Law / United States / 
Missouri
Notice of security breach of personal information
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected Missouri consumer of a breach of security involving their personal information without unreasonable delay.
- Notify the Missouri Attorney General's office and every nationwide consumer reporting agency without unreasonable delay if you provide notice to more than 1,000 consumers at one time.
- Do not rely on this statute to cover a breach of biometric, genetic, or student data alone. Missouri's personal information definition carries no such element.
These lines are LexLint's reading of the law's text. Also read by: Office of the Missouri Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://ago.mo.gov/get-help/programs-services-from-a-z/data-breaches/
- Guidance body
- Office of the Missouri Attorney General
- Open questions
- How likely must identity theft or other fraud be before a person may determine under Mo. Rev. Stat. ยง 407.1500.2(5) that a risk of identity theft or other fraud to any consumer "is not reasonably likely to occur" and skip consumer notice?
What it makes you log
What the log must hold
Decision basis
Log retention
Applies to the written determination that notice is not required (subsection 2(5)).
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A person need not notify consumers of a breach if, after an appropriate investigation or consultation with law enforcement, it determines that identity theft or other fraud is not reasonably likely; the determination must be documented in writing and the documentation maintained for five years (subsection 2(5)). Where law enforcement asks for delay, the request must be in writing or the person must document it contemporaneously in writing with the officer's name and agency (subsection 2(3)). The notice itself (subsection 2(1)) and the notice to the Attorney General and consumer reporting agencies when more than 1,000 consumers are notified (subsection 2(8)) are notifications, not logs. The section names no audit and no demand for the documentation. A person that owns or licenses the data of Missouri residents or conducts business in Missouri is covered, and a consumer is defined as a Missouri resident.
- Kind
- Explicit
- As of
- Provision
- Mo. Rev. Stat. 407.1500, subsection 2(5) (a determination that notice is not required, documented in writing and kept five years), with 2(3) (a law enforcement delay request documented in writing)
- Trigger
- security_incident
What this law does
Any person, defined to include an individual, corporation, or other legal or commercial entity as well as a government, governmental subdivision, agency, or instrumentality, that owns or licenses personal information of a Missouri resident, or that conducts business in Missouri and owns or licenses such information, must notify the affected consumer of a breach of security without unreasonable delay.
Personal information is limited to a name combined with a Social Security number, a driver's license or other unique government identification number, a financial account or card number with an access code, a unique electronic identifier or routing code with an access code, medical information, or health insurance information, and excludes information lawfully obtained from publicly available sources or government records made available to the general public; it carries no biometric, genetic, or student-data element.
A person providing notice to more than 1,000 consumers at one time must also notify the Attorney General's office and every nationwide consumer reporting agency without unreasonable delay. The Attorney General has exclusive authority to bring an action for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach or series of related breaches, and the statute creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .