Law / United States / 
District of Columbia
Security requirements for personal information (Security Breach Protection Amendment Act of 2020)
D.C. Code § [28-3852.01] (Title 28, Chapter 38, Subchapter II, "Security requirements," added by the Security Breach Protection Amendment Act of 2020, D.C. Law 23-98, § 2(a)(5), 67 DCR 3923)
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of an individual residing in the District of Columbia; a person or entity already subject to and in compliance with the security-procedure requirements of the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act (HIPAA), or the HITECH Act is deemed to comply.
- Implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information you hold and to your own nature and size.NIST CSF 2.0PR.DS-01
- If you disclose a District resident's personal information to a nonaffiliated third-party service provider, require by written agreement that the third party implement and maintain its own reasonable security procedures and practices over that information.NIST CSF 2.0GV.SC-05
- When destroying records that contain personal information, including computerized or electronic records and devices, take reasonable steps to protect against unauthorized access to or use of the information, considering the sensitivity of the records, your own nature and size, the costs and benefits of different destruction methods, and available technology.NIST CSF 2.0ID.AM-08
- A violation is enforced as an unfair or deceptive trade practice: the Attorney General may sue for injunctive relief and a civil penalty of up to $5,000 for a first violation and up to $10,000 for each subsequent violation, and a consumer may bring a private action limited to actual damages rather than the treble-damages-or-$1,500-per-violation floor available for most other violations of the Consumer Protection Procedures Act.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty the Attorney General for the District of Columbia may recover under D.C. Code 28-3909(b), which names [28-3852.01] directly among the sections it covers. The ceiling is $5,000 for each violation by a merchant that commits a first violation, and $10,000 for each subsequent violation by a merchant that repeats the same violation; the higher tier is coded. The Attorney General also recovers economic damages and the costs of the action, with no aggregate cap stated. A consumer's own private action for the same violation, available under D.C. Code 28-3905(k) because 28-3853(b) designates a violation of this subchapter an unfair or deceptive trade practice under 28-3904(kk), is limited to actual damages rather than the treble-damages-or-$1,500-per-violation floor available for most other violations of the Consumer Protection Procedures Act.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Attorney General for the District of Columbia enforces this section as an unfair or deceptive trade practice under the Consumer Protection Procedures Act, and a consumer may also bring a private action for the same violation under D.C. Code § 28-3905(k).
Settledness
- As of
- Open questions
- Which safeguards are "reasonable" under D.C. Code 28-3852.01(a), given "the nature of the personal information and the nature and size of the entity or operation"?
- Does a person or entity that meets the security rules of Title V of the Gramm-Leach-Bliley Act, HIPAA or the HITECH Act only for part of the personal information it holds count as "subject to and in compliance with" them under D.C. Code 28-3852.01(d) for the rest?
What this law does
Any person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District of Columbia must implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information and the nature and size of the entity or operation.
The same person or entity must require by written agreement that a nonaffiliated third-party service provider implement and maintain reasonable security procedures and practices over any personal information disclosed to it. When destroying records that contain personal information, the same person or entity must take reasonable steps to protect against unauthorized access to or use of that personal information.
A person or entity already subject to and in compliance with the security-procedure requirements of Title V of the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, or the Health Information Technology for Economic and Clinical Health Act is deemed to be in compliance with this section. A violation of this section is, like a violation of the notification duty in the same subchapter, an unfair or deceptive trade practice under the Consumer Protection Procedures Act.
The Attorney General may enforce it for a civil penalty of up to $5,000 for a first violation and up to $10,000 for each subsequent violation. A consumer may also bring a private action for the same violation, but limited to actual damages.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .