Arkansas Personal Information Protection Act (Data Breach)
A.C.A. § 4-110-101, et seq.
CITATION:
Arkansas Code
Title 4 - Business and Commercial Law
Subtitle 7 - Consumer Protection
Chapter 110 - Personal Information Protection Act
§ 4-110-101. Short title
§ 4-110-102. Findings and purpose
§ 4-110-103. Definitions
§ 4-110-104. Protection of personal information
§ 4-110-105. Disclosure of security breaches
§ 4-110-106. Exemptions
§ 4-110-107. Waiver
§ 4-110-108. Penalties
4-110-101. Short title.
This chapter shall be known and cited as the "Personal Information Protection Act".
4-110-102. Findings and purpose.
(a) It is the intent of the General Assembly to ensure that sensitive personal information about Arkansas residents is protected.
(b) To that end, the purpose of this chapter is to encourage individuals, businesses, and state agencies that acquire, own, or license personal information about the citizens of the State of Arkansas to provide reasonable security for the information.
4-110-103. Definitions.
As used in this chapter:
(1) (A) "Breach of the security of the system" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business.
(B) "Breach of the security of the system" does not include the good faith acquisition of personal information by an employee or agent of the person or business for the legitimate purposes of the person or business if the personal information is not otherwise used or subject to further unauthorized disclosure;
(2) (A) "Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered, or holding a license or authorization certificate under the law of this state, any other state, the United States, or of any other country or the parent or the subsidiary of a financial institution.
(B) "Business" includes:
(i) An entity that destroys records; and
(ii) A state agency;
(3) "Customer" means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business;
(4) "Individual" means a natural person;
(5) "Medical information" means any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a health care professional;
(6) "Owns or licenses" includes, but is not limited to, personal information that a business retains as part of the internal customer account of the business or for the purpose of using the information in transactions with the person to whom the information relates;
(7) "Personal information" means an individual's first name or first initial and his or her last name in combination with any one (1) or more of the following data elements when either the name or the data element is not encrypted or redacted:
(A) Social security number;
(B) Driver's license number or Arkansas identification card number;
(C) Account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account; and
(D) Medical information;
(E)(i) Biometric data.
(ii) As used in this subdivision (7)(E), "biometric data" means data generated by automatic measurements of an individual's biological characteristics, including without limitation:
(a) Fingerprints;
(b) Faceprint;
(c) A retinal or iris scan;
(d) Hand geometry;
(e) Voiceprint analysis;
(f) Deoxyribonucleic acid (DNA); or
(g) Any other unique biological characteristics of an individual if the characteristics are used by the owner or licensee to uniquely authenticate the individual's identity when the individual accesses a system or account;
(8) (A) "Records" means any material that contains sensitive personal information in electronic form.
(B) "Records" does not include any publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number; and
(9) "State agencies" or "state agency" means any agency, institution, authority, department, board, commission, bureau, council, or other agency of the State of Arkansas supported by cash funds or the appropriation of state or federal funds.
4-110-104. Protection of personal information.
(a) A person or business shall take all reasonable steps to destroy or arrange for the destruction of a customer's records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.
(b) A person or business that acquires, owns, or licenses personal information about an Arkansas resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
4-110-105. Disclosure of security breaches.
(a) (1) Any person or business that acquires, owns, or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(2) The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, or any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system.
(b)(1) A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee that there has been a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(2) If a breach of the security of a system affects the personal information of more than one thousand (1,000) individuals, the person or business required to make a disclosure of the security breach under subdivision (b)(1) of this section shall, at the same time the security breach is disclosed to an affected individual or within forty-five (45) days after the person or business determines that there is a reasonable likelihood of harm to customers, whichever occurs first, disclose the security breach to the Attorney General.
(c) (1) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
(2) The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d) Notification under this section is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers.
(e) For purposes of this section, notice may be provided by one (1) of the following methods:
(1) Written notice;
(2) Electronic mail notice if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. 7001, as it existed on January 1, 2005; or
(3) (A) Substitute notice if the person or business demonstrates that:
(i) The cost of providing notice would exceed two hundred fifty thousand dollars ($250,000);
(ii) The affected class of persons to be notified exceeds five hundred thousand (500,000); or
(iii) The person or business does not have sufficient contact information.
(B) Substitute notice shall consist of all of the following:
(i) Electronic mail notice when the person or business has an electronic mail address for the subject persons;
(ii) Conspicuous posting of the notice on the website of the person or business if the person or business maintains a website; and
(iii) Notification by statewide media.
(f) Notwithstanding subsection (e) of this section, a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies affected persons in accordance with its policies in the event of a breach of the security of the system.
(g)(1) A person or business shall retain a copy of the written determination of a breach of the security of a system and supporting documentation for five (5) years from the date of determination of the breach of the security of the system.
(2) If the Attorney General submits a written request for the written determination of the breach of the security of the system, the person or business shall send a copy of the written determination of the breach of the security of the system and supporting documentation to the Attorney General no later than thirty (30) days after the date of receipt of the request.
(3) The determination and documentation retained under this subsection are confidential and not subject to public disclosure.
4-110-106. Exemptions.
(a) (1) The provisions of this chapter do not apply to a person or business that is regulated by a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breaches of the security of personal information than that provided by this chapter.
(2) Compliance with the state or federal law shall be deemed compliance with this chapter with regard to the subjects covered by this chapter.
(b) This section does not relieve a person or business from a duty to comply with any other requirements of other state and federal law regarding the protection and privacy of personal information.
4-110-107. Waiver.
Any waiver of a provision of this chapter is contrary to public policy, void, and unenforceable.
4-110-108. Penalties.
Any violation of this chapter is punishable by action of the Attorney General under the provisions of 4-88-101 et seq.
4-88-101. Applicability of chapter.
This chapter does not apply to:
(1) Advertising or practices which are subject to and which comply with any rule, order, or statute administered by the Federal Trade Commission;
(2) Broadcasters, printers, publishers, and other persons engaging in the dissemination of information who do not have actual knowledge of the intent, design, purpose, or deceptive nature of the advertising or practice;
(3) Actions or transactions permitted under laws administered by the Insurance Commissioner, the Securities Commissioner, the State Highway Commission, the Bank Commissioner, or other regulatory body or officer acting under statutory authority of this state or the United States, unless a director of these divisions specifically requests the Attorney General to implement the powers of this chapter; or.
(4) Actions or transactions of a public utility which have been authorized by the Arkansas Public Service Commission, a municipal authority, the Federal Energy Regulatory Commission, the Federal Communications Commission, or other regulatory body or officer acting under statutory authority of the United States.
For more information, see here: https://www.arkleg.state.ar.us/Acts/Document?type=pdf&act=1030&ddBienniumSession=2019%2F2019R
AND
https://www.arkleg.state.ar.us/Bills/Detail?ddBienniumSession=2019%2F2019R&measureno=HB1943
AND
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.
| Attachment | Size |
|---|---|
 arkansas_personal_information_protection_act_act1030.pdf | 305.13 KB |