Law / United States / 
District of Columbia
Consumer Security Breach Notification
D.C. Code §§ 28-3851 to 28-3853 (Title 28, Chapter 38, Subchapter II)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Breach notice, Biometric
- Audit expectation
- none
What it requires
- If your business conducts business in the District of Columbia and discovers a breach of the security of a system containing a District resident's personal information, notify each affected resident in the most expedient time possible and without unreasonable delay.
- Personal information covered by this duty includes biometric data generated by automatic measurements of biological characteristics, such as a fingerprint, voice print, genetic print, or retina or iris image, when used to authenticate identity.
- If the breach affects 50 or more District residents, also give written notice to the Office of the Attorney General for the District of Columbia, no later than when you notify residents.
- Notifying more than 1,000 people also requires notifying the nationwide consumer reporting agencies of the timing, distribution, and content of the notices.
- A violation of this notification duty is enforced as an unfair or deceptive trade practice and can be brought by a consumer, but recovery for this specific violation is limited to actual damages rather than the treble-damages-or-$1,500-per-violation floor available for other consumer protection violations.
- Information that is lawfully made available to the general public from government records is not personal information for purposes of this duty.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General for the District of Columbia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 28-3853(b) makes a violation of the subchapter an unfair or deceptive trade practice under section 28-3904(kk), and section 28-3909(a) lists sections 28-3851 and 28-3852 among the provisions whose violation the Attorney General may sue on. In that action the Attorney General recovers from a merchant a civil penalty of not less than $500 and not more than $5,000 for each first violation, and not less than $1,000 and not more than $10,000 for each subsequent violation of the same kind. The highest tier is recorded.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Office of the Attorney General for the District of Columbia
Settledness
- As of
- Guidance link
- https://oag.dc.gov/about-oag/laws-legal-opinions/requirements-districts-data-breach-notification
- Guidance body
- Office of the Attorney General for the District of Columbia
- Open questions
- Does the civil penalty that section 28-3909(b) recovers "from a merchant" reach a person or entity that owes the section 28-3852 notification duty but sells no consumer goods or services?
What it makes you log
Logging duty
Section 28-3852 requires a person or entity that conducts business in the District, and discovers a breach of the security of a system holding a resident's personal information, to notify each affected resident, to notify the owner where it only holds the data, to send the Attorney General written notice with listed contents when 50 or more residents are affected, and to notify nationwide consumer reporting agencies when more than 1,000 are notified. Those are notices sent to others; the text sets no duty to document the breach or keep a copy, no retention period, no audit and no right to inspect any record. Section 28-3853 makes a violation an unfair or deceptive trade practice. The security requirements in sections 28-3852.01 to 28-3852.03 are not cited by the row. The reach is conducting business in the District (establishment) and the residence of the person notified.
- Kind
- None
- As of
What this law does
Any person or entity conducting business in the District that owns or licenses computerized data containing personal information must notify affected District residents in the most expedient time possible after discovering a breach of the security of the system, and must also notify the Office of the Attorney General in writing if the breach affects 50 or more residents.
Personal information covered by the notification duty includes biometric data such as a fingerprint, voice print, genetic print, or retina or iris image used to authenticate identity. A violation of this notification duty is an unfair or deceptive trade practice under the Consumer Protection Procedures Act.
For this specific violation, though, a consumer's private recovery is limited to actual damages rather than the treble-damages-or-$1,500-per-violation floor available for other violations of that Act. The definition of personal information excludes information that is publicly available from government records. The statute was enacted in 2007 and amended in 2020 by the Security Breach Protection Amendment Act.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .