Law / United States / 
Maryland
Breach of the security of a system at a public institution of higher education: investigation, notice to the individual, web notice and remedy policy
Md. Code Ann., State Gov't §§ 10-13A-03(f) and 10-13A-04
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Disclosure
- Audit expectation
- none
What it requires
- If you are a public institution of higher education that collects an individual's personally identifiable information and you discover or are notified of a breach of the security of a system, conduct in good faith a reasonable and prompt investigation to determine whether unauthorized acquisition of the individual's information has occurred (State Gov't 10-13A-04(a)).
- If the investigation determines that a breach has occurred, notify the individual and your Chief Information Officer, directly or through a third party authorized under a written contract, and describe to the extent possible the categories of personally identifiable information that were, or are reasonably believed to have been, acquired (State Gov't 10-13A-04(b)(1) and (2)).
- If a breach involves the personally identifiable information of 1,000 or more individuals, post a notice describing the breach on the same webpage as your privacy notice and keep it publicly available for at least 1 year from the date notice was sent to the affected individuals (State Gov't 10-13A-04(b)(3)).
- Develop and adopt a policy establishing an appropriate remedy for individuals whose personally identifiable information has been affected by a breach (State Gov't 10-13A-03(f)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
After a breach the institution must investigate, notify the affected individual and its Chief Information Officer, and for a breach of 1,000 or more individuals post a notice for at least 1 year. The section requires no log, register or retention of a record; the year-long web notice is a public notice, not a record kept for a recipient.
- Kind
- None
- As of
What this law does
A breach of the security of a system is the unauthorized acquisition of personally identifiable information maintained by a public institution of higher education that creates a reasonable risk of harm to the individual whose information was acquired.
A breach does not include a good faith acquisition by an employee or agent for the institution's purposes, if the information is not used or further disclosed, or information secured by encryption or redacted for which the encryption key has not been compromised or disclosed.
When an institution that collects an individual's personally identifiable information discovers or is notified of a breach, it must conduct in good faith a reasonable and prompt investigation to determine whether unauthorized acquisition of that individual's information has occurred. If the investigation determines that a breach has occurred, the institution or a third party authorized under a written contract must notify the individual and the institution's Chief Information Officer.
The notification must include, to the extent possible, a description of the categories of personally identifiable information that were, or are reasonably believed to have been, acquired by an unauthorized person. If a breach involves the information of 1,000 or more individuals, the institution must post a notice describing the breach on the same webpage as its privacy notice for at least 1 year from the date notice was sent to the affected individuals.
Each institution must also adopt a policy establishing an appropriate remedy for individuals whose personally identifiable information has been affected by a breach.
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .