Crawls the web, in Alabama

Ala. Code § 13A-8-112 · Read the law's page

• Ordinary access to a public-facing Alabama website is not, by itself, computer tampering; a violation requires acting without authority or exceeding authorization of use, and separately doing one of the eight listed acts such as altering, damaging, disclosing, taking, or disrupting a computer, program, or data.
• Because exceeding authorization of use is defined as using access you do have to obtain or alter information you are not entitled to obtain or alter, do not use a login or other legitimate access to a computer, computer system, or network to take or alter data beyond what you are authorized to take or alter.
• Penalties escalate with harm: the base offense is a Class A misdemeanor, an unlawful-benefit or defraud intent raises it to a Class C felony, a victim loss over $2,500 or interference with a government or utility service raises it to a Class B felony, and a victim loss over $100,000 or physical injury raises it to a Class A felony.

Ala. Code secs. 8-38-3, 8-38-10 · Read the law's page

• Implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security. The measures required are those practicable for the entity, including consideration of: designating an employee or employees to coordinate the effort, identifying internal and external risks, adopting and assessing information safeguards, retaining service providers contractually required to maintain appropriate safeguards, evaluating and adjusting the measures for changed circumstances, and keeping management, including the board of directors where one exists, informed of the overall status of the measures. An assessment of the entity's security looks at its measures as a whole, emphasizing failures that are multiple or systemic, and weighs the entity's size, the amount and type of information and activities, and its cost of the measures relative to its resources.
• Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.
• This binds any covered entity (a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information of an Alabama resident) and any third-party agent it contracts with to maintain, store, process, or access that information. An entity already subject to and complying with a federal or state data-breach-notification regime at least as thorough as this chapter is exempt from the entire chapter.
• There is no private right of action for a violation of either duty. Only the Attorney General may bring an action for civil penalties under the chapter, and the chapter's only stated civil-penalty amounts (up to $500,000 per breach, or $5,000 per day) are tied expressly to a violation of the chapter's separate notification provisions, not to this reasonable-security-measures or disposal duty; no distinct penalty figure is stated for either duty. The Attorney General may also sue for actual damages on behalf of named individuals (Section 8-38-9(b)(2)), and may sue a state, county or municipal official or employee to compel performance of the official's duties under the chapter, while government entities themselves are exempt from civil penalties (Section 8-38-9(b)(6)).