Tennessee Updates Breach Notification Law
The state of Tennessee recently passed a bill - S.B. 2005 - that was signed into law by Governor Haslam that makes some important precedent-setting changes to information breach laws in that state. This may influence similar changes in other states' breach notification laws moving forward.
S.B. 2005 makes three important changes to the existing breach notification statute:
The definition of "unauthorized person" is clarified to be inclusive of employee misuse
The previous statute required notification of a breach to be made in "the most expedient time possible and without unreasonable delay."[1]. The revised statute now imposes a window of 14 days from the company's discovery (or notification by an outside party) of a breach to issue the required notification. Both the original and the revised statute provide provisions for delayed notification at the behest of law enforcement.
Most significantly, the revision removes safe harbor for the loss of encrypted data. The revised statute now reads: "'Breach of the security of the system' means unauthorized acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information..."
At first glance, that third point seems like a disastrous move. The best and most sensible protection any information holder can and should make to protect that data is to use encryption. The loss of a laptop, for instance, wouldn't result in the 'breach of the security of the system' if the laptop were encrypted at rest.
The sky is not falling, however. There's a key phrase in that definition: "materially compromises". The loss of a laptop does not represent the material compromise of data security because whomever recovers it would be unable to access the data in a meaningful way.
So why remove the word "unencrypted" from the definition of a breach? What this does is it closes a loophole for improperly or insufficiently encrypted data.
Here's a couple scenarios to consider.
First, let's stick with that encrypted laptop that someone either had stolen from their car. It's encrypted, so we're good, right? Well, what if it turns out that this employee had his boot password written on a sticky note on the bottom? The data lost is encrypted, yes, but the thief has the password so the data is definitely "materially compromised." The company should, in this instance, need to disclose the breach to the impacted persons.
Second, let's consider the loss of a username and password database. If the passwords are stored using unsalted MD5, then strictly speaking the data is encrypted. Any security specialist in the world would point out that MD5 should not be used any circumstance in 2016, though, because it provides virtually no data security. This loss constitutes a "material compromise" of the security of any personal information contained within those accounts. The company should not be expected to disclose the breach to those impacted persons.
Breach notification law is a rapidly shifting field with a lot of impact on how businesses need to view data security. Despite what may look like the withdrawal of protections for the loss of encrypted data, encrypting data at rest is still an extremely important protection for businesses against legal and reputational consequences in the event of data loss.
[1]Tennessee Code Annotated §47-18-2701
Photo credit: Tony Webster
