![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-58523-100x100.png\")
California is strict? There's NO civil or criminal penalty for failure to disclose. Hawaii's looking real good right about now.
![\"user-pic\"](\"/css/images/default.gif\")
What law pertains:
Are the companies bound by the laws of the state(s) ...where they have operations?
...where they are headquartered?
...or where their customers are located?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-84019-100x100.png\")
I looked through the page but couldn't find this - what is \"private right of action\"? Is that saying that people whose data have been stolen can sue?
@Anitra: Yes, \"private right of action\" means that the person whose data was stolen can sue the company for failing to inform him or her as required by the statute. In the states that do not have a private right of action, usually the company can still be found liable in a lawsuit brought by the state attorney general.
Awesome, according to the map, every single federal law would preempt stronger state laws and prevent identity theft victims from suing the person who leaked the data!
That means every Senator or Congressperson who sponsored one of the bills thinks their own state legislature is too stupid to pass a good law, so they're stopping them.
Congress cares! (about their banking and data mining corporate contributors who have sloppy data protection....)
@Imhotep: I'm in Hawaii and work as a computer tech with a specialty in information and data security. I just quit a company on art because they refused to take the recommended steps to protect confidential medical data and I didn't want to be in a position where civil and criminal charges could be brought against a company where I was responsible, in part, for the protection of that data. It is great for consumers and people in general, because laws like this force companies to take responsibility for the data they hold.
Rhode Islanders seem to have it best, having private right of action plus a civil/criminal penalty for failure to disclose!