Most small businesses don't think about breach notification law until they're in the middle of an incident. That's the worst time to learn it, because the clock may already be running.
In Arizona, the rules are in A.R.S. 18-551 and 18-552. They apply to any business that operates in Arizona and keeps personal information about people on computers. Here's what the law requires, in plain English.
What counts as personal information
The law covers a person's first name or first initial and last name, combined with any of these:
- Social Security number
- Arizona driver license or state ID number
- Financial account or credit card number, along with the code or password needed to use it
- Health insurance ID number
- Information about medical or mental health treatment or diagnosis by a health care professional
- Passport number
- Taxpayer ID number or IRS identity protection PIN
- A private key used to sign electronic records
- Biometric data used to log in to an online account
It also covers a username or email address together with a password or security question that opens an online account. That one surprises people. If someone steals the logins your business keeps for customers, the law can apply even if no Social Security numbers were involved.
Two important limits. The law only covers computerized data that is unencrypted and unredacted. Redacted means no more than the last four digits are visible, with at least two digits removed. And it doesn't cover information that's publicly available from government records.
What counts as a breach
A breach is unauthorized access to and acquisition of that personal information in a way that materially compromises its security or confidentiality. An employee who looks at records in good faith for a work purpose hasn't caused a breach, as long as the information isn't misused or disclosed further.
Step 1: Investigate promptly
Once you become aware of a security incident, the law says you must promptly investigate to determine whether a breach happened. In practice, that means:
- Don't wipe or rebuild the affected computers yet. They hold the evidence.
- Call your IT provider to contain the problem and preserve logs.
- If you have cyber insurance, call the claims line early. Many policies expect you to use their approved breach attorneys and forensic firms, and going around them can affect coverage.
Step 2: Notify affected people within 45 days
If you determine a breach happened, you have 45 days to notify the affected individuals. The notice must include:
- The approximate date of the breach
- A brief description of the personal information involved
- The toll-free numbers and addresses of the three major credit bureaus
- The toll-free number, address and website of the Federal Trade Commission
You can send it by letter, by email if you have the person's email address, or by phone, as long as you reach the person directly and it isn't a prerecorded message.
If notice would cost more than $50,000, would go to more than 100,000 people, or you don't have enough contact information, the law allows substitute notice. That means a letter to the attorney general plus a prominent notice on your website for at least 45 days.
If law enforcement tells you that notifying people would interfere with a criminal investigation, you can wait. The 45 days start once they tell you it no longer would.
When the only thing exposed was online login credentials, you can satisfy the law by telling people to change their password and security question, and to do the same anywhere else they use the same login.
Step 3: Over 1,000 people? Tell the state and the credit bureaus
If the breach requires notifying more than 1,000 people, you also have to notify:
- Equifax, Experian and TransUnion
- The Arizona attorney general and the director of the Arizona Department of Homeland Security, in writing
These notices are due within the same 45 days. The attorney general's office has an online form for this, and the law also lets you send each agency a copy of the notice you sent to individuals.
When notice isn't required
You don't have to notify people if you, an independent forensic auditor or law enforcement determine, after a reasonable investigation, that the breach hasn't caused and isn't reasonably likely to cause substantial economic loss to the people affected.
That's a judgment call with real consequences. Document the investigation carefully, and make the decision with a breach attorney rather than on your own.
Businesses that follow federal rules instead
The Arizona law doesn't apply to two big groups. Both follow federal rules with their own deadlines.
Financial companies covered by the Gramm-Leach-Bliley Act. That includes mortgage lenders and brokers, financial advisors, tax preparers and many other financial businesses. Non-bank companies follow the FTC Safeguards Rule, which requires notifying the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted information about at least 500 consumers is acquired without authorization. SEC-registered advisors follow Regulation S-P, which requires notifying affected customers within 30 days. Banks and credit unions have their own regulators' rules, some requiring notice to the regulator within 36 hours.
HIPAA covered entities and their business associates. Medical and dental practices follow the HIPAA Breach Notification Rule. Patients must be notified without unreasonable delay and no later than 60 days after the breach is discovered. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and if more than 500 residents of one state are affected, to prominent media there too. Smaller breaches are reported to HHS once a year.
And if you have customers who live in other states, those states' breach laws apply to them too. Every state has one, and the deadlines differ.
Penalties
Only the Arizona attorney general can enforce this law. A knowing and willful violation is treated as consumer fraud. The civil penalty can reach $10,000 per affected person or the total economic loss, whichever is less, up to $500,000 for a breach or a series of related breaches. The attorney general can also seek restitution for the people affected.
How to get ready before anything happens
Most of the work is easier to do now than in the middle of an incident:
- Encrypt laptops and phones. The law only covers unencrypted data, so a stolen encrypted laptop is usually an inconvenience instead of a notification event, as long as the password or key wasn't taken with it.
- Turn on multi-factor authentication for email and remote access. Stolen logins are one of the most common ways attackers get in.
- Know where personal information lives. Delete what you don't need. Data you no longer keep can't be breached.
- Write a one-page incident plan. List who to call first: your IT provider, your insurer and an attorney. Include where your customer contact list lives, because you'll need it to send notices.
- Check your cyber insurance. Confirm it covers forensic investigation, legal help and notification costs. Answering the insurance questionnaire accurately matters too, because it affects whether a claim gets paid.
How we help
We help Phoenix-area businesses protect the data these laws cover, with encryption, multi-factor authentication and 24/7 security monitoring. If something does happen, we work with you, your insurer and your attorney to contain it, preserve the evidence and figure out what was exposed.
This article is a plain-English summary of A.R.S. 18-551 and 18-552, not legal advice. Your attorney can tell you how the law applies to your situation.