Law / United States / 
Idaho
Identity Theft Act, breach notification enforcement and penalties
In force since .
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect a violation of Idaho's breach notice duty to be enforced by your primary regulator, not by a private plaintiff.
- Avoid an intentional failure to give required notice; it carries a civil fine of up to $25,000 per breach.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which regulator is the 'primary regulator' under Idaho Code 28-51-104(6) of a commercial entity that holds both a federal charter and a license from the Idaho department of finance or department of insurance, and so may bring the civil action under Idaho Code 28-51-107?
What it makes you log
Logging duty
The section lets an entity's primary regulator bring a civil action to enforce the notice duty of section 28-51-105 and sets a fine of up to $25,000 per breach for an intentional failure to give notice. It names no record, log or audit, and a civil action is not a demand for a record. The section has no territorial clause of its own and cites the notice section only for the violation.
- Kind
- None
- As of
What this law does
An affected entity's own primary regulator, not a private plaintiff, enforces the notice duty: the primary regulator may bring a civil action to compel compliance and enjoin further violations, and an agency, individual, or commercial entity that intentionally fails to give notice is subject to a fine of up to $25,000 per breach. The chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .