounties.org
Notification Requirements If the county s investigation indicates that that the notice requirements have been met, then all individuals affected by a data breach must be directly notified in writing as quickly as possible but no later than 45 days after making the determination that notice is required or receiving notice of from a third-party agent that a breach has occurred. www.alabamacounties.org
Notification Requirement The law requires the notification be sent to mailing address or email address the county has on file for the individual, and to include the following information: The date, or estimated date of the breach A description of the sensitive information that was acquired from the breach A general description of the actions taken by the county to restore the security and confidentiality of the personal information subject to the breach A general description of the steps affected individuals can take to protect themselves from identity theft Contact information for the county s point of contact related to the breach www.alabamacounties.org
Notification Requirement The law permits covered entities to give substitute notice in lieu of direct notice if at least one of the following circumstances are met: The cost of providing direct notice would exceed $500,000 or is an excessive amount relative to the resources of the covered entity; There is insufficient contact information for the individuals requiring notification; or Over 100,000 people were affected by the data breach. www.alabamacounties.org
Notification Requirement Substitute notice, when allowable,can be satisfied by placing it in a conspicuous location on county s website, if available, for 30 days or through print and broadcast media outlets. The law also provides that, with approval from the Attorney General s Office, alternative forms of substitute notice may be permitted. www.alabamacounties.org
QUESTION 9 BASED ON YOUR COUNTY S CURRENT RESOURCES, WHAT WOULD BE THE MOST EFFICIENT WAY TO NOTIFY RESIDENTS, IN THE EVENT OF AN ACTUAL OR SUSPECTED DATA BREACH? A. U.S. Mail B. Email C. Via the county website D. Local newspaper E. Other (please specify) ________________________________________________ www.alabamacounties.org
Notification Requirement If a data breach impacts more than 1,000 people, the law requires the county to notify the Attorney General no later than 45 days after making the determination that notice is required or receiving notice of from a third-party agent that a breach has occurred. Any information provided to the Attorney General that is marked as being confidential will not be subject to any requests under the open records or freedom of information laws. www.alabamacounties.org
Notification Requirement The law requires covered entities to provide the Attorney General with: A summary of the events surrounding the breach; The estimated number of Alabama residents impacted by the breach; A list of any free services the entity is offering to individuals affected by the breach along with instructions on how to use the services; and The contact information of the designated employee from whom additional information may be obtained about the breach. www.alabamacounties.org
Notification Requirement If a third-party agent experiences a security breach in its system, the agent must notify the county about the breach no later than 10 days following the determination or reasonable belief that a security breach has occurred. After receiving such notice from the third-party, the county (not the agent) is required to meet all of the notice requirements under the law; The agent must provide any information in its possession that will aid the county in meeting the notice requirements. www.alabamacounties.org
Violation of Notice Requirements The Act prohibits the Attorney General from bringing civil penalties against government entities for violations of the notification provisions of this law. The law does authorize the Attorney General to bring an action against any state, county or city official or employee in his or her official capacity to accomplish any of the following: Compel performance of his or her duties or ministerial acts under the law; or Enjoin him or her from acting in bad faith or beyond his or her authority under the law. www.alabamacounties.org
Violation of Notice Requirements The law requires the Attorney General to submit an annual report to the Governor, Senate Pro Tem, and Speaker of the House describing any reported security breaches of governmental entities or their third-party agents. The report must identify any government entity that violated ANY of the requirements in this law in the preceding year. www.alabamacounties.org
Violation of Notice Requirements Entities that are already subject to federal or state rules, regulations, or guidelines that maintain procedures regarding data breach and notification pursuant to those requirements (i.e., financial institutions and healthcare entities) are exempt from the requirements of this Act. Such entities must still provide timely notice to the Attorney General s Office when the breach impacts 1,000 people or more. www.alabamacounties.org
Alabama Data Breach Notification Act of 2018: QUESTIONS QUESTIONS www.alabamacounties.org
