What the Notice to an Individual Must Say

A breach notice is a regulated document. The statutes do not merely require that people be told; they specify what the telling must contain, and in one state they specify how it must look. The elements are additive across jurisdictions, so an organization writing to residents of several states is drafting to the union of the applicable lists rather than to any one of them.

The elements almost every statute requires

Four items appear in nearly every list. The first is the identity of the entity writing, with contact information sufficient for the recipient to ask questions. The second is a description of the categories of personal information that were, or are reasonably believed to have been, involved. The third is timing, expressed as the date of the breach, an estimated date or a date range where the exact figure cannot be fixed. The fourth is a route to more information, usually a telephone number and an address or website.

Washington's list is a clean statement of the core with one addition: plain language, the name and contact information of the reporting entity, the types of personal information involved, a time frame of exposure including the dates of the breach and of its discovery, and the toll-free telephone numbers and addresses of the major credit reporting agencies where the breach exposed personal information. Florida's list is the shortest of the group, requiring the date or estimated date range, a description of the information accessed, and information the recipient can use to contact the entity about the incident and about what records it holds.

Where the statute prescribes the document itself

California goes considerably further than a content list. The notice must be written in plain language, titled "Notice of Data Breach", and must present the required information under five headings in a fixed sequence: what happened, what information was involved, what is being done, what the recipient can do, and where to get more information. The format must be designed to call attention to the nature and significance of the information. The title and headings must be clearly and conspicuously displayed, and the text must be no smaller than ten-point type.

The statute then supplies a model form and provides that using it, or using the prescribed headings with the required information in plain language, is compliance with the formatting subdivision. That is a genuine safe harbor on presentation, and it is the reason most multi-state notices are built inside the California structure even where California residents are a small part of the population. The content minimum sits alongside the format: the reporting entity's name and contact details, the types of information involved, the date or estimated date or range together with the date of the notice, whether notification was delayed by a law enforcement investigation, a general description of the incident, and the credit reporting agency contacts where the exposure included the categories that make those contacts useful.

What the federal health rule adds

The health rule's list overlaps the state core and then adds an element the states largely omit: a brief description of what the covered entity is doing to investigate the breach, to mitigate harm to individuals and to protect against further breaches. It also asks for any steps individuals should take to protect themselves, and it specifies the contact procedures in the alternative, requiring a toll-free number, an email address, a website or a postal address. Like California, it requires plain language.

The remediation element changes the drafting problem. A sentence describing what the organization has done is a factual statement made under a rule that places the burden of demonstrating compliance on the entity, and it will be read later against the incident record. Vague assurance is worse than a short specific account, and an account that outruns what was actually done is worse still.

The rule also requires the notice to state any steps individuals should take to protect themselves. That element is where the credit bureau contacts, the credit freeze information and any offered services naturally sit, and it is the part of the letter most likely to be reused verbatim across incidents. Reuse is fine as far as it goes, but the steps have to match the exposure. Advice about monitoring bank statements attached to a notice about a breach of health diagnoses tells the recipient that the letter was assembled rather than written.

One further divergence is worth noting. Several state statutes deem notice given under the rules of a covered entity's primary or functional federal regulator to satisfy the state requirement, provided the individuals are notified in accordance with those rules. Florida includes such a provision. That is a substitution of one content standard for another rather than an exemption, and it works only where the federal notice actually went to the state's residents.

Delivery, and what happens when it fails

The default method is written notice to the last known address, with electronic mail available where the recipient has agreed to it or, in some states, where email is the ordinary channel between the parties. Where the breach involves credentials rather than identity data, several statutes prescribe a different route: notice delivered online when the consumer connects to the account from an address or location the entity knows the consumer customarily uses, and, where the compromised credentials belong to an email account the entity itself provides, a route other than that email address.

When contact information is missing or stale for enough people, the statutes switch to a published form of notice with its own thresholds and methods, described in substitute notice when people cannot be reached. The switch is conditional, not elective; an entity that has usable addresses cannot choose a website posting because it is cheaper. And whichever method is used, the timing obligations are unchanged, which is why drafting normally proceeds in parallel with the clock analysis set out in the state notification clocks and where they differ rather than after it.