Delaware Code Title 6 § 12B-100 et seq
Enacted: 8.17.2017 (Effective 4.14.2018)
Type of Data Covered: Computerized or electronic data.
Is Breach Defined?
Yes! §12B-101 stipulates that a "breach of security" refers to "The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. Good faith acquisition of personal information by an employee or agent of any person for the purposes of such person is not a breach of security, provided that the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure." See §12B-101(1)(a). §12B-101(1)(b) was added to the new statute to deal with situations where information is encrypted but the encryption key has also been compromised.
When is notice required?
Notice is required for any Delaware resident who had their information compromised in the breach. Residents are required to be notified "without unreasonable delay but not later than 60 days after determination of the breach of security..." See §12B-102(c). There are exceptions, for instance if there is a pending law enforcement investigation or if federal law requires a shorter time frame. If over 500 Delaware residents are to be notified, then the notification must also go to the Attorney General. See §12B-102(d). While there is nothing in the statute about the contents of the notification §12B-102(e) requires credit reporting services be provided for all residents for one year if the breach involves a Social Security number.
What are the penalties for non-compliance?
Violations have their own section of the law, §12B-104, which reads as follows:
"(a) Pursuant to the enforcement duties and powers of the Director of Consumer Protection of the Department of Justice under Chapter 25 of Title 29, the Attorney General may bring an action in law or equity to address the violations of this chapter and for other relief that may be appropriate to ensure proper compliance with this chapter or to recover direct economic damages resulting from a violation, or both. The provisions of this chapter are not exclusive and do not relieve a person subject to this chapter from compliance with all other applicable provisions of law.
(b) Nothing in this chapter may be construed to modify any right which a person may have at common law, by statute, or otherwise."