or

(2) a user name or email address, in combination with a password or Social Security question and answer that would permit access to an online account.

If the breach only involved the credentials for an online account, the company should send password-reset credentials. It should not email the notice to the breached email account.

The notice must be “written in plain language” and be titled “Notice of Data Breach.”

The notice must contain: (1) name and contact information of company; (2) list of categories of personal information compromised; (3) if possible, the date or estimated date or ranges of the breach; (4) date of notice; (5) whether notice was delayed due to law enforcement investigation, if possible; (6) general description of the data breach, if possible; (7) toll-free phone numbers and addresses of major credit reporting agencies, and an offer for 12 months of free identity theft prevention and mitigation services, if Social Security or ID card number was exposed.

Companies also may choose to provide information about what they have done to protect consumers from harm arising from the breach and advice on how the consumers may take steps to protect themselves.

This notice should be presented under the following headings: “What Happened,” “What Information Was Involved,” “What We are Doing,” “What You Can Do,” and “For More Information.”

Companies must provide “appropriate identity theft protection services, and, if applicable, identity theft mitigation services” for at least twelve months.

or

(2) any other number or code or combination of numbers or codes that allows access to or use of a financial or credit account.

Separately, Florida's notification law covers a user name or email address, in combination with a password or security question and answer that would permit access to an online account. The notification requirement applies even if the individual's name is not disclosed.

Notices to individuals must include the date, estimated date, or date range of the breach, a description of the personal information at issue in the breach, and contact information for the company.

Third-party agents that suffer a data breach must notify the company whose customers' information is breached within ten days of the breach. When the company receives a notice from a third-party agent, the company should provide the required individual notices.

Companies must provide written notice to credit reporting agencies if more than 1000 Florida residents' personal information is compromised.

The statute defines “personal information” as an individual's first name or first initial and last name in combination with at least one of the following: (1) Social Security number; (2) driver's license or state ID card number; (3) financial account number or credit card or debit card number, along with any required access codes or passwords; (4) account passwords or personal ID numbers or other access codes; or (5) any of the previous for items when not in connection with individual's name if the information would be sufficient to conduct identity theft.

Notice must describe the incident in general terms, along with the type of personal information that was breached, the steps the company took to prevent further access, a telephone number for more information, and advice to “remain vigilant by reviewing financial account records and monitoring free credit reports.”

The notice must include toll-free phone numbers for the credit reporting agencies, toll-free phone number, address, and web address for the FTC, and a statement that these sources can provide information about fraud alerts and credit freezes. The notice must not include the number of Illinois residents whose data was compromised.

Notices must contain a description of the breach, the approximate date of the breach, the type of personal information breached, contact information for consumer reporting agencies, and advice to the consumer to report suspected identity theft to local law enforcement or the Iowa Attorney General.

Notices must contain descriptions of the types of data breached, the company's contact information, the toll-free phone numbers and addresses for the credit reporting agencies, the toll-free telephone number, addresses, and websites for the FTC and Maryland Attorney General, and a statement that individuals can obtain information about identity theft from these sources.

The statute does not have the standard risk-of-harm exception. Instead, it requires notification if a company “(1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose.”

The notice must include the consumer's right to obtain a police report, instructions to request a security freeze, including fees paid to consumer reporting agencies. The notice must not describe the nature of the breach or the number of Massachusetts residents affected.

Notices must be written in a “clear and conspicuous manner,” describe the breach in general terms, describe the type of personal information that is the subject of the unauthorized access or use, if applicable, describe remediation steps to prevent further breaches, include phone number for additional information, and remind recipients of the need to remain vigilant for identity theft and fraud.

The notice should contain a description of the incident “in general terms,” the type of personal information obtained, a phone number for further information and assistance, if one exists, contact information for consumer reporting agencies, and advice that the consumer should “remain vigilant by reviewing account statements and monitoring free credit reports.”

or

(b) a user name or email address, along with the password or security question that allows access to an online user account.

If the company has ten or fewer employees and the cost of notice would exceed $10,000, substitute notice consists of (1) email to known addresses; (2) notification by a paid advertisement in a local newspaper in the geographic area in which the company is located, provided that the ad covers at least a quarter of a page in the newspaper and is published at least once a week for three consecutive weeks; (3) conspicuous posting on the company's website; and (4) notification to major media outlets in the geographic area in which the company is located.

The notice must include a description of the incident “in general terms,” the approximate date of the breach, the type of personal information obtained due to the breach, and the telephone contact information for the company.

If more than 1000 New Hampshire residents are notified for one incident, the company must notify the major consumer reporting agencies of the time the notification was distributed and the content of the notification. (Companies subject to GLBA need not notify credit bureaus.)

The notice must include contact information for the company, and a description of the categories of information believed to have been acquired.

If more than 5000 New York residents are notified at one time, the company must notify the consumer reporting agencies of the timing, content, and distribution of the notices and approximate number of New York residents affected.

The notice must contain a description of the incident “in general terms,” a description of the categories of personal information that were subject to unauthorized access, a description of the steps the business took to prevent further unauthorized access, a phone number for further information and assistance, advice to “remain vigilant by reviewing account statements and monitoring free credit reports,” toll-free numbers and addresses for the major consumer reporting agencies, and toll-free numbers, addresses, and website addresses for the FTC and North Carolina Attorney General's office, along with a statement that the individual “can obtain information from these sources about preventing identity theft.”

If a company notifies more than 1000 North Carolina residents at once, the company must notify the consumer reporting agencies of the timing, distribution, and content of the individual notices.

Separately, Ohio allows a separate form of substitute notice if the company has ten or fewer employees and the cost of notice would exceed $10,000. In this case, the substitute notice must include (1) notice by a paid advertisement in a local newspaper that is distributed in the area in which the company is located, with the advertisement covering at least one-quarter of a page and published at least weekly for three consecutive weeks; (2) conspicuous posting of the notice on the company's website; and (3) notice to major media outlets in the company's geographic area.

Notice must contain a description of the data breach “in general terms,” the approximate date of the breach, the type of personal information that was subject to the breach, contact information for the company that was subject to the breach, contact information for credit bureaus, and advice to report suspected identity theft to law enforcement, including the Attorney General and the Federal Trade Commission.

The individual notices should contain (1) a “general and brief description” of the breach, including how it occurred and the number of affected individuals; (2) the type of information that was breached; (3) date (or estimated date) of the breach; (4) date of discovery of the breach; (5) description of remediation services, including toll-free phone numbers and websites for credit reporting agencies, remediation service providers, and the Rhode Island Attorney General; and (6) a “clear and concise” description of the consumer's ability to file or obtain a police report regarding the data breach, how the individual can request a security freeze on financial accounts, and the fees that consumers may be required to pay to credit bureaus for these remedies.

Note that Tennessee is the only jurisdiction that does not exempt encrypted information from its breach notification law. However, a company would have a strong argument that encryption eliminates the possibility that the breach “materially” compromised the security, confidentiality, or integrity of the information.

or

information that identifies an individual and relates to (1) the physical or mental health or condition of the individual; (2) the provision of health care to the individual; or (3) payment for the provision of healthcare to the individual.

Some commentators have suggested that the Texas statute could be read to suggest that it requires companies to provide notice even if the individuals do not live in Texas, though no court has ruled on this issue.

Individual notices must contain (1) a description of the breach; (2) the type of personal information that was breached; (3) the steps that the company took to protect against further unauthorized access; (4) a toll-free number for more information; (5) advice to “remain vigilant” by reviewing account statements and free credit reports; and (6) date of the breach.

Vermont requires two forms of notice to state regulators.

First, the Vermont Attorney General or Department of Financial Regulation must be notified of the dates of the breach and discovery, along with a preliminary description, within fourteen business days, consistent with the needs of law enforcement. Companies must notify state regulators no later than when they notify consumers. In other words, if a company notifies consumers seven days after discovering a breach, it must notify Vermont regulators at the same time that it notifies consumers, even though the fourteen-day period has not elapsed. If, before the breach occurs, the company swears in writing to the Attorney General that it maintains written security policies and procedures and responds to breaches in a manner consistent with Vermont law, they need only notify state regulators of the date of the breach and discovery of the breach before they notify individuals.

Second, when companies notify Vermont residents of data breaches, they also must provide Vermont regulators with a copy of the individual notice and the number of Vermont residents who were notified.

If more than 1000 consumers are notified, the company shall notify credit bureaus, without unreasonable delay, of the timing, distribution, and content of the notice.

Notice must describe: (1) the incident “in general terms”; (2) the categories of personal information subject to the breach: (3) the general steps taken to protect the information from further unauthorized access; (4) a phone number for more information, if one exists; and (5) advice to remain vigilant by reviewing account statements and free credit reports.

Notices must be written in plain language and include (1) name and contact information of the company, a list of the categories of personal information at issue, and toll-free telephone numbers of the major credit reporting agencies if personal information was exposed.

The individual notice should indicate that the company knows of a breach of personal information pertaining to the individual

Individual notices must contain, at minimum, (1) a toll-free phone number to contact the company and learn the contact information for major credit bureaus; (2) the types of personal information that were reasonably believed to have been breached; (3) a general description of the breach; (4) the approximate date of the breach, if determinable; (5) the steps taken by the company to prevent further harm; (6) advice to remain vigilant by reviewing account statements and monitoring credit reports; and (7) whether notification was delayed due to a law enforcement investigation, if that is possible to determine at the time of the notice.