The South Dakota legislature recently amended its laws to address identity theft, effective July 1, 2018.
"Breach of system security" means the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder. The term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the information holder if the personal or protected information is not used or subject to further unauthorized disclosure.
"Encrypted" means computerized data that is rendered unusable, unreadable, or indecipherable without the use of a decryption process or key or in accordance with the Federal Information Processing Standard 140-2 in effect on January 1, 2018.
"Information holder" means any person or business that conducts business in South Dakota, and that owns or licenses computerized personal or protected information of residents of South Dakota.
"Personal information" means a person's first name or first initial and last name, in combination with any one or more of the following data elements:
Personal information does not include information that is lawfully made available to the general public from federal, state, or local government records or information that has been redacted, or otherwise made unusable.
"Protected information," includes:
"Unauthorized person" means any person not authorized to acquire or disclose personal information, or any person authorized by the information holder to access personal information who has acquired or disclosed the personal information outside the guidelines for access of disclosure established by the information holder.
Following the discovery by or notification to an information holder of a breach of system security an information holder must disclose as required the breach of system security to any resident of South Dakota whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person. Such disclosure must be made not later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement. An information holder is not required to make a disclosure if, following an appropriate investigation and notice to the South Dakota Attorney General, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder must document the determination in writing and maintain the documentation for not less than three years.
Any information holder that experiences a breach of system security must disclose to the South Dakota Attorney General by mail or electronic mail any breach of system security that exceeds two hundred fifty residents of South Dakota.
The required notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. If the notification is delayed, the notification must be made not later than thirty days after the law enforcement agency determines that notification will not compromise the criminal investigation.
The required disclosure may be provided by:
If an information holder maintains its own notification procedure as part of an information security policy for the treatment of personal or protected information and the policy is otherwise consistent with the timing requirements, the information holder is in compliance with the notification requirements if the information holder notifies each person in accordance with the information holder's policies in the event of a breach of system security.
If an information holder discovers circumstances that require notification the information holder must also notify, without unreasonable delay, all consumer reporting agencies, as defined by federal law in effect as of January 1, 2018, and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice.
The South Dakota Attorney General may prosecute each failure to disclose a breach of system security as a deceptive act or practice under South Dakota law. In addition to any remedy provided by South Dakota law, the attorney general may bring an action to recover on behalf of the state a civil penalty of not more than $10,000 per day per violation. The South Dakota Attorney General may recover attorney's fees and any costs associated with any action brought related to identity theft.
Notwithstanding any other provisions, any information holder that is regulated by federal law or regulation, including the federal Health Insurance Portability and Accountability Act of 1996 or the federal Gramm Leach Bliley Act and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator is deemed to be in compliance with South Dakota law if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.
Learn more about the Goals Module and its key monitoring and reporting features.
Learn about the changes of state consumer protection and the responsibility of financial services institutions to pursue operational excellence and a culture of compliance.
Regulatory and technology experts discuss innovation, CRA reforms, and how single-close construction loans are reenergizing rural America.
