Data Breach Notice to Residents and State Authorities in West Virginia
At a glance
| Covered entity and service provider | Individual or entity owning/licensing computerized PI notifies residents; nonowner maintainer tells owner/licensee as soon as practicable after discovering qualifying access and acquisition (§ 46A-2A-102(a),(c)) |
|---|---|
| Breach and covered information | Unauthorized access AND acquisition of unencrypted, unredacted computerized PI, with actual or reasonably expected identity theft/fraud; name plus SSN, driver/state ID, or financial account with access code; public-data and good-faith employee exclusions (§ 46A-2A-101(1),(6)) |
| Risk screen or notice exception | Fraud-risk element is part of breach definition and resident notice test; encrypted data triggers notice if obtained unencrypted or key holder involved and fraud is reasonably expected (§§ 46A-2A-101(1), 46A-2A-102(a)-(b)) |
| Individuals who receive notice | WV residents whose unencrypted, unredacted PI was or is reasonably believed to have been accessed AND acquired by an unauthorized person, with actual or reasonably expected fraud (§ 46A-2A-102(a)) |
| Individual notice deadline and clock | Without unreasonable delay after discovery or notification; scope determination and integrity restoration may precede notice; no fixed outer day count (§ 46A-2A-102(a)) |
| Regulator threshold and deadline | No separate AG breach report in general §§ 46A-2A-101 to -104; AG enforces violations, while a licensed financial institution's primary regulator enforces its violations (§§ 46A-2A-102, 46A-2A-104) |
| Consumer-reporting-agency notice | If entity must notify more than 1,000 people, tell all nationwide consumer-reporting agencies without unreasonable delay of timing, distribution, and content, without names; GLBA Title V entities excepted (§ 46A-2A-102(f)) |
| Individual delivery and content | Postal writing, telephone, or qualifying electronic notice; include data categories if possible, entity contact for held-data inquiry, major credit-bureau contacts, and fraud-alert/freeze information (§§ 46A-2A-101(7)(A)-(C), 46A-2A-102(d)) |
| Substitute notice conditions and channels | Cost over $50,000, affected WV class over 100,000, or insufficient contacts; choose any TWO of available email, conspicuous website posting, and major statewide media (§ 46A-2A-101(7)(D)) |
| Delays and alternate compliance | Law-enforcement advice that notice impedes criminal/civil investigation or jeopardizes homeland/national security permits delay until cleared; timely own-policy, federal financial-guidance, or primary-regulator procedure can satisfy article (§§ 46A-2A-102(e), 46A-2A-103) |
Requirements one by one
Covered information and the fraud test
Section 46A-2A-101(1) defines a breach using unauthorized access and acquisition, a compromised database of multiple people's computerized information, and actual or reasonably expected identity theft or other fraud. Section 46A-2A-101(6) covers a resident's name or first initial and last name linked to a Social Security number, driver or state ID number, or an account or card number with a code that permits account access. Lawfully public information is excluded.
An employee's good-faith acquisition for the entity's purposes is excluded only while the information is used lawfully and is not further disclosed without authority (§ 46A-2A-101(1)). Under § 46A-2A-102(b), obtaining encrypted information in readable form, or a breach involving someone with the key, can bring the event within the notice rule when fraud is reasonably expected.
Who receives notice, and when
The owner or licensee notifies an affected resident when the resident's unencrypted and unredacted information was, or is reasonably believed to have been, both accessed and acquired by an unauthorized person and the fraud condition is met (§ 46A-2A-102(a)). A nonowner maintainer instead alerts the owner or licensee as soon as practicable after discovery when access and acquisition occurred or are reasonably believed to have occurred (§ 46A-2A-102(c)).
Resident notice follows discovery or notification without unreasonable delay. Section 46A-2A-102(a) allows time to determine the breach's scope and restore reasonable system integrity; it gives no outside number of days.
What the notice says and how it reaches residents
Section 46A-2A-102(d) requires the categories of information reasonably believed exposed, to the extent possible; a telephone number or website for an inquiry about what information the entity held; and major credit-reporting-agency contacts plus information on fraud alerts or security freezes. Section 46A-2A-101(7) permits postal writing, telephone, or qualifying electronic delivery.
Substitute notice is available when direct notice would cost over $50,000, the affected resident class exceeds 100,000, or contact information is insufficient. It consists of any two of email where addresses exist, a conspicuous posting on the entity's website if it has one, and major statewide media (§ 46A-2A-101(7)(D)).
Additional recipients and alternate procedures
If an entity must notify more than 1,000 people, § 46A-2A-102(f) also requires notice to all nationwide consumer-reporting agencies without unreasonable delay. The report describes timing, distribution, and content, without recipient identities. This added agency duty does not apply to a Title V Gramm-Leach-Bliley Act entity.
Section 46A-2A-103 treats a timely own-policy notice, the specified federal financial-institution guidance, or a primary-regulator procedure as compliance when its conditions are met.
What trips people up
Attorney General enforcement is different from a breach filing. Section 46A-2A-104 grants the Attorney General enforcement authority for the general article and gives a licensed financial institution's primary regulator exclusive enforcement of its violations. Section 46A-2A-102 does not prescribe a separate Attorney General notification threshold or deadline.
Police delay requires an agency determination and advice. Under § 46A-2A-102(e), law enforcement must determine and advise that disclosure would impede a criminal or civil investigation or jeopardize national or homeland security. Notice resumes without unreasonable delay once the agency determines that impediment has ended.
Common questions
Does unauthorized access alone trigger this notice rule?
Section 46A-2A-101(1) requires both unauthorized access and acquisition, plus the stated compromise and fraud condition.
Must the breach letter name each exposed account?
Section 46A-2A-102(d) requires categories of information to the extent possible and a way for a person to ask what types the entity held; it does not require listing each account in the letter.
Are consumer-reporting agencies told the affected residents' names?
No. Section 46A-2A-102(f) expressly says the entity need not provide names or other personal identifiers of notice recipients.
Statutes and sources
- W. Va. Code § 46A-2A-101 — definitions, covered information, and delivery methods.
- W. Va. Code § 46A-2A-102 — resident, owner, and reporting-agency notice; content and delays.
- W. Va. Code § 46A-2A-103 — equivalent procedures.
- W. Va. Code § 46A-2A-104 — enforcement.
Current official West Virginia Code checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does West Virginia law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current West Virginia law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace