Processes personal data, in Alaska

Alaska Stat. Sec. 45.48.080 · Read the law's page

• Expect a violation of Alaska's breach notification duty by a non-governmental information collector to be pursued as an unfair or deceptive act or practice, which can arm a private plaintiff, not only the state.
• Do not assume a private plaintiff's recovery follows the general treble-damages rule of Alaska's Unfair Trade Practices Act. A breach notification violation caps recovery to actual economic damages not exceeding $500 under one cross-referenced remedy, and to actual economic damages under the other.
• Expect a civil penalty of up to $500 for each unnotified Alaska resident, capped at $50,000 total, regardless of whether the violator is a government agency or a private information collector.

Alaska Stat. Secs. 45.48.010-45.48.070 · Read the law's page

• Disclose a breach of the security of an information system containing an Alaska resident's personal information to each affected resident in the most expeditious time possible and without unreasonable delay.
• Document and retain for five years any determination, made after investigation and written notice to the Alaska Attorney General, that a breach is unlikely to cause resident harm and so does not require disclosure.
• Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Alaska's personal information definition does not include any of those categories.

Alaska Stat. Secs. 45.48.500-45.48.590 · Read the law's page

• This binds a business (a person who conducts business in Alaska, or who conducts business and holds personal information on Alaska residents) and a state or local governmental agency other than a judicial-branch agency that disposes of records containing personal information; a business already complying with the Gramm-Leach-Bliley Act's disposal rule or the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w, is exempt, as is disposal that federal law requires to be done in a manner this duty does not permit.
• When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.
• Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.
• Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.
• A knowing violation draws a civil penalty of up to $3,000 payable to the state, and a person damaged by a violation may separately sue to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees.