Delaware Security Breach Law - Right to Sue for Triple Damages

Delaware has enacted a Security Breach notification law (House Bill 116).

The new law requires that any person or company that:

(A) Conducts business in Delaware

AND

(B) Owns or licenses computerized data that includes personal information

AND

(a) Discovers that the unencrypted personal information of a
Delaware Resident was,

OR

(b) Is reasonably believed to have been,


Acquired by an unauthorized person,

To:

Notify the Delaware resident of any breach of the security of the system.



The law also requires a person or a company that maintains computerized data with personal information to that the do not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery of a breach, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

“Security Breach” means:

“The unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by an individual or a commercial entity.”

The law provides that:

“Good faith acquisition of personal information by an employee or agent of an individual or a commercial entity for the purposes of the individual or the commercial entity is not a breach of the security of the system, provided that the personal information is not used for or is not subject to further unauthorized disclosure.”

The law allows Delaware residents to sue for TRIPLE damages, plus attorney’s fees.

The state Attorney General can also sue.