Missouri recently enacted a law which made it the 45th state to adopt data breach notification regulations. The law goes into effect August 28, 2009. Similar to other states’ laws, Missouri’s law applies to any persons and companies who have personal information of a Missouri resident, regardless of size, nature of business or other factors.
What Type of Information is Covered? Missouri’s law defines “personal information” expansively to include:
- social security numbers;
- driver’s license numbers or similar unique identification numbers created by a government body;
- financial account numbers (with a required security code, access code or password which would permit access to the account);
- credit card or debit card numbers (with a required security code, access code or password which would permit access to the account);
- unique electronic identifiers or routing codes (with a required security code, access code or password which would permit access to the account);
- medical information; and
- health insurance information.
What You Must Do After a Breach. If a breach occurs, you must provide notice to the Missouri resident that a breach has occurred without any unreasonable delay. That notice must include, at minimum:
- a description of the incident in general terms;
- the type of information that was obtained in the breach;
- a contact number for the person or company for further assistance; and
- contact information for consumer reporting agencies.