EdLaw
Alaska Personal Information Protection Act (AS 45.48) — breach of security, disposal of records
Alaska's breach-of-security article in full: the covered person's duty to disclose a breach to each state resident, delay for law enforcement, methods of notice, notice to consumer credit reporting agencies, the information recipient's duty to notify the information distributor, violations and definitions; the disposal-of-records article (reasonable measures, due diligence on a record-destruction contractor, written policy); and the chapter definitions and short title.
AS 45.48.010. Disclosure of breach of security
- (a) If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.
- (b) An information collector shall make the disclosure required by (a) of this section in the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.
- (c) Notwithstanding (a) of this section, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. The determination shall be documented in writing, and the documentation shall be maintained for five years. The notification required by this subsection may not be considered a public record open to inspection by the public.
AS 45.48.020. Allowable delay in notification
An information collector may delay disclosing the breach under AS 45.48.010 if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation. However, the information collector shall disclose the breach to the state resident in the most expeditious time possible and without unreasonable delay after the law enforcement agency informs the information collector in writing that disclosure of the breach will no longer interfere with the investigation.
AS 45.48.030. Methods of notice
An information collector shall make the disclosure required by AS 45.48.010
- (1) by a written document sent to the most recent address the information collector has for the state resident;
- (2) by electronic means if the information collector's primary method of communication with the state resident is by electronic means or if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic Signatures in Global and National Commerce Act); or
- (3) if the information collector demonstrates that the cost of providing notice would exceed $150,000, that the affected class of state residents to be notified exceeds 300,000, or that the information collector does not have sufficient contact information to provide notice, by
- (A) electronic mail if the information collector has an electronic mail address for the state resident;
- (B) conspicuously posting the disclosure on the Internet website of the information collector if the information collector maintains an Internet website; and
- (C) providing a notice to major statewide media.
AS 45.48.040. Notification of certain other agencies
- (a) If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis and provide the agencies with the timing, distribution, and content of the notices to state residents.
- (b) This section may not be construed to require the information collector to provide the consumer reporting agencies identified under (a) of this section with the names or other personal information of the state residents whose personal information was subject to the breach.
- (c) This section does not apply to an information collector who is subject to the Gramm-Leach-Bliley Financial Modernization Act.
- (d) In this section, “consumer credit reporting agency that compiles and maintains files on consumers on a nationwide basis” has the meaning given to “consumer reporting agency that compiles and maintains files on consumers on a nationwide basis” in 15 U.S.C. 1681a(p).
AS 45.48.050. Exception for employees and agents
In AS 45.48.010 — 45.48.090, the good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose of the information collector is not a breach of the security of the information system if the employee or agent does not use the personal information for a purpose unrelated to a legitimate purpose of the information collector and does not make further unauthorized disclosure of the personal information.
AS 45.48.060. Waivers
A waiver of AS 45.48.010 — 45.48.090 is void and unenforceable.
AS 45.48.070. Treatment of certain breaches
- (a) If a breach of the security of the information system containing personal information on a state resident that is maintained by an information recipient occurs, the information recipient is not required to comply with AS 45.48.010 — 45.48.030. However, immediately after the information recipient discovers the breach, the information recipient shall notify the information distributor who owns the personal information or who licensed the use of the personal information to the information recipient about the breach and cooperate with the information distributor as necessary to allow the information distributor to comply with (b) of this section. In this subsection, “cooperate” means sharing with the information distributor information relevant to the breach, except for confidential business information or trade secrets.
- (b) If an information recipient notifies an information distributor of a breach under (a) of this section, the information distributor shall comply with AS 45.48.010 — 45.48.030 as if the breach occurred to the information system maintained by the information distributor.
AS 45.48.080. Violations
- (a) If an information collector who is a governmental agency violates AS 45.48.010 — 45.48.090 with regard to the personal information of a state resident, the information collector
- (b) If an information collector who is not a governmental agency violates AS 45.48.010 — 45.48.090 with regard to the personal information of a state resident, the violation is an unfair or deceptive act or practice under AS 45.50.471 — 45.50.561. However,
- (1) the information collector is not subject to the civil penalties imposed under AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 — 45.48.090, except that the total civil penalty may not exceed $50,000; and
- (2) damages that may be awarded against the information collector under
- (c) The Department of Administration may enforce (a) of this section against a governmental agency. The procedure for review of an order or action of the department under this subsection is the same as the procedure provided by AS 44.62 (Administrative Procedure Act), except that the office of administrative hearings (AS 44.64.010) shall conduct the hearings in contested cases and the decision may be appealed under AS 44.64.030(c).
AS 45.48.090. Definitions
In AS 45.48.010 — 45.48.090,
- (1) “breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector; in this paragraph, “acquisition” includes acquisition by
- (2) “covered person” means a
- (3) “governmental agency” means a state or local governmental agency, except for an agency of the judicial branch;
- (4) “information collector” means a covered person who owns or licenses personal information in any form if the personal information includes personal information on a state resident;
- (5) “information distributor” means a person who is an information collector and who owns or licenses personal information to an information recipient;
- (6) “information recipient” means a person who is an information collector but who does not own or have the right to license to another information collector the personal information received by the person from an information distributor;
- (7) “personal information” means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of
- (A) an individual's name; in this subparagraph, “individual's name” means a combination of an individual's
- (B) one or more of the following information elements:
- (i) the individual's social security number;
- (ii) the individual's driver's license number or state identification card number;
- (iii) except as provided in (iv) of this subparagraph, the individual's account number, credit card number, or debit card number;
- (iv) if an account can only be accessed with a personal code, the number in (iii) of this subparagraph and the personal code; in this sub-subparagraph, “personal code” means a security code, an access code, a personal identification number, or a password;
- (v) passwords, personal identification numbers, or other access codes for financial accounts.
AS 45.48.500. Disposal of records
- (a) When disposing of records that contain personal information, a business and a governmental agency shall take all reasonable measures necessary to protect against unauthorized access to or use of the records.
- (b) Notwithstanding (a) of this section, if a business or governmental agency has otherwise complied with the provisions of AS 45.48.500 — 45.48.590 in the selection of a third party engaged in the business of record destruction, the business or governmental agency is not liable for the disposal of records under AS 45.48.500 — 45.48.590 after the business or governmental agency has relinquished control of the records to the third party for the destruction of the records.
- (c) A business or governmental agency is not liable for the disposal of records under AS 45.48.500 — 45.48.590 after the business or governmental agency has relinquished control of the records to the individual to whom the records pertain.
AS 45.48.510. Measures to protect access
The measures that may be taken to comply with AS 45.48.500 include
- (1) implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of paper documents containing personal information so that the personal information cannot practicably be read or reconstructed;
- (2) implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the personal information cannot practicably be read or reconstructed;
- (3) after due diligence, entering into a written contract with a third party engaged in the business of record destruction to dispose of records containing personal information in a manner consistent with AS 45.48.500 — 45.48.590.
AS 45.48.520. Due diligence
In AS 45.48.510(3), due diligence ordinarily includes performing one or more of the following:
- (1) reviewing an independent audit of the third party's operations and its compliance with AS 45.48.500 — 45.48.590;
- (2) obtaining information about the third party from several references or other reliable sources and requiring that the third party be certified by a recognized trade association or similar organization with a reputation for high standards of quality review; or
- (3) reviewing and evaluating the third party's information security policies and procedures, or taking other appropriate measures to determine the competency and integrity of the third party.
AS 45.48.530. Policy and procedures
A business or governmental agency shall adopt written policies and procedures that relate to the adequate destruction and proper disposal of records containing personal information and that are consistent with AS 45.48.500 — 45.48.590.
AS 45.48.540. Exemptions
- (a) A business or a governmental agency is not required to comply with AS 45.48.500 — 45.48.530 if federal law requires that the business or governmental agency act in a way that does not comply with AS 45.48.500 — 45.48.530.
- (b) A business is not required to comply with AS 45.48.500 — 45.48.530 if
AS 45.48.550. Civil penalty
- (a) An individual, a business, or a governmental agency that knowingly violates AS 45.48.500 — 45.48.590 is liable to the state for a civil penalty not to exceed $3,000.
- (b) In this section, “knowingly” has the meaning given in AS 11.81.900.
AS 45.48.560. Court action
An individual who is damaged by a violation of AS 45.48.500 — 45.48.590 may bring a civil action in court to enjoin further violations and to recover for the violation actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees.
AS 45.48.590. Definitions
In AS 45.48.500 — 45.48.590,
- (1) “business” means a person who conducts business in the state or a person who conducts business and maintains or otherwise possesses personal information on state residents; in this paragraph,
- (A) “conducts business” includes engaging in activities as a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this state, another state, the United States, or another country;
- (B) “possesses” includes possession for the purpose of destruction;
- (2) “dispose” means
- (A) the discarding or abandonment of records containing personal information;
- (B) the sale, donation, discarding, or transfer of
- (i) any medium, including computer equipment or computer media, that contains records of personal information;
- (ii) nonpaper media, other than that identified under (i) of this subparagraph, on which records of personal information are stored; and
- (iii) equipment for nonpaper storage of information;
- (3) “governmental agency” means a state or local governmental agency, except for an agency of the judicial branch;
- (4) “personal information” means
- (5) “records” means material on which information that is written, drawn, spoken, visual, or electromagnetic is recorded or preserved, regardless of physical form or characteristics, but does not include publicly available information containing names, addresses, telephone numbers, or other information an individual has voluntarily consented to have publicly disseminated or listed.
AS 45.48.990. Definitions
In this chapter, unless the context indicates otherwise,
- (1) “consumer” means an individual;
- (2) “consumer credit reporting agency” means a person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties;
- (3) “credit report” means a consumer report that a consumer credit reporting agency furnishes to a person that the consumer credit reporting agency has reason to believe intends to use the consumer report as a factor in establishing the consumer's eligibility for credit to be used primarily for personal, family, or household purposes; in this paragraph, “consumer report” has the meaning given to “consumer report” in 15 U.S.C. 1681a(d) (Fair Credit Reporting Act), except that “consumer reporting agency” in 15 U.S.C. 1681a(d) is to be read as “consumer credit reporting agency”;
- (4) “Fair Credit Reporting Act” means 15 U.S.C. 1681 — 1681x;
- (5) “Gramm-Leach-Bliley Financial Modernization Act” means 15 U.S.C. 6801 — 6827;
- (6) “identity theft” means the theft of the identity of an individual;
- (7) “information system” means any information system, including a system consisting of digital databases and a system consisting of pieces of paper;
- (8) “person” has the meaning given in AS 01.10.060 and includes a state or local governmental agency, except for an agency of the judicial branch;
- (9) “state resident” means an individual who satisfies the residency requirements under AS 01.10.055.
AS 45.48.995. Short title
This chapter may be cited as the Alaska Personal Information Protection Act.