Substitute Notice When People Cannot Be Reached

Substitute notice is what a statute allows when the ordinary letter cannot be delivered. It is drafted as an exception, and the exception has a gate. An organization reaches it by demonstrating a specific state of affairs, not by concluding that a public announcement would be simpler or cheaper than a mailing. The methods that follow are usually cumulative, so the substitute is frequently more work than the notice it replaces.

The three conditions that open the route

The most common gateway has three branches, any one of which suffices. The first is cost: the entity demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars. The second is volume: the affected class of subject persons to be notified exceeds five hundred thousand. The third is contact information: the entity does not have sufficient contact information for the affected people. California, Washington and New York all use that structure and those figures. Florida uses the same two numbers and expresses the third branch as the absence of an email address or a mailing address for the affected individuals.

Each branch is a factual claim the entity has to be able to support. New York frames it explicitly as a demonstration to the state attorney general. Cost means the cost of giving the notice, calculated against the population actually to be notified, and it is assessed after the definitional and safe harbor analyses have reduced that population rather than before. Where the analysis in what counts as a breach removes a large block of records, it can move an incident back below the threshold.

Three methods, taken together

Where the gate opens, the statutes then prescribe what substitute notice consists of, and the list is conjunctive. California requires all of the following: email notice where the entity has an email address for the subject persons; a conspicuous posting of the notice on the entity's website, maintained for a minimum of thirty days, where the entity has a website; and notification to major statewide media. Washington's list is the same three items in the same relationship. An entity that posts to its website and stops has performed one third of the obligation.

California also defines conspicuous posting rather than leaving it to judgment. It means a link to the notice on the home page or the first significant page after entering the site, presented in larger type than the surrounding text, or in contrasting type, font or color, or set off from surrounding text of the same size by symbols or other marks designed to call attention to it. That definition is worth applying even where a statute does not supply one, because a posting that satisfies it is difficult to characterize later as hidden.

Florida assembles the same idea from different parts. Its substitute consists of a conspicuous notice on the entity's website, where it maintains one, together with notice in print and to broadcast media, including major media in urban and rural areas where the affected individuals reside. The urban and rural language is unusual and it is operative: a media buy concentrated in the largest markets does not cover a population distributed across a state. Where the affected residents are spread thinly, the media component is the expensive part, which undercuts the assumption that the substitute is the economical route.

A different gateway under the health rule

The federal health rule does not use cost or class size at all. Substitute notice becomes available where there is insufficient or out-of-date contact information that precludes written notification, and the rule then splits on a count of ten. For fewer than ten individuals, the substitute may take the form of an alternative written notice, a telephone call or other means. For ten or more, the substitute must be either a conspicuous posting for a period of ninety days on the home page of the entity's website or conspicuous notice in major print or broadcast media in the geographic areas where the affected individuals likely reside, and it must include a toll-free number that remains active for at least ninety days so a person can learn whether their information was involved.

Two details in that rule are easy to miss. The posting is on the home page, not on a notices page reachable from it. And where the individual is known to be deceased and the entity holds an address for the next of kin or a personal representative, substitute notice is not required if that address is insufficient. The parallel rule for personal health record vendors applies the same ten-individual test, but only after the entity has made reasonable efforts to reach everyone through the ordinary methods.

What substitute notice does not displace

Switching methods changes delivery and nothing else. The content requirements are unchanged, so the posted or broadcast notice must carry the same elements the letter would have carried, including the categories of information involved and the timing of the incident; those elements are set out in the required contents of an individual notice. The deadlines are unchanged as well, and the published notice has to appear inside the same period as the mailing it replaces.

The regulator obligations are also untouched. Filing thresholds are counted on residents to be notified, not on the method used, and several statutes require a sample copy of the notice with the filing, which in a substitute-notice incident is the published text. New York adds a variation for credential breaches, requiring clear and conspicuous notice delivered to the consumer online when connected to the account from an address or location the entity knows the consumer customarily uses. Coordinating a published notice across jurisdictions with different media requirements is one of the harder parts of an incident that crosses many states, because the published version is visible to every regulator at once, and the timing pressure it creates is examined in the state clocks and where they differ.