Sec. 214. Content of notice to individuals
838 words·~4 min read·
/bill/113/s/1995/is/section-214·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Regardless of the method by which individual notice is provided to individuals under section 213(1), such notice shall include— a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, and how the agency or business entity came into possession of the sensitive personally identifiable information at issue; a toll-free number— that the individual may use to contact the agency or business entity, or the agent of the agency or business entity; and from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual; the toll-free contact telephone numbers, websites, and addresses for the major credit reporting agencies; the telephone numbers and websites for the relevant Federal agencies that provide information regarding identity theft prevention and protection; notice that the individual is entitled to receive, at no cost to such individual, consumer credit reports on a quarterly basis for a period of 2 years, credit monitoring or any other service that enables consumers to detect the misuse of sensitive personally identifiable information for a period of 2 years, and instructions to the individual on requesting such reports or service from the agency or business entity; notice that the individual is entitled to receive a security freeze and that the agency or business entity will be liable for any costs associated with the security freeze for 2 years and the necessary instructions for requesting a security freeze; and notice that any costs or damages incurred by an individual as a result of a security breach will be paid by the business entity or agency that experienced the security breach.
Telephone notice described in section 213(2) shall include, to the extent possible— notification that a security breach has occurred and that the individual’s sensitive personally identifiable information may have been compromised; a description of the categories of sensitive personally identifiable information that were, or are reasonably believed to have been, accessed or acquired by an unauthorized person; a toll-free number and website— that the individual may use to contact the agency or business entity, or the authorized agent of the agency or business entity; and from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual; and an alert to the individual that the agency or business entity is sending or has sent written notification containing additional information as required under section 213(1)(A).
Public notice described in section 213(3) shall include— electronic notice, which includes— notification that a security breach has occurred and that the individual’s sensitive personally identifiable information may have been compromised; a description of the categories of sensitive personally identifiable information that were, or are reasonably believed to have been, accessed or acquired by an unauthorized person; and a toll-free number and website— that the individual may use to contact the agency or business entity, or the authorized agent of the agency or business entity; and from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual; and media notice, which includes— a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person; a toll-free number— that the individual may use to contact the agency or business entity, or the authorized agent of the agency or business entity; and from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual and remedies available to that individual; the toll-free contact telephone numbers, websites, and addresses for the major credit reporting agencies; the telephone numbers and websites for the relevant Federal agencies that provide information regarding identity theft prevention and protection; notice that the affected individuals are entitled to receive, at no cost to such individuals, consumer credit reports on a quarterly basis for a period of 2 years, credit monitoring, or any other service that enables consumers to detect the misuse of sensitive personally identifiable information for a period of 2 years; notice that the individual is entitled to receive a security freeze and that the agency or business entity will be liable for any costs associated with the security freeze for 2 years; and notice that the individual is entitled to receive compensation from the business entity or agency for any costs or damages incurred by the individual resulting from the security breach.
Notwithstanding section 221, a State may require that a notice under subsection
(a)shall also include information regarding victim protection assistance provided for by that State. Regardless of whether a business entity, agency, or a designated third party provides the notice required pursuant to section 211(b), such notice shall include the name of the business entity or agency that has a direct relationship with the individual being notified.