For purposes of this subchapter, the term:
(1) "Breach of the security of the system" means unauthorized acquisition of computerized or other electronic data, or any equipment or device storing such data, that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. The term "breach of the security system" shall not include a good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business if the personal information is not used improperly or subject to further unauthorized disclosure. Acquisition of data that has been rendered secure, so as to be unusable by an unauthorized third party, shall not be deemed to be a breach of the security of the system.
(2) "Notify" or "notification" means providing information through any of the following methods:
(A) Written notice;
(B) Electronic notice, if the customer has consented to receipt of electronic notice consistent with the provisions regarding electronic records and signatures set forth in the Electronic Signatures in Global and National Commerce Act, approved June 30, 2000 (114 Stat. 641; 15 U.S.C.S. § 7001); or
(C)(i) Substitute notice, if the person or business demonstrates that the cost of providing notice to persons subject to this subchapter would exceed $50,000, that the number of persons to receive notice under this subchapter exceeds 100,000, or that the person or business does not have sufficient contact information.
(ii) Substitute notice shall consist of all of the following:
(I) E-mail notice when the person or business has an e-mail address for the subject persons;
(II) Conspicuous posting of the notice on the website page of the person or business if the person or business maintains one; and
(III) Notice to major local and, if applicable, national media.
(3)(A) "Personal information" means:
(i) An individual's first name or first initial and last name, or phone number, or address, and any one or more of the following data elements:
(I) Social security number;
(II) Driver's license number or District of Columbia Identification Card number; or
(III) Credit card number or debit card number; or
(ii) Any other number or code or combination of numbers or codes, such as account number, security code, access code, or password, that allows access to or use of an individual's financial or credit account.
(B) For purposes of this paragraph, the term "personal information" shall not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(Mar. 8, 2007, D.C. Law 16-237, § 2(c), 54 DCR 393.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
Law 16-237, the "Consumer Personal Information Security Breach Notification Act of 2006", was introduced in Council and assigned Bill No. 16-810, which was referred to Committee on Consumer and Regulatory Affairs. The Bill was adopted on first and second readings on November 14, 2006, and December 5, 2006, respectively. Signed by the Mayor on December 28 2006, it was assigned Act No. 16-593 and transmitted to both Houses of Congress for its review. D.C. Law 16- 237 became effective on March 8, 2007.
Miscellaneous Notes
Section 3 of D.C. Law 16-237 provided: "This act shall apply as of July 1, 2007."
(a) Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach. The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (d) of this section, and with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b) Any person or entity who maintains, handles, or otherwise possesses computerized or other electronic data that includes personal information that the person or entity does not own shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery.
(c) If any person or entity is required by subsection (a) or (b) of this section to notify more than 1,000 persons of a breach of security pursuant to this subsection, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by section 603(p) of the Fair Credit Reporting Act, approved October 26, 1970 (84 Stat. 1128; 15 U.S.C. § 1681a(p)), of the timing, distribution and content of the notices. Nothing in this subsection shall be construed to require the person to provide to the consumer reporting agency the names or other personal identifying information of breach notice recipients. This subsection shall not apply to a person or entity who is required to notify consumer reporting agencies of a breach pursuant to Title V of the Gramm-Leach-Bliley Act, approved November 12, 1999 (113 Stat. 1436; 15 U.S.C § 6801 et seq).
(d) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation but shall be made as soon as possible after the law enforcement agency determines that the notification will not compromise the investigation.
(e) Notwithstanding subsection (a) of this section, a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this subchapter shall be deemed to be in compliance with the notification requirements of this section if the person or business provides notice, in accordance with its policies, reasonably calculated to give actual notice to persons to whom notice is otherwise required to be given under this subchapter. Notice under this section may be given by electronic mail if the person or entity's primary method of communication with the resident is by electronic means.
(f) A waiver of any provision of this subchapter shall be void and unenforceable.
(g) A person or entity who maintains procedures for a breach notification system under Title V of the Gramm-Leach -Bliley Act, approved November 12, 1999 (113 Stat. 1436; 15 U.S.C § 6801 et seq.) ("Act"), and provides notice in accordance with the Act, and any rules, regulations, guidance and guidelines thereto, to each affected resident in the event of a breach, shall be deemed to be in compliance with this section.
(Mar. 8, 2007, D.C. Law 16-237, § 2(c), 54 DCR 393.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
For Law 16-237, see notes following § 28-3851.
(a) Any District of Columbia resident injured by a violation of this subchapter may institute a civil action to recover actual damages, the costs of the action, and reasonable attorney's fees. Actual damages shall not include dignitary damages, including pain and suffering.
(b) The Attorney General may petition the Superior Court of the District of Columbia for temporary or permanent injunctive relief and for an award of restitution for property lost or damages suffered by District of Columbia residents as a consequence of the violation of this subchapter. In an action under this subsection, the Attorney General may recover a civil penalty not to exceed $100 for each violation, the costs of the action, and reasonable attorney's fees. Each failure to provide a District of Columbia resident with notification in accordance with this section shall constitute a separate violation.
(c) The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law.
(Mar. 8, 2007, D.C. Law 16-237, § 2(c), 54 DCR 393.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
For Law 16-237, see notes following § 28-3851.
