Louisiana Database Security Breach Notification Law (Act 499 of 2005 Regular Session)

Louisiana Database Security Breach Notification Law (Act 499 of 2005 Regular Session)

The privacy and financial security of individuals are increasingly at risk due to the widespread collection of personal information. As a result, over 30 states, including Louisiana, have passed laws that require residents to be notified when their "personal information" is compromised. SB205 Act 499, known as the "Database Security Breach Notification Law," became effective on January 1, 2006 and requires notification to any Louisiana resident whose unencrypted "personal information" was, or is reasonably believed to have been, acquired by an unauthorized person as a result of a "security breach." In addition, the notification must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs to law enforcement or any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system.

“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following elements, when the name or the data element is not encrypted or redacted:

• Social security number;
• Driver’s license number;
• State Identification card number;
• Passport number;
• Biometric data (Note: Biometric data can include any data generated by automatic measurements of an individual's biological characteristics, such as fingerprint, voice print, retina/iris scan, or other unique biological characteristics that is used to uniquely authenticate an individual's identity.)
• Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

More information on Louisiana’s Database Security Breach Notification Law can be found here:  https://legis.la.gov/legis/home.aspx.