North Carolina Security Freeze & Security Breach Law

A North Carolina bill which would require notification in the event of security breach and allow for a security freeze has passed the State Senate and the State House.

The bill, (House Bill 1248; Senate Bill 1048) would allow a "consumer or the consumer's attorney-in-fact" to place a security freeze on the consumer's credit report by making a request in writing to a consumer reporting agency. Consumers would not have to be victims of identity theft to request the freeze.

The bill would also require that "any business that maintains or otherwise possesses personal information of residents of North Carolina or any business that conducts business in North Carolina that maintains or otherwise possesses personal information of consumers in any form (whether computerized, paper, or otherwise) shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach."

"Security breach" is defined as "an incident of unauthorized access to and acquisition of records or data containing personal information where unauthorized or illegal use of the personal information has occurred or is reasonably likely to occur. Good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose is not a security breach, provided that the personal information is not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure."