Under state breach notification laws, which is NOT typically included in the definition of personal information?
Under state breach notification laws, which is NOT typically included in the definition of personal information?
State breach notification laws typically define personal information as data that could be used to identify an individual in combination with more sensitive information such as Social Security numbers, state identification numbers, financial account numbers, or medical information. First and last names alone, without additional sensitive data, are generally not considered sufficient to constitute personal information under these laws.
Definition of Personal Information An example of the typical definition of personal information is Connecticut’s, which defines it as “an individual’s First name or first initial and last name in combination with anyone, or more, of the following data: (1) Social Security number; (2) driver’s license number; (3) state identification card number; or (4) account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account
This data is part of the definition of personal information in all state data breach elements. For example, Alabama, Arkansas, California, Colorado, Delaware, Florida, Illinois, Maryland, Missouri, Montana, Nevada, North Dakota, Oregon, Rhode Island, South Dakota, Texas, Virginia, and Wyoming “INCLUDE MEDICAL AND HEALTHCARE INFORMATION.” The laws in Alaska, Georgia, Maine, North Carolina, and Vermont apply to “passwords, personal identification numbers, account numbers, or other similar information related to financial accounts. “ Alabama, Colorado, Delaware, Maryland, Montana, New Mexico, New York, North Carolina, Oregon, South Carolina, South Dakota, and Wyoming “include any federal or state identification number, which serves as a catchall for passport numbers, military identification, and other tax identification numbers.
Several states, including Colorado, Delaware, Illinois, Iowa, Maryland, Nebraska, New Mexico, North Carolina, Oregon, Wisconsin, and Wyoming apply to “unique biometric data (“i.e., such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data”) or biometric data (consisting of digital measurements of an individual’s fingerprints, voice print, retina or iris image, facial characteristics, or hand geometry).” Delaware and Wisconsin specifically “list a DNA profile. “ Puerto Rico includes “tax information and work-related evaluations.” North Carolina and North Dakota add “mother’s maiden name (often used as a security question).”