Ships a mobile app, in District of Columbia

D.C. Code § [28-3852.01] (Title 28, Chapter 38, Subchapter II, "Security requirements," added by the Security Breach Protection Amendment Act of 2020, D.C. Law 23-98, § 2(a)(5), 67 DCR 3923) · Read the law's page

• This binds any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of an individual residing in the District of Columbia; a person or entity already subject to and in compliance with the security-procedure requirements of the Gramm-Leach-Bliley Act, HIPAA, or the HITECH Act is deemed to comply.
• Implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information you hold and to your own nature and size.
• If you disclose a District resident's personal information to a nonaffiliated third-party service provider, require by written agreement that the third party implement and maintain its own reasonable security procedures and practices over that information.
• When destroying records that contain personal information of your consumers, employees or former employees, including computerized or electronic records and devices, take reasonable steps to protect against unauthorized access to or use of the information, considering the sensitivity of the records, your own nature and size, the costs and benefits of different destruction methods, and available technology.
• A violation is enforced as an unfair or deceptive trade practice: the Attorney General may sue for injunctive relief and a civil penalty of up to $5,000 for a first violation and up to $10,000 for each subsequent violation, and a consumer may bring a private action in which the damages are actual damages, excluding pain and suffering, rather than the treble-damages-or-$1,500-per-violation floor available for most other violations of the Consumer Protection Procedures Act; attorney's fees, punitive damages and an injunction remain available.