Data Breach Notification Laws – What They Are and What they Require

Summary:  In 1748, in response to the request of a friend, Benjamin Franklin offered the following hints in his pamphlet, Advice to a Young Tradesman, Written by an Old One: “Remember that time is money. Remember that credit is money.” In a patchwork landscape of data breach notification laws, these words have never been so true for American companies preparing for and responding to data breaches.

The Identity Theft Resource Center® (ITRC), is a nationally recognized nonprofit organization established to support victims of identity crime. According to the ITRC, 92 million records were exposed from 619 data breaches in 2013 when we first addressed this issue. By 2017 that number had increased to 197 million records exposed, with 1,579 from data breaches. In 2018, ITRC tracked an extreme jump at 126 percent in the number of consumer records exposed (446.5 million) from data breaches. The most recent update of statistics from the ITRC tracked records for data breaches was for the third quarter 2020 which revealed a 30 percent drop in number (846 breaches) year over year compared to 2019 (1,190 breaches).