The following is not meant to be legal advice.
Under the
Personal information under the Act includes any information that can be associated with an individual. A name, address, or telephone number alone constitutes personal information.
A breach of the security of the system includes unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. The following factors should be considered in determining whether information has been compromised:
(i) indications that the information is in the physical possession and control of an unauthorized person, such as a lost or stolen computer;
(ii) indications that the information has been downloaded or copied; and
(iii) indications that the information was used by an unauthorized person, such as fraudulent accounts opened or identity theft reported.
Under the Act, businesses must disclose breaches to affected persons without unreasonable delay such within ten days of the discovery of the breach.
Comment Preview