Arizona Governor Doug Ducey signed HB 2154 into law on April 11, 2018, amending and strengthening the state’s data breach notification law. Notably, the amended law significantly expands the definition of “personal information” to include a number of new data elements, including online account credentials, certain health information, and biometric data used to authenticate an individual when the individual accesses an online account. The amended law also requires that notice be provided within 45 days after a determination that a “security system breach” has occurred and adds an obligation to notify the Arizona Attorney General and nationwide consumer reporting agencies if the security system breach involves more than 1,000 individuals.
On April 25, 2018, from 1 p.m. to 2 p.m. MT, Ballard Spahr attorneys will hold a webinar—Arizona Strengthens and Expands Data Breach Notification Law. The webinar registration form is available here.
Click here for the full alert.