McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → Products & Solutions → Data Protection → US & Global Data Protection Laws → Security Breach Notification Laws

District of Columbia

Consumer Security Breach Notification Act of 2006
CITATION D.C. Code § 28- 3851 et seq.
ENACTED 2006
SUMMARY The law requires any person or entity conducting business in the District of Columbia and who uses computerized or other electronic data that includes personal information to provide notice to the individual in the event of a breach or suspected breach.
DATA COVERED

The law covers ‘Personal Information’ which means an individual’s first name or first initial and last name, or phone number, address, and any one or more of the following:

  1. Social Security number;
  2. Driver’s license number or District of Columbia Identification Card Number; or
  3. Credit card number or debit card number; or
  4. Any other number or code combination of numbers or codes, such as account number, security code, access code or use of an individual’s financial or credit account.
INDUSTRY

Any person or entity that conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach.

Any person or entity that maintains, handles, or otherwise possesses computerized or other electronic data that includes personal information that the person or entity does not own shall notify the owner or licensee of the information of any breach of the security of the system in the most expedient time possible following discovery.

Alternative means of notification are provided for companies that have to provide more than 1,000 notices.
PENALTIES

Any District of Columbia resident injured by a violation of this subchapter may institute a civil action to recover actual damages, the costs of the action, and reasonable attorney's fees. Actual damages shall not include dignitary damages, including pain and suffering.

The Attorney General may petition the Superior Court of the District of Columbia for temporary or permanent injunctive relief and for an award of restitution for property lost or damages suffered by District of Columbia residents as a consequence of the violation of this subchapter. In an action under this subsection, the Attorney General may recover a civil penalty not to exceed one hundred dollars ($100) for each violation, the costs of the action, and reasonable attorney's fees. Each failure to provide a District of Columbia resident with notification in accordance with this section shall constitute a separate violation.
United States - English