Ohio Enacts Data Breach Notification Law

By Michele A. Shuster

Ohio's Data Breach Notification Law, House Bill (HB) 104, takes effect Friday, February 17, 2006. The law requires businesses operating in Ohio to notify Ohio residents of a data breach of "personal information" if the breach is likely to result in identity theft or fraud. The law provides the Ohio Attorney General's office with enforcement authority.

Personal information is defined as computerized information that contains an individual's name plus information that would permit access to the individual's financial accounts such as:

• a social security number,
• a driver's license or state identification number, or
• an account, credit, or debit card number

Notification is not required if the computerized data elements are encrypted, redacted to four digits, or otherwise made to be unreadable. Personal information does not include information that is public record or already available to the public through a widely circulated media.

Companies that experience a data breach must notify consumers in the "most expedient time possible," but generally not later than 45 days following its discovery of the data breach. If the breach involves more than 1,000 consumers, then the company is also required to notify the credit reporting agencies.

Failure to comply with the notification law can lead to damages of up to $10,000 per day for each day that a company fails to provide the notification.