Section 45.48.010. Disclosure of breach of security.

   (a) If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.
   (b) An information collector shall make the disclosure required by (a) of this section in the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.
   (c) Notwithstanding (a) of this section, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. The determination shall be documented in writing, and the documentation shall be maintained for five years. The notification required by this subsection may not be considered a public record open to inspection by the public.

Authorities

45.48.020;45.48.030;45.48.040;45.48.050;45.48.060;45.48.070;45.48.080;45.48.090;45.50.471

Notes

References

AS 45.48.020 Allowable delay in notification.
AS 45.48.030 Methods of notice.
AS 45.48.040 Notification of certain other agencies.
AS 45.48.050 Exception for employees and agents.
AS 45.48.060 Waivers.
AS 45.48.070 Treatment of certain breaches.
AS 45.48.080 Violations.
AS 45.48.090 Definitions.
AS 45.50.471 Unlawful acts and practices.

History

(Sec. 4 ch 92 SLA 2008)