Law / United States / 
Arkansas
Arkansas Personal Information Protection Act, breach notification and security
Ark. Code Ann. secs. 4-110-101 to 4-110-108
In force.
A breach notification rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Kept, Produced on request
What it requires
- Implement and maintain reasonable security procedures and practices to protect Arkansas residents' personal information, and dispose of records containing it in a manner that renders the information unreadable or undecipherable.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkPR.DS-P3
- Notify each affected Arkansas resident of a breach of security without unreasonable delay.NIST Privacy FrameworkCM.AW-P7
- Notify the Arkansas Attorney General if the breach affects more than 1,000 individuals, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever occurs first.NIST Privacy FrameworkCM.AW-P7
- Treat faceprint and voiceprint data as personal information capable of triggering this Act's security and breach duties. PIPA names them directly with no exclusion for data derived from a photograph or recording.
- Do not assume PIPA violations are shielded from private suit. Whether the Arkansas Deceptive Trade Practices Act's private right of action reaches a PIPA violation has not been confirmed either way; treat it as an open question rather than a cleared risk.
These lines are LexLint's reading of the law's text. Also read by: Arkansas Attorney General (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://arkansasag.gov/divisions/public-protection/identity/security-or-data-breach/
- Guidance body
- Arkansas Attorney General
- Open questions
- Is notice to the Attorney General under Ark. Code Ann. 4-110-105 owed for a breach affecting more than 1,000 individuals only when the person or business determines that there is a reasonable likelihood of harm to customers, as the Attorney General's page says, or also when it notifies an affected individual without making that determination?
- Does the Attorney General notice duty in Ark. Code Ann. 4-110-105(b)(2), which binds 'the person or business required to make a disclosure of the security breach under subdivision (b)(1)', reach an owner or licensee that notifies individuals, or only a person that maintains data it does not own?
What it makes you log
Who may demand the log
Regulator
Log retention
Subdivision (g)(1): five years from the date of determination of the breach.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A person or business must keep a copy of the written determination of a breach of the security of a system, with its supporting documentation, for five years from the date of the determination, and must send a copy to the Attorney General within 30 days of a written request. The determination and documentation are confidential and not open to public disclosure (subdivision (g)(3)). The subsection names no field of the record from the closed list. Section 4-110-104(a) separately requires records containing personal information to be destroyed when no longer to be retained, which limits the personal data and not this record.
- Kind
- Explicit
- As of
- Provision
- Ark. Code Ann. sec. 4-110-105(g), added by Act 1030 of 2019, Section 3
- Trigger
- security_incident
What this law does
PIPA requires an individual, business, or state agency that acquires, owns, or licenses personal information of an Arkansas resident to implement and maintain reasonable security procedures, dispose of records properly, and notify affected Arkansas residents of a breach of security without unreasonable delay.
If a breach affects more than 1,000 individuals, the person or business must also notify the Attorney General, at the same time as consumer notice or within 45 days of determining a reasonable likelihood of harm, whichever is first.
Biometric data, including faceprint and voiceprint, is one of the data elements that makes information personal information for these purposes, named with no exclusion for data derived from a photograph or recording, but PIPA imposes no separate capture-consent, retention, or destruction duty on biometric data as such.
PIPA violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act; whether that Act's own private-suit provision, section 4-88-113, also arms a private plaintiff for a PIPA violation specifically was not confirmed from primary text and is left as an open question rather than a decided finding. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .