Washington Expands Data Breach Laws Surrounding Notifications

Data breach laws can vary from state to state in terms of notification. For years some states did not even have laws in place that required companies to inform victims if their data had been compromised in a breach. Laws vary depending on not only the location of the company that was breached, but also the location of the victims.

Washington state has had data breach laws in place for years, but those laws had a somewhat limited scope. Currently in Washington, if certain pieces of data – like your Social Security number – are not impacted in a breach, the company does not have to offer protection service or notify victims of the incident.

A new bill in Washington would expand the definition for sensitive data to include things like your birthdate, health insurance number, student ID or military ID number and more. This essentially broadens the terms of what can trigger a required notification.

The need for this change grew out of the increase in data breaches and the growing numbers of residents whose identifying information was compromised in data breaches. More than 3 million residents of that state had their data accidentally or intentionally attacked in a one-year period from July 2017 to June 2018. With breach on the rise, Washington is taking action with their data breach laws.

This new bill would not only broaden the types of personal data that are covered, but also reduce the length of time that a company has to report the breach. The current notification law gave the affected businesses 45 days to notify the state’s attorney general of a data breach, and this new bill would reduce that to 30 days. The difference of those two weeks can make an enormous impact in minimizing the damage of victims.

Of course, laws such as this one can be seen as a double-edged sword. Supporters, security experts and consumer advocates understand that there are many different kinds of identity theft, and that serious harm can result even without stealing someone’s Social Security number. However, critics view it through the eyes of the organizations and businesses, and how it may hurt them in the event of a data breach. It is important to remember that businesses who collect and store consumers’ personally identifiable information have an obligation to protect it. If they fail in that regard, then they should have to offer information and support to the customers who were affected.

The Identity Theft Resource Center and Futurion have partnered and launched a tool called Breach Clarity, which takes publicly-available data breach information and breaks down both the threat and that actionable steps for consumers.

Watch Our New Free Webinar: Deciphering the Code of Data Breach Notifications

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: What To Know About Payment Apps and Security