Chapter 48

COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 1CHAPTER 48 NOTIFI CATION OF BREACHES OF PERSONAL INFORMATI ON SOURCE: This entire chapter added by P.L. 30 -004:1 (Mar. 13, 2009) . 2009 COMMENT: See § 48.70 for the effective date of this Chapter. § 48.10. Legislative Findings and Intent . § 48.20. Definitio ns. § 48.30. Disclosure of Breach of Security of Computerized Personal Information by an Individual orEntity . §48.40. Procedures Deemed in Compliance with Security Breach Requirements . § 48.50. Violations . § 48.60. Applicability. § 48.70. Effective Date . § 48.80. Preemption. § 48. 10. Legislative Findings and Intent. I Liheslaturan Guåhan finds that both public and private entities on Guam have a duty to safeguard personal information that, ifstolen or publicized, may result in crimes such as fraud an d identity theft. The anonymity of the global internet, that transcends the borders of sovereign nations, makes it possible for unscrupulous individuals to profit from the theft of personal information and never be brought to justice for their c rimes ormade to pay restitution.

ders of sovereign nations, makes it possible for unscrupulous individuals to profit from the theft of personal information and never be brought to justice for their c rimes ormade to pay restitution. Therefore, it is incumbent upon all entities that are entrusted with such data to maintain strong security systems to ensure that the personal information will always be protected. It is the intent of I Liheslatura to ensure that t he personal information of the residents of Guam is protected, by providing procedures for notification of security breaches related to personal information and there by encouraging individuals and commercial entities, as defined by public law, to provide r easonable security for unencrypted personal information. § 48. 20. Definitions. As used in this Chapter: (a) Breach of the security of a system means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromise s the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 2information regarding multiple

ion maintained by an individual or entity as part of a database of personal COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 2information regarding multiple individuals and that cause s, orthe individual orentity reasonably believes has caused or willcause, identity theft or other fraud to any resident of Guam. Good faith acquisition of personal information by an employee or agent of an individual orentity for the purposes of the individual orthe entity is not a breach of the security of the system , provided, that the personal information is notused for a purpose other than a lawful purpose of the individual orentity or subject to further unauthorized disclosure. (b) Entity includes corporations, business trusts, estate s, partnerships, limited par tnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, orinstrumentalities, orany other legal entity, whether for profit ornot-for-profit. (c)Encrypted means transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning

her legal entity, whether for profit ornot-for-profit. (c)Encrypted means transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process orkey, or securing the information by another method that re nders the data elements unreadable or unusable. (d) Financial institution has the meaning given that term in Section 6809(3) of Title 15, United States Code. (e) Individual means a natural person. (f) Personal information means the first name, orfirst i nitial, and last name in combination with and linked to any one ormore of the following data elements that relate to a resident of Guam, when the data elements are neither encrypted norredacted: (1)Social Security number; (2)Driver’s license number or Guam identification card number issued in lieu of a driver’s license; or (3)Financial account number, or credit card ordebit card number, in combination with any required security code, access code, orpassword that would permit access to a resident’s financial accounts. (4)The term does not include information that is lawfully obtained from publicly available information, orfrom

de, access code, orpassword that would permit access to a resident’s financial accounts. (4)The term does not include information that is lawfully obtained from publicly available information, orfrom Federal, State, COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 3orlocal government records lawfully made available to the general public. (g) Notice means: (1)Written notice to the postal address in the records of the individual orentity; (2)Telephone notice; (3)Electronic notice ; or (4)Substitute notice, if the individual orthe entity required to provide notice demonstrates that the cost of providing notice wil l exceed Ten Thousand Dollars ($10,000), orthat the affected class of residents to be notified exceeds five thousand (5,000) persons, or that the individual or the entity does nothave sufficient contac t information orconsent to provide notice as describ ed in paragraphs 1, 2, or3. Substitute notice consists of any two (2) of the following: (A)E-mail notice ifthe individual orthe entity has e -mail addresses for the members of the affected class of residents; (B)Conspicuous posting of the notice on th e Website of the individual

lowing: (A)E-mail notice ifthe individual orthe entity has e -mail addresses for the members of the affected class of residents; (B)Conspicuous posting of the notice on th e Website of the individual orthe entity, ifthe individual orthe commercial entity maintains a Website; and (C)Notice to major Guam media. (h) Redact means alteration ortruncation of data such that nomore thanthe following are accessible as part o f the personal information: (1) five (5) digits of a Social Security Number, or (2) The last four (4) digits of a driver's license number, Guam identification card number orfinancial account number. § 48. 30. Disclosure of Breach of Security of Computeri zed Personal Information by an Individual orEntity. (a) General Rule . An individual orentity that owns orlicenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notif ication of the breach of the security of the system to any resident of Guam whose unencrypted and unredacted personal information was oris reasonably believed to have been accessed and acquired by an unauthorized person and COL 0528099GCA CRIMES AND CORRECTIONS

ident of Guam whose unencrypted and unredacted personal information was oris reasonably believed to have been accessed and acquired by an unauthorized person and COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 4that causes, orthe individual orentity reasonably believes has caused or will cause, identity theft orother fraud to any resident of Guam. Except as provided in subsection (d) of this Section, o rin order to take any measures necessary to determine the scope of the breach and to res tore the reasonable integrity of the system, the disclosure shall be made without unreasonable delay. (b) Encrypted Information . An individual orentity must disclose the breach of the security of the system ifencrypted information is acce ssed and acqu ired in an unencrypted form, orifthe security breach involves a person with access to the encryption key and the individual orentity reasonably believes that such breach has caused orwill cause identity theft or other fraud to any resident of Guam. (c) An individual orentity that maintains computerized data that includes personal information that the individual orentity does not own or license shall

theft or other fraud to any resident of Guam. (c) An individual orentity that maintains computerized data that includes personal information that the individual orentity does not own or license shall notify the owner orlicensee of the information of any breach of the security of the system as soon a s practicable following discovery, if the personal information was, orif the entity reasonably believes was, accessed and acquired by an unauthorized person. (d) Notice required by this Section may be delayed ifa law enforcement agency determines and a dvises the individual orentity that the notice will impede a criminal orcivil investigation, orhomeland ornational security. Notice required by this Section must be made without unreasonable delay after the law enforcement agency determines that notif ication will no longer impede the investigation orjeopardize national orhomeland security. § 48. 40. Procedures Deemed in Compliance with Security Breach Requirements. (a) Information Privacy orSecurity Policy. An entity that maintains its own notific ation procedures as part of an information privacy orsecurity policy for the treatment of personal information and that are consistent with

orSecurity Policy. An entity that maintains its own notific ation procedures as part of an information privacy orsecurity policy for the treatment of personal information and that are consistent with the timing requirements of this Chapter shall be deemed to be in compliance with the notification requirements of t his Chapter ifit notifies residents of Guam in accordance with its procedures in the event of a breach of security of the system. (b) Compliance with Federal requirements.COL 0528099GCA CRIMES AND CORRECTIONS CH.48NOTIFICATION OF BREACHES OF PERSONAL INFORMATION 5(1) A financial institution that complies with the notification requirements pre scribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with this Chapte r. (2) An entity that complies with the notification requirements or procedu res pursuant to the rules, regulations, procedures, orguidelines established by the entity’s primary orfunctional Federal regulator shall be in compliance with this Chapter. § 48. 50. Violations .

du res pursuant to the rules, regulations, procedures, orguidelines established by the entity’s primary orfunctional Federal regulator shall be in compliance with this Chapter. § 48. 50. Violations . (a) A violation of this Chapter that results in injury orloss to residents of Guam may be enforced by the Office of the Attorney General. (b) Except as provided by § 48. 40 of this Chapter, the Office of the Attorney General shall have exclusive authority to bring action and may obtain either actual damages for a violation of this Chapter ora civil penalty not to exceed One Hundred Fifty Thousand Dollars ($150,000) per breach of the security of the system orseries of breaches of a similar nature that are discovered in a single investigation. § 48. 60. Applicabilit y. This Chapter shall apply to the discovery ornotification of a breach of the security of the system that occurs on orafter the effective date of this Chapter. § 48. 70. Effective Date. This Chapter shall take effect one hundred twenty (120) days af ter the date of enactment. § 48. 80. Preemption. This Chapter deals with subject matter that is of island -wide concern, and it is the intent of I Liheslatura that this Chapter

d twenty (120) days af ter the date of enactment. § 48. 80. Preemption. This Chapter deals with subject matter that is of island -wide concern, and it is the intent of I Liheslatura that this Chapter shall supersede and preempt all rules and regulations regarding the matters e xpressly set forth in this Chapter. ----------