State Data Breach Law PII Analysis

This is an analysis of Personal Data thresholds for Data Breach Laws in all 50 U.S. States and plus the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands.

We focus on PII triggers for breach notification in three areas: 1) the Combinations of data that trigger breaches, 2) the data elements that can trigger a breach, and 3) whether there is a Public Data exception for and how it is defined. In this analysis we do not explore harm thresholds – see our State Data Breach Harm Trigger Analysis for information on that aspect of regulations.

Our dataset breaks out each law into Data Combos, the Data Elements, and Data Exceptions.

We score each state based on how expansive their data breach state protects constituents. Recent data breaches at Facebook, LinkedIn, and Clubhouse have highlighted the deficiencies in these laws to cover what are obvious breaches of the public trust. While each State has a data breach law, not all of them really protect citizens from every breach.

We found that the District of Columbia, Oregon, Washington, California, and Colorado had the strongest Data breach Laws in terms of personal data actually triggering a breach. This is because they cover more combinations of data, more data elements, and while they exempt Public records, that exemption does not extend past items “lawfully made available to the general public from federal, state, or local government records.”

Ohio scored worst, with Connecticut, Idaho, and Utah not far behind. Each of these states (and many others) require First and Last Name to be a part of the breached data, along with another element from a list. In these cases of these States, the list of Data Elements is short as well, encompassing primarily SSN, DL, and Financial data. Finally, they all exempt Public data including data “widely distributed in the media,” without regard to the sensitivity of that data.

There are problems with most state data breach laws. Based on the loopholes in almost all of these regulations, a catastrophic breach of a major entity might technically not even be a “breach.” Let’s look at a hypothetical: If FB lost facial recognition patterns, biometric info, Like data, location and derived psychometric data on millions of Americans – but the breached info did NOT include first and last name – it wouldn’t be legally considered a breach in nearly every US State. With that data, most Americans would be reidentified and profiled in the worst ways by bad actors.

The chart below shows you the details, sortable in many ways, and links you to the primary State Statute. You can also view detailed analyses of those regulations to check our work by jumping to State pages from Perkins Coie and Baker Hostetler.

We would love your feedback and commentary. Have we got it right? Are we missing something? Submit feedback to info@privacyplan.net or find Jeff on LinkedIn or on Twitter as @Privacy_Stan.