Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-3888 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/04/Wyoming-iStock_000003505950_Full-300x239.jpg" alt="Wyoming iStock_000003505950_Full" width="300" height="239" />Wyoming recently joined the list of states passing laws that broaden the scope of their data breach notification laws. On March 2, 2015, Wyoming signed into law two bills (<a href="http://legisweb.state.wy.us/2015/Enroll/SF0035.pdf">S.F. 35</a> and <a href="http://legisweb.state.wy.us/2015/Enroll/SF0036.pdf">S.F. 36</a>) that expand the definition of personally identifiable information (PII) and require additional minimum content requirements for notifications to affected individuals. Specifically, S.F. 36 broadens the scope of the definition of PII to include data containing the first name or first initial and last name of a person in combination with one or more of the following new data elements:
<ul>
	<li>Bank account number or credit or debit card number in combination with any security code that would allow access to a financial account;</li>
	<li>Shared secrets or security tokens that are known to be used for data-based authentication;</li>
	<li>Username or email address in combination with a password or security questions and answer;</li>
	<li>Birth or marriage certificate;</li>
	<li>Medical information, defined as a person’s medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional;</li>
	<li>Health insurance information, defined as a person’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the person or information related to a person’s application, and claims history; and</li>
	<li>Unique biometric data used for authentication purposes.</li>
</ul>
Wyoming’s expansion of the definition of personal information to include usernames and passwords to online accounts follows a recent trend began by California in 2014. Florida and Puerto Rico have made similar amendments to their respective breach notification laws.

The second bill (S.F. 35) requires that notices to affected individuals “be clear and conspicuous” and include, at a minimum:
<ul>
	<li>The types of PII reasonably believed affected;</li>
	<li>A general description of the incident;</li>
	<li>The approximate date of the breach;</li>
	<li>The general actions taken by the company to prevent further breaches; and</li>
	<li>Advice directing affected persons to remain vigilant by reviewing account statements and credit monitoring reports.</li>
</ul>
S.F. 35 also adds that entities subject to, and who comply with, the Health Insurance Portability and Accountability Act are considered to be in compliance with the Wyoming breach notification statute if those entities notify Wyoming residents according to the requirements of the act.

The most significant aspect of Wyoming’s amendments is that companies will be obligated to notify affected individuals in a broader range of circumstances. The amendments to the Wyoming law go into effect July 1, 2015.

Given the increasing frequency of data breaches, state legislators and attorneys general wanting to appear tough on cybercrime are likely to continue pressing, without significant opposition, for more stringent data breach notification laws. Therefore, companies should expect to continue to see expansion of state data breach notification laws in 2015.

Wyoming Broadens Data Breach Notification Law