Law / United States / 
Guam
Notification of Breaches of Personal Information
In force.
A breach notification rule binding public and private bodies.
- Enforcement body
- Attorney General of Guam (exclusive)
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- If you own or license computerized data that includes personal information, disclose a breach of the security of the system, without unreasonable delay following discovery or notification of the breach, to any Guam resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person, where the breach causes, or you reasonably believe it has caused or will cause, identity theft or other fraud to any resident of Guam.
- If you hold a Guam resident's computerized personal information for another owner or licensee rather than for yourself, notify that owner or licensee as soon as practicable after discovering a breach.
- Do not treat this chapter as reaching biometric data: its personal-information definition covers only a Social Security number, a driver's license or Guam ID number, or a financial account or card number, none of them biometric.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty only, not to exceed $150,000 per breach of the security of the system or per series of breaches of a similar nature discovered in a single investigation; the Attorney General may instead elect actual damages.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 150,000
What it makes you log
Logging duty
Section 48.30 requires an individual or entity that owns or licenses computerized personal information to disclose a breach of the security of the system to any resident of Guam whose unencrypted and unredacted information was acquired, and requires one that maintains data it does not own to notify the owner as soon as practicable after discovery. Section 48.40 deems an entity with its own notification procedures, or one that follows its federal regulator's rules, in compliance, and section 48.50 lets the Attorney General enforce with a civil penalty of up to $150,000 per breach. The chapter requires notices only and no record of the breach, its investigation or the notices sent. The reach is the resident whose information was breached.
- Kind
- None
- As of
What this law does
An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to any affected Guam resident without unreasonable delay once it discovers or is notified of the breach and reasonably believes it has caused or will cause identity theft or other fraud; an entity holding such data for another owner or licensee must instead notify that owner or licensee as soon as practicable.
Personal information is a first name or initial and last name combined with a Social Security number, a driver's license or Guam identification card number, or a financial account, credit, or debit card number together with any required access code, and it excludes information lawfully obtained from publicly available sources or government records; the definition carries no biometric-data category.
Guam added this chapter on and its own text sets the chapter's effective date at one hundred twenty days after that enactment date, without stating the resulting calendar day; the Office of the Attorney General has exclusive authority to enforce it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .