Alaska Consumer Notification Laws

Statute Citation

Alaska Stat. §§ 45.48.010 through 45.48.090

Effective date: July 1, 2009

What Is A Breach?

Unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information, including acquisition by: photocopying; facsimile; other paper-based method; a device, including a computer that can read, write, or store information that is represented in numerical form; and other methods not identified.

When Is Notice Required?

Computerized data containing personal information: unencrypted.

Personal information: First name or first initial and last name in combination with (1) Social Security number; (2) drivers license or state identification number; (3) account, credit or debit card number; (4) personal code to access an account including a security code, access code, personal identification number or password; or (5) passwords, personal identification numbers, or other access codes for financial accounts in combination with any required security code, access code, or password that would permit access to an individual financial account.

When Is Notice Not Required?

Harm Trigger
Notice is not required if, after investigation and written notice to the Attorney General, there is no reasonable likelihood that harm has resulted or will result.

The determination must be documented in writing for five years.

Statutory
Credit reporting agency notice provision does not apply if the information collector is subject to the Gramm- Leach- Bliley Act (GLB).

Good Faith
Notice if not required if there has been a good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose if the employee or agent does not use the personal information for a purpose unrelated to a legitimate purpose or make further unauthorized disclosure.

Encryption
Notice is not required if the personal information was encrypted or redacted and the encryption key has not been accessed or acquired.

Who Must Notify?

An information collector that owns or licenses personal information in any form.

An information recipient that maintains personal information must notify and cooperate with the information distributor that owns or licenses the personal information.

Who Must Be Notified?

The individual.

The nationwide credit reporting agencies must be notified if more than 1,000 individuals receive notice at one time.

Regulatory/law enforcement notice not specifically addressed.

Required Contents of Notice

Not specifically addressed.

Timing of Notice

The most expedient manner possible and without unreasonable delay.

Notification may be delayed if a law enforcement agency determines that it will impede a criminal investigation.

Notification is required after the law enforcement agency determines that it will no longer interfere with the investigation.

Notification may be delayed to determine the scope of the breach and restore the reasonable integrity of the system.

Permitted Delivery of Notice

Written.

Electronic, if the person’s primary method of communication is electronic or if electronic notice is consistent with E- Sign requirements.

Substitute notice may be done if cost of providing notice exceeds $150,000 or number of persons exceeds 300,000 or sufficient contact information not available. All of the following must be done: (i) email notice; (ii) Web site posting; and (iii) notice to major statewide media.

Law Enforcement Contacts

Rick Svobodny, Esquire
Acting Attorney General of Alaska
123 Fourth Street
Diamond Courthouse
Juneau, AK 99811
(907)465-3600

FBI- Anchorage
101 East Sixth Avenue
Anchorage, Alaska 99501-2524
http://anchorage.fbi.gov
(907)276-4441

Secret Service - Anchorage
(907)271-5148

---