Law / United States / 
South Carolina
State agency breach of security notification
In force since .
A breach notification rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- This binds an agency of this State that owns, licenses or maintains computerized data or other data that includes personal identifying information, meaning any agency, department, board, commission, committee, or institution of higher learning of the State or a political subdivision of it (section 1-11-490(A), (B) and (D)(1)).
- Disclose a breach of the security of the system to each South Carolina resident whose unencrypted and unredacted personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay (section 1-11-490(A)).
- If you maintain such data you do not own, notify the owner or licensee of the information of a breach immediately following discovery (section 1-11-490(B)).
- If you give notice to more than one thousand persons at one time, notify the Consumer Protection Division of the Department of Consumer Affairs and every nationwide consumer reporting agency, without unreasonable delay, of the timing, distribution and content of the notice (section 1-11-490(I)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Administrative fine of up to $1,000 for each resident whose information was accessible by reason of the breach, decided by the Department of Consumer Affairs, for a knowing and wilful violation only.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 1,000
Who enforces it
Enforcement body
South Carolina Department of Consumer Affairs (administrative fine for a knowing and wilful violation); private civil action by an injured resident.
What this law does
An agency of this State that owns or licenses computerized data or other data that includes personal identifying information must disclose a breach of the security of the system, following discovery or notification of the breach, to a resident of this State whose unencrypted and unredacted personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person.
The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
An agency that maintains such data it does not own must notify the owner or licensee of the information of a breach immediately following discovery, if the personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. An agency means any agency, department, board, commission, committee, or institution of higher learning of the State or a political subdivision of it.
Personal identifying information has the same meaning as in section 16-13-510(D) of the South Carolina Code. If an agency gives notice to more than one thousand persons at one time, it must also notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs and every nationwide consumer reporting agency of the timing, distribution, and content of the notice.
A resident of this State who is injured by a violation may institute a civil action to recover damages, seek an injunction to enforce compliance, and recover attorney's fees and court costs if successful. An agency that knowingly and wilfully violates the section is subject to an administrative fine of up to one thousand dollars for each resident whose information was accessible by reason of the breach, the amount to be decided by the Department of Consumer Affairs.