Security Breach Notification

As recently as 2005, if a company or government agency had a security breach that compromised customers' personal information, there was little chance those customers would hear about it. Times have certainly changed. The first U.S. law requiring notice of security breaches was enacted in California in 2002. It wasn't until a much-publicized breach at ChoicePoint in 2005, however, that the issue received much attention and other states began to follow California's lead. Over forty states have notice laws covering businesses, government agencies or both. Federal bank regulators have also published guidance to financial institutions as to when and how consumers should be notified of a security breach at their institution. These laws, and the bank guidance, vary from each other in many ways: Read more