Processes biometric data, in South Dakota

SDCL secs. 22-40-19 to 22-40-26 (SL 2018 ch. 135) · Read the law's page

• Notify each affected South Dakota resident of a breach of system security not later than 60 days after discovery, absent a law enforcement delay.
• Notify the South Dakota Attorney General by mail or electronic mail if a breach affects more than 250 South Dakota residents. This threshold is 250, not 250,000.
• Treat biometric data as a breach-notification trigger only when it is paired with an employer-assigned identification number used for authentication, not on its own.
• Do not assume a private right of action is settled either way for a notice violation here. It is left as an open question here: a deeming-plus-UDAP chain to SDCL sec. 37-24-31 exists in the text with no exclusivity clause closing it, but no confirming case is located.