New Hampshire
| Notice of Security Breach | |
|---|---|
| CITATION | N.H. Rev. Stat. §§ 87-801 et seq. |
| ENACTED | 2006 |
| SUMMARY | The law requires that an individual or a commercial entity that conducts business in New Hampshire and that owns or licenses computerized data that includes personal information about a resident of New Hampshire becomes aware of a breach of the security of their computer system, the business or entity should conduct a prompt investigation to determine if personal information has been compromised and assess the risk of misuse. The law also requires the individual or the commercial entity provide notice as soon as possible to the affected New Hampshire resident unless the investigation determines that the misuse of information about a New Hampshire resident has not occurred and is not reasonably likely to occur. |
| DATA COVERED |
The law covers ‘Personal Information’ which is defined as an individual's first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
|
| INDUSTRY | Breach of the security of the system means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or a commercial entity. Good faith acquisition of personal information by an employee or agent of an individual or a commercial entity for the purposes of the individual or the commercial entity is not a breach of the security of the system if the personal information is not used or subject to further unauthorized disclosure. |
| PENALTIES | Any person injured by a violation of the Act may bring an action for damages and for an injunction. If the Court determines that the violation was willful and/or knowing, the Court can award as much as three times but not less than 2 times the amount of damages. The plaintiff may also recover costs of litigation plus attorneys’ fees. |