RSA 359-C:19 · Definitions

359-C:19 Definitions. – In this subdivision:

Copy link

I.

"Computerized data" means personal information stored in an electronic format.

Copy link

II.

"Encrypted" means the transformation of data through the use of an algorithmic process into a form for which there is a low probability of assigning meaning without use of a confidential process or key, or securing the information by another method that renders the data elements completely unreadable or unusable. Data shall not be considered to be encrypted for purposes of this subdivision if it is acquired in combination with any required key, security code, access code, or password that would permit access to the encrypted data.

Copy link

III.

"Person" means an individual, corporation, trust, partnership, incorporated or unincorporated association, limited liability company, or other form of entity, or any agency, authority, board, court, department, division, commission, institution, bureau, or other state governmental entity, or any political subdivision of the state.

Copy link

IV.

(a) "Personal information" means an individual's first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

Copy link

(1)

Social security number.

Copy link

(2)

Driver's license number or other government identification number.

Copy link

(3)

Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.

Copy link

(b)

"Personal information" shall not include information that is lawfully made available to the general public from federal, state, or local government records.

Copy link

V.

"Security breach" means unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in this state. Good faith acquisition of personal information by an employee or agent of a person for the purposes of the person's business shall not be considered a security breach, provided that the personal information is not used or subject to further unauthorized disclosure. Source. 2006, 242:1, eff. Jan. 1, 2007.

Copy link