Disclosing Information Security Breaches Under Privacy and Securities Laws

The Privacy Rights Clearinghouse estimates that over 100 million records containing sensitive personal information have been involved in security breaches. This non-profit consumer organization has tracked these breaches on its website (www.privacyrights.org) beginning with the significant and well-publicized ChoicePoint breach in February 2005. As a result, over two-thirds of states enacted security breach notification laws governing the notification that a company must make in the event of a security breach. This article outlines the requirements for providing notification of a security breach under state security breach notification law by any company and the factors that a public company needs to take into account regarding whether to disclose a security breach under federal securities law.