Computer Security: Montana Law on Reporting Breaches
If your business stores or maintains personal information about customers on a computer network which could possibly be accessed by unauthorized parties, including computer hackers, you should be aware of a new Montana law which went into effect on March 1, 2006 . The 2005 Legislature amended ยง 31-3-115 of the Montana Code Annotated to address specifically breaches of computer security.
There are several factors involved in the law. First, the law applies to any person or business which conducts business in Montana and that owns, licenses or maintains computerized data which includes "personal information." "Personal information" means a person's name in combination with identification data such as a social security or driver's license number, or an account or credit card number coupled with the password or security code. Second, the personal information at issue must have been unencrypted; if the information acquired was encrypted, the information does not constitute personal information subject to the law. Third, the personal information must be that of a Montana resident. Fourth, there must be an "unauthorized acquisition of computerized data," as that is how Montana law defines a breach of computer security.
Fifth, and most important, the law does not actually prohibit breaches of computer security. Instead, it mandates the reporting of breaches to those affected. The disclosure must be made without unreasonable delay, and can normally be made in writing, electronically, or by telephone. However, a person or business which maintains its own notification procedures as part of an overall information security policy may provide notification pursuant to its procedures if it does not unreasonably delay notice.
The computer security law also provides for a fine of up to $10,000 for each violation of the reporting law. The possibility of jail time of up to one year for a violation constituting fraudulent conduct also exists. The State may also institute legal action to enjoin further breaches.
If you have questions about, or need further analysis of or help with meeting the Montana law on computer security, please contact the Moulton Law Firm. We would be happy to assist you.
