State Data Breach Notification Letter

ALABAMA DATA BREACH NOTIFICATION PACKET

Use this packet only after counsel has evaluated the incident under the Alabama Data Breach Notification Act of 2018. The packet includes a decision worksheet, an affected-individual notice, an Attorney General submission worksheet, a nationwide consumer-reporting-agency notice, a third-party-agent notice, and a no-notice determination record.

1. THRESHOLD AND INVESTIGATION WORKSHEET

A. Entity and Role

• Organization: [________________________________]
• Incident reference: [________________________________]
• Date incident discovered: [__/__/____]
• Date investigation opened: [__/__/____]
• Organization is acting as: ☐ Covered entity ☐ Third-party agent ☐ Both
• Alabama residents' electronic data is involved: ☐ Yes ☐ No ☐ Under investigation

Before using the notice forms, determine whether the organization is exempt under Ala. Code § 8-38-11 or § 8-38-12 because it is regulated by qualifying federal or state breach-notification requirements, maintains procedures under those requirements, and gives the required notices. An exempt entity must still timely provide the Attorney General a copy of the notice when it notifies more than 1,000 individuals.

B. Sensitive Personally Identifying Information

Under Ala. Code § 8-38-2(6), sensitive personally identifying information generally requires an Alabama resident's first name or first initial and last name combined with at least one qualifying data element concerning that resident. Check every category involved:

☐ Non-truncated Social Security number or tax identification number

☐ Non-truncated driver's-license, state identification, passport, military identification, or other qualifying government identification number

☐ Financial-account, credit-card, or debit-card number together with a security code, access code, password, expiration date, or PIN necessary to access the account or conduct a credit or debit transaction

☐ Medical history, mental or physical condition, medical treatment, or diagnosis by a health-care professional

☐ Health-insurance policy or subscriber number, or a unique identifier used by a health insurer

☐ User name or email address together with a password or security question and answer that permits access to an online account affiliated with the covered entity and reasonably likely to contain, or be used to obtain, sensitive personally identifying information

☐ No listed combination identified

Exclude information lawfully made public by a government record or widely distributed media. Also evaluate whether the information was truncated, encrypted, secured, or otherwise modified so that it is unusable; that exclusion may not apply when the entity knows or has reason to know that the relevant encryption key or security credential was breached with the information.

C. Required Investigation

If a covered entity determines that a breach has or may have occurred, Ala. Code § 8-38-4 requires a good-faith and prompt investigation. Document:

1. Nature and scope of the incident: [________________________________]
2. Sensitive personally identifying information that may be involved: [________________________________]
3. Alabama residents to whom the information relates: [________________________________]
4. Evidence of unauthorized acquisition or a reasonable belief of acquisition: [________________________________]
5. Assessment of whether substantial harm is reasonably likely: [________________________________]
6. Measures implemented to restore system security and confidentiality: [________________________________]

Factors relevant to unauthorized acquisition may include possession or control by an unauthorized person, downloading or copying, unauthorized use, and public disclosure.

D. Notice Decision

Consumer notice under Ala. Code § 8-38-5 is required only if the covered entity determines that sensitive personally identifying information was acquired, or is reasonably believed to have been acquired, by an unauthorized person and is reasonably likely to cause substantial harm to the individuals concerned.

☐ Notice required; determination date: [__/__/____]

☐ Notice not required; complete Section 6 and retain the written determination and related records for at least five years

☐ Further investigation required

E. Timing and Additional Recipients

When notice is required, give affected-individual notice as expeditiously as possible and without unreasonable delay, and no later than 45 days after the covered entity determines that the breach occurred and is reasonably likely to cause substantial harm, or after the covered entity receives breach notice from a third-party agent. A written request from a federal or state law-enforcement agency may delay notice for the period the agency determines necessary under Ala. Code § 8-38-5(c).

• Individual notices required: [________]
• Individual notices planned for dispatch: [__/__/____]
• More than 1,000 individuals must be notified: ☐ Yes ☐ No
• If yes, Attorney General notice due under § 8-38-6: ☐ Calendar entered
• More than 1,000 individuals will be notified at one time: ☐ Yes ☐ No
• If yes, nationwide consumer reporting agencies must be notified under § 8-38-7: ☐ Calendar entered

2. AFFECTED-INDIVIDUAL NOTICE

IMPORTANT NOTICE ABOUT A DATA BREACH

Date: [Month Day, Year]

Dear [Name]:

What Happened

[State the date, estimated date, or estimated date range of the breach and provide a concise factual description of what occurred.]

What Information Was Involved

The information acquired by an unauthorized person included: [Describe the sensitive personally identifying information acquired.]

What We Are Doing

[Provide a general description of the actions taken to restore the security and confidentiality of the personal information involved in the breach.]

What You Can Do

[Provide a general description of steps the affected individual can take to protect against identity theft. Tailor these steps to the information involved.]

How to Contact Us

For questions about this incident, contact:

• Organization: [________________________________]
• Telephone: [________________________________]
• Email: [________________________________]
• Mailing address: [________________________________]
• Hours: [________________________________]

Sincerely,

[AUTHORIZED SIGNATORY]

[TITLE]

[ORGANIZATION]

Substitute Notice Worksheet

Direct notice may be replaced under Ala. Code § 8-38-5(e) only when it is not feasible because of excessive cost, insufficient contact information, or more than 100,000 affected individuals. The statutory excessive-cost category includes cost exceeding $500,000 or cost excessive relative to the covered entity's resources.

Unless the Attorney General approves an alternative form, substitute notice must include both a conspicuous notice on the covered entity's website for 30 days, if it maintains a website, and notice in print and broadcast media, including major media in urban and rural areas where affected individuals reside.

• Substitute-notice ground: [________________________________]
• Supporting calculation or facts: [________________________________]
• Website notice start and end dates: [__/__/____] to [__/__/____]
• Print media plan: [________________________________]
• Broadcast media plan: [________________________________]
• Alternative form approved by Attorney General: ☐ No ☐ Yes; approval date: [__/__/____]

3. ATTORNEY GENERAL SUBMISSION WORKSHEET

Complete this section when the number of individuals the covered entity is required to notify under Ala. Code § 8-38-5 exceeds 1,000. Submit through the Alabama Attorney General's current online Data Breach Notification Form:

https://www.alabamaag.gov/data-breach-notification/

Information Required by Ala. Code § 8-38-6(b)

1. Synopsis of events surrounding the breach at the time of notice: [________________________________]
2. Approximate number of affected individuals in Alabama: [________]
3. Services offered or scheduled to be offered without charge, and instructions for using them: [________________________________ / None]
4. Employee or agent available for additional information:
   - Name: [________________________________]
   - Address: [________________________________]
   - Telephone: [________________________________]
   - Email: [________________________________]

• Initial submission date: [__/__/____]
• Submission confirmation or reference: [________________________________]
• Information marked confidential where appropriate: ☐ Yes ☐ No

The covered entity may provide supplemental or updated information at any time. The Attorney General's current page directs filers who need to supplement a previous notification with additional documents to email those documents to [email protected].

4. NATIONWIDE CONSUMER REPORTING AGENCY NOTICE

Date: [Month Day, Year]

To: [CONSUMER REPORTING AGENCY]

Re: Timing, Distribution, and Content of Alabama Data Breach Notices

Under Ala. Code § 8-38-7, [COVERED ENTITY] provides notice concerning affected-individual notifications arising from the following incident:

• Timing of individual notices: [________________________________]
• Distribution of individual notices: [NUMBER, METHOD, AND RELEVANT GEOGRAPHIC SCOPE]
• Content of individual notices: [ATTACH OR DESCRIBE THE FINAL NOTICE]
• Covered-entity contact: [NAME, TITLE, ADDRESS, TELEPHONE, AND EMAIL]

Sincerely,

[AUTHORIZED SIGNATORY]

[TITLE]

[COVERED ENTITY]

5. THIRD-PARTY-AGENT NOTICE TO COVERED ENTITY

Date: [Month Day, Year]

To: [COVERED ENTITY CONTACT]

Re: Notice of Security Breach Under Ala. Code § 8-38-8

[THIRD-PARTY AGENT] notifies [COVERED ENTITY] of a breach of security in a system maintained by the agent.

• Date breach determined or reason to believe it occurred arose: [__/__/____]
• Date or estimated date range of breach: [________________________________]
• Systems involved: [________________________________]
• Sensitive personally identifying information involved or potentially involved: [________________________________]
• Alabama residents identified or potentially affected: [________________________________]
• Investigation status: [________________________________]
• Security and confidentiality measures implemented: [________________________________]
• Information and records available to support the covered entity's notices: [________________________________]
• Agent contact: [NAME, ADDRESS, TELEPHONE, AND EMAIL]

The agent will cooperate and provide information in its possession so that the covered entity can comply with applicable notice requirements. Responsibility for handling notices is: ☐ Covered entity ☐ Third-party agent under written agreement ☐ To be determined

Sincerely,

[AUTHORIZED SIGNATORY]

[TITLE]

[THIRD-PARTY AGENT]

6. WRITTEN NO-NOTICE DETERMINATION

Organization: [________________________________]

Incident reference: [________________________________]

Determination date: [__/__/____]

After a good-faith and prompt investigation under Ala. Code § 8-38-4, the covered entity determines that notice under Ala. Code § 8-38-5 is not required because:

☐ The incident did not involve a breach of security as defined by Ala. Code § 8-38-2(1)

☐ The data did not contain sensitive personally identifying information as defined by Ala. Code § 8-38-2(6)

☐ The information was not acquired and is not reasonably believed to have been acquired by an unauthorized person

☐ Substantial harm to the individuals concerned is not reasonably likely

☐ Other grounded basis: [________________________________]

Supporting Findings

[Describe the evidence, analysis, scope, affected information, acquisition assessment, harm assessment, and remediation supporting the determination.]

Record Retention

• Retain through at least: [__/__/____]
• Record custodian: [________________________________]
• Repository or matter number: [________________________________]

Approved by:

[NAME AND TITLE]

[SIGNATURE]

[DATE]

INTERNAL COMPLETION CHECKLIST

☐ Legal and regulatory exemption analysis completed

☐ Role as covered entity, third-party agent, or both confirmed

☐ Required investigation documented

☐ Notice threshold and substantial-harm determination approved by counsel

☐ Individual 45-day deadline calculated from the correct statutory trigger

☐ Written law-enforcement delay request retained, if applicable

☐ Attorney General threshold tested using “exceeds 1,000”

☐ Nationwide consumer reporting agency threshold tested separately

☐ Final notices checked against the facts established by the investigation

☐ Submission confirmations and final notice copies retained under the organization's record-retention policy

☐ If notice was not required, written determination and supporting records calendared for at least five years

SOURCES AND REFERENCES

• Alabama Legislature — Ala. Code § 8-38-2
• Alabama Legislature — Ala. Code § 8-38-4
• Alabama Legislature — Ala. Code § 8-38-5
• Alabama Legislature — Ala. Code § 8-38-6
• Alabama Legislature — Ala. Code § 8-38-7
• Alabama Legislature — Ala. Code § 8-38-8
• Alabama Legislature — Ala. Code § 8-38-11
• Alabama Legislature — Ala. Code § 8-38-12
• Alabama Attorney General — Data Breach Notification Form