Delaying Notice at the Request of Law Enforcement

Every notification statute in this field contains a law enforcement exception, and every one of them places the decision outside the organization. The trigger is a determination by an agency, expressed to the entity, that notification would impede an investigation. Nothing about the organization's own view of the investigation, its cooperation with it, or its expectation that a request is coming has any effect on the clock.

Whose determination it is

The state formulations are close to identical in substance. Ohio permits a person to delay the required disclosure if a law enforcement agency determines that the disclosure will impede a criminal investigation or jeopardize homeland or national security, and requires disclosure once the agency determines that it will not. California permits delay if a law enforcement agency determines that notification will impede a criminal investigation and requires notification promptly after the agency determines that it will not compromise the investigation. Washington ties the delay to the data owner contacting an agency after discovery and to that agency's determination that notification will impede an investigation.

The common structure has two consequences. First, the delay is not available before contact with an agency has produced a determination, so an organization that has filed a report and heard nothing is not inside the exception. Second, the delay ends on the agency's word rather than on the organization's assessment that the investigation has gone quiet. An entity that stops hearing from an investigator has an obligation to ask, because the clock is waiting on an answer that only the agency can give.

New York frames the same idea as an exception to its numbered deadline rather than as a separate power, carving the legitimate needs of law enforcement out of the thirty-day limit and restoring the duty when the agency determines that notification no longer compromises the investigation. The drafting difference has no practical effect, but it explains why the exception in some statutes appears in the timing subsection and in others in a subsection of its own.

The form the request should take

Florida is the most explicit of the state statutes. Where a federal, state or local agency determines that notice would interfere with a criminal investigation, the notice is delayed upon the written request of the agency for a specified period the agency determines is reasonably necessary. A subsequent written request may revoke the delay as of a specified date or extend the original period to a specified date if further delay is needed. Everything in that provision is written, dated by reference to a specified period, and issued by the agency rather than negotiated.

The federal health rule builds the same preference into a rule of decay. If the statement is in writing and specifies the time for which a delay is required, the entity delays for that period. If the statement is made orally, the entity must document it, including the identity of the official who made it, and may delay temporarily for no longer than thirty days from the date of the oral statement, unless a written statement is submitted during that time. An oral request therefore buys thirty days and a documentation duty, and nothing more.

That structure is worth adopting even where a state statute imposes no form. An investigator's telephone call is a real determination, and the exception is available on it, but the entity relying on it months later has only its own note. Converting the call into a short written confirmation, specifying the period sought and the officer's name and agency, costs nothing and turns an assertion into a document. Where the agency declines to put anything in writing, the note of the call should record that too, along with who declined.

What the delay reaches, and what it does not

The federal rule is drafted broadly: where the condition is met, the entity delays the notification, notice or posting required under the subpart. That language covers the letters to individuals, the media notice and the report to the Secretary together, which avoids the awkward result of a public filing that discloses what the letters were held back to conceal. State provisions are usually drafted around the disclosure or notification required by the section, and reach the recipients that section names.

What the delay does not do is suspend the analysis. The definitional work, the encryption assessment and the population count all continue during the pause, because the notice has to be ready when the pause lifts. Nor does the delay travel between statutes. A delay obtained under one state's provision does not answer the obligation running in another state, which is one of the coordination problems taken up in handling an incident that crosses many states.

Restarting, and what the record has to show

When the delay ends, the statutes require notification promptly or after the agency's determination, and they do not restate the full original period. The prudent reading is that the balance of the original clock resumes rather than a new one beginning, and the practical response is to have the notice drafted, reviewed and ready to send before the release arrives. The alternative, treating the release as the start of a fresh thirty or forty-five days, is a position an entity may have to defend without any statutory text supporting it.

The record that supports the delay belongs with the rest of the incident file: the date of contact with the agency, the identity of the official, the terms of the request, any written statement, and the communication ending it. That file is also where the reasoning supporting any decision to withhold notice is kept, as described in documenting a decision not to notify. And because the delay is an allowance inside a running deadline rather than a suspension of the framework, it is best understood alongside the other permitted pauses set out in the state clocks and where they differ, which also carries the point that a fixed number of days is a ceiling rather than an entitlement. The parallel provision for regulated health information sits in the sixty-day rule for health information.