Notifying a Regulator and the Threshold That Triggers It

Notifying individuals and notifying a regulator are separate obligations. They are triggered by different facts, counted on different bases and due on different days, and the second is the one more often missed. A breach team working from a single deadline usually has the consumer clock in mind, and the filing clock in several states expires either earlier or on an entirely different event.

The counts that force a filing

Five hundred residents is the most common threshold, but the wording differs in ways that change the arithmetic. Washington requires a filing where notification must be issued to more than five hundred Washington residents as a result of a single breach. Florida keys its department notice to a breach affecting five hundred or more individuals in the state. California's provision applies where more than five hundred California residents are notified as the result of a single breach of the security system.

Two details follow from that phrasing. The count is of residents of the state applying the statute, not of the incident population, so a widely dispersed breach may clear no threshold anywhere. And in several statutes the count is of people who must be notified rather than of records exposed, which means the analysis described in what counts as a breach runs first and reduces the population before the threshold is applied.

The filing clock, which rarely matches the consumer clock

Washington sets thirty days from discovery for the filing, the same period it allows for consumer notice. Florida requires the department notice as expeditiously as practicable and no later than thirty days after determination of the breach, with fifteen additional days available if written good cause is supplied to the department inside the original period. California takes a different approach: the sample copy is due within fifteen calendar days of notifying affected consumers, so the regulator clock does not begin until the consumer notice has gone out.

Vermont sits at the opposite extreme. It requires the data collector to give the Attorney General, or the Department of Financial Regulation for entities it supervises, the date of the breach, the date of discovery and a preliminary description within fourteen business days of discovery, while consumers may be notified up to forty-five days after discovery. The regulator therefore learns of the incident first, and the filing is expected to be preliminary. How these interact across a population is the subject of the comparison of state notification clocks.

Sequencing follows from that spread. A team that plans backwards from the consumer deadline will be late in Vermont and early in California, and a team that plans forwards from discovery will hold the California sample copy longer than it needs to. The workable order is to treat the earliest regulator obligation as the first external step, the consumer round as the second, and the filings keyed to the consumer round as the third. Each of those steps produces a document the next one reuses.

The federal health rule adds a fourth pattern that does not fit the state model at all. Its report goes to the Secretary rather than to a state office, its threshold counts individuals nationwide rather than residents of one state, and below that threshold the report is deferred to an annual log rather than filed at the time. An entity subject to both regimes therefore runs a state count and a federal count over the same population, and the two rarely produce the same answer.

What the submission has to contain

Washington's list is the fullest statutory statement of contents: the number of residents affected or an estimate where the exact figure is unknown, the types of personal information involved, a time frame of exposure including the date of the breach and the date of discovery, a summary of the steps taken to contain the breach, and a single sample copy of the notification with personally identifiable information removed. The statute then requires the filing to be updated if any of those items was unknown when the notice fell due.

That last clause changes how the deadline should be read. An incomplete filing made on time and corrected afterwards satisfies the statute; a complete filing made late does not. Florida requires a synopsis of the events, the number of individuals in the state, services being offered without charge and a copy of the notice, and permits police or investigative reports to be supplied on request. California asks for the sample notice itself, which is why the drafting choices set out in what the notice to an individual must say are read by a regulator as well as by the recipients.

Consumer reporting agencies as a third recipient

Above the regulator tier sits a further obligation to the nationwide consumer reporting agencies, triggered at higher counts and satisfied with different content. Florida requires notice to the agencies that compile and maintain files on consumers on a nationwide basis, without unreasonable delay, where notice is provided to more than one thousand individuals at a single time, covering the timing, distribution and content of the notices. New York sets the same duty at more than five thousand residents notified at one time, adding the approximate number of affected persons, and provides expressly that this notice must not delay notice to the residents themselves.

The agencies receive a description of the notification program rather than the personal data of those affected, which is why the tier is easy to overlook: nothing about it resembles the consumer letter. In a large incident it is the last of three counts to be run, after the individual population and the per-state filing thresholds, and it is the one most often discovered late. Where the same records sit with an outside processor, the counts have to be reconciled against what that processor reports, a problem addressed in handling an incident that crosses many states.