|Consumer Security Breach Notification Act of 2006|
|CITATION||D.C. Code § 28- 3851 et seq.|
|SUMMARY||The law requires any person or entity conducting business in the District of Columbia and who uses computerized or other electronic data that includes personal information to provide notice to the individual in the event of a breach or suspected breach.|
The law covers ‘Personal Information’ which means an individual’s first name or first initial and last name, or phone number, address, and any one or more of the following:
Any person or entity that conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach.
Any person or entity that maintains, handles, or otherwise possesses computerized or other electronic data that includes personal information that the person or entity does not own shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery.
Alternative means of notification are provided for companies that have to provide more than 1,000 notices.
Any District of Columbia resident injured by a violation of this subchapter may institute a civil action to recover actual damages, the costs of the action, and reasonable attorney's fees. Actual damages shall not include dignitary damages, including pain and suffering.
The Attorney General may petition the Superior Court of the District of Columbia for temporary or permanent injunctive relief and for an award of restitution for property lost or damages suffered by District of Columbia residents as a consequence of the violation of this subchapter. In an action under this subsection, the Attorney General may recover a civil penalty not to exceed one hundred dollars ($100) for each violation, the costs of the action, and reasonable attorney's fees. Each failure to provide a District of Columbia resident with notification in accordance with this section shall constitute a separate violation.