Law / United States / 
Idaho
Identity Theft Act, breach of security disclosure duty
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Give notice to each affected Idaho resident as soon as possible, and in the most expedient time possible without unreasonable delay, after discovering a breach of system security involving personal information.
- If you are a government agency, also notify the Idaho Attorney General within 24 hours of discovering the breach; this duty does not extend to a private commercial entity.
- Do not treat a breach exposing only biometric, genetic, or health data as triggering this notice duty. Idaho's breach definition of personal information does not include those categories.
These lines are LexLint's reading of the law's text. Also read by: Idaho Office of the Attorney General, Consumer Protection Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's page states that a commercial entity that experiences a breach may notify the Attorney General's Office but is not required to do so.
- As of
- Guidance link
- https://www.ag.idaho.gov/consumer-protection/security-breaches/
- Guidance body
- Idaho Office of the Attorney General, Consumer Protection Division
- Open questions
- Does the 24-hour period for an agency to notify the Idaho Attorney General under Idaho Code 28-51-105(1) begin when a vendor that maintains the agency's data gives notice to the agency under Idaho Code 28-51-105(2), or only when the agency itself 'becomes aware of a breach of the security of the system'?
What it makes you log
Logging duty
The section requires a good-faith investigation into whether personal information has been or will be misused, notice to each affected Idaho resident, and, from an agency, notice to the Idaho attorney general within twenty-four hours of becoming aware of a breach. It requires no log or record to be kept and names no audit or access to a record. A state agency's separate duty to report to the office of the chief information officer under Idaho technology authority policies is mentioned but its terms are not in the section. Both prongs of the applicability clause are coded as hooks: conducting business in Idaho and holding information about an Idaho resident.
- Kind
- None
- As of
What this law does
An agency, individual, or commercial entity that owns or licenses computerized data including personal information must give notice as soon as possible, and in the most expedient time possible without unreasonable delay, to each affected Idaho resident following a breach of system security. A government agency must additionally notify the Idaho Attorney General within 24 hours of discovery; this duty does not extend to a private commercial entity.
Any governmental employee who intentionally discloses personal information not subject to disclosure otherwise allowed by law is guilty of a misdemeanor, punishable by up to a $2,000 fine, up to one year in county jail, or both.
Personal information is a resident's name combined with a Social Security number, a driver's license or Idaho identification card number, or a financial account or card number with an access code, and does not include publicly available information lawfully made available to the general public from government records or widely distributed media; it carries no biometric, genetic, or health element, so a breach exposing only biometric data does not trigger this duty.
The statute, added in 2006 and amended in 2014, sets no fixed numeric notice deadline and no consumer reporting agency threshold. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .