EdLaw
District of Columbia — Consumer Security Breach Notification (D.C. Code §§ 28-3851–28-3853)
Subchapter II of Chapter 38 of Title 28 of the D.C. Code. It was enacted by D.C. Law 16-237 (effective March 8, 2007, per each section's credit). D.C. Law 23-98 (June 17, 2020) rewrote it and added the security-requirements, remedies and rulemaking sections, §§ [28-3852.01]–[28-3852.03]. The subchapter binds a person or entity: "an individual, firm, corporation, partnership, company, cooperative, association, trust, or any other organization", excluding "the District of Columbia government or any of its agencies or instrumentalities" (§ 28-3851(2A)). It requires:
- notice to affected District residents and, for 50 or more residents, to the Attorney General;
- reasonable security safeguards;
- security terms in written contracts with service providers;
- reasonable steps when destroying records.
Applicability to EdTech
- A vendor holding a school's data must notify the owner. A person or entity that "maintains, handles, or otherwise possesses" personal information it does not own "shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery" (§ 28-3852(b)).
- The security duty reaches processors directly. Anyone that "owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District shall implement and maintain reasonable security safeguards" ([§ 28-3852.01](SECURITY-BREACH.md#dc-28-3852-01)).
- The contract must require security. Where personal information is disclosed to a service provider under a written agreement, "the agreement" must require the provider to "implement and maintain reasonable security procedures and practices" appropriate to the information ([§ 28-3852.01](SECURITY-BREACH.md#dc-28-3852-01)). A school or other covered business contracting with an EdTech vendor will put that clause in.
- Login credentials and biometric data are covered. Personal information includes "A user name or e-mail address in combination with a password, security question and answer, or other means of authentication … that permits access to an individual's e-mail account". It also includes biometric data such as a "voice print" or "retina or iris image" used to authenticate identity (§ 28-3851(3)).
- Attorney General notice. If 50 or more residents are affected, written notice to the Office of the Attorney General is required, "in no event later than" notice to residents, with the listed contents (§ 28-3852(b-1)).
- Identity theft protection. A breach involving social security or taxpayer identification numbers requires at least 18 months of free identity theft protection services (§ [28-3852.02]).
Contents
| Document | Covers |
|---|---|
| SECURITY-BREACH.md | D.C. Code §§ 28-3851, 28-3852, [28-3852.01]–[28-3852.03] and 28-3853 in full |
Enforcement
"A violation of this subchapter, or any rule issued pursuant to the authority of this subchapter, is an unfair or deceptive trade practice pursuant to § 28-3904(kk)" (§ 28-3853(b)). Those remedies are cumulative (§ 28-3853(c)). A waiver of the subchapter is void (§ 28-3852(f)).
Licence
The Council's D.C. Code site states, on every page: "The codes and laws on this website are in the public domain." (code.dccouncil.gov — Subchapter II index, read 2026-10-08.) The corpus reproduces the statute text, headings and session-law credits, and none of the publisher's annotations.
Conditions: none. The same page asks: "Please do not scrape. Instead, bulk download the HTML or XML." The builder reads seven pages per run (the index and six sections) and crawls nothing.
Related
- District of Columbia — Protecting Students Digital Privacy Act — the District's operator statute for student data
- Alaska Personal Information Protection Act — another breach statute with a holder-notifies-owner rule
- FERPA — the federal education-records layer