Bill > HB381

This bill amends Delaware's computer security breach laws to require that any entity experiencing a data breach that affects Delaware residents must now also notify the Attorney General of the breach, in addition to providing notice to the affected individuals. The bill clarifies that "notice" can be written, telephonic, or electronic, and outlines specific conditions for "substitute notice" if direct notification is impractical due to cost, the number of affected individuals, or insufficient contact information, which includes posting on a website and notifying major media outlets. Importantly, if a person cannot identify within 60 days whether certain Delaware residents' personal information was compromised, they must notify those residents as soon as they discover it and also notify the Attorney General within 60 days of determining the breach, unless they provide substitute notice within that same 60-day period. Furthermore, entities already regulated by state or federal laws like HIPAA (Health Insurance Portability and Accountability Act) or the Gramm-Leach-Bliley Act, which have their own breach notification procedures, will be considered in compliance with Delaware's notification requirements if they follow their established regulatory procedures for notifying affected Delaware residents.