New Jersey Enacts Security Breach; Security Freeze Law

Earlier today the state of New Jersey enacted a security breach notification law, when the Governor signed Assembly Bill 4001.

20 states now have a security breach notification law, (although Indiana's only applies to state agencies).

The law also creates of the strictest “security freeze” laws in the country.

The law goes into effect January 1, 2006.

SECURITY BREACH NOTIFICATION

The security breach provisions are similar to those of California.

The law provides that “any business that conducts business in New Jersey, or any public entity that compiles or maintains computerized records that include personal information, shall disclose any breach of security of those computerized records following discovery or notification of the breach to any customer who is a resident of New Jersey whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person.”

This also applies entities which compiles or maintains information behalf of another business or public entity

Disclosures must be made “made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.”

The law does provide that “Disclosure of a breach of security to a customer shall not be required under this section if the business or public entity establishes that misuse of the information is not reasonably possible.” Documentation of a breach must be kept in writing for five years.

Notice may be in writing, electronically, or through the media, “if the business or public entity demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the business or public entity does not have sufficient contact information.”

For breaches requiring notification to more than 1,000 people, notice must also be sent to the national consumer reporting agencies.

The law also limits how businesses may use or display a person’s Social Security number.


CREDIT FREEZE REQUIREMENT

The law also allows consumers to place a freeze on their credit reports.

A consumer reporting agency must place the freeze no later than five business days after receiving a written request from the consumer. Agencies must send a written confirmation of the security freeze to the consumer within five business days of placing the freeze, provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his credit for a specific party or period of time.

A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze must comply within three business days.

The law requires consumer reporting agencies to develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process request from consumers to temporarily lift a freeze on a consumer report.

The law requires the state to create regulations which would require consumer reporting agencies to lift a security freeze “as quickly as possible, with the goal of processing a request within 15 minutes of that request.”

If a security freeze is in place, a consumer reporting agency may not change any of the following official information in a consumer report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file:

* Name
* Date of birth
* Social Security number
* Address.

The following entities are not required to place a security freeze in a consumer report:

-- A check services company or fraud prevention services company.

-- A demand deposit account information service company