Law / United States / 
South Carolina
Business data breach of security, notification statute
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify each affected South Carolina resident of a breach of security involving personal identifying information in the most expedient time possible and without unreasonable delay.
- Notify the Consumer Protection Division of the Department of Consumer Affairs and all nationwide consumer reporting agencies if you notify more than 1,000 persons of a breach at one time.
- Expect a South Carolina resident injured by a violation of this statute to be able to sue you directly for damages, an injunction, and attorney's fees. This statute grants a private right of action on its face.
These lines are LexLint's reading of the law's text. Also read by: South Carolina Department of Consumer Affairs (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Administrative fine of $1,000 for each resident whose information was accessible by reason of the breach, decided by the Department of Consumer Affairs, available only for a knowing and willful violation; no fine is stated for a merely negligent violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 1,000
Who enforces it
Enforcement body
South Carolina Department of Consumer Affairs (administrative fine for a knowing and willful violation); private civil action by an injured resident.
Settledness
- As of
- Guidance link
- https://consumer.sc.gov/business-resourceslaws/reporting-security-breach-businesses
- Guidance body
- South Carolina Department of Consumer Affairs
- Open questions
- Does the duty to notify the Consumer Protection Division of the Department of Consumer Affairs and the consumer reporting agencies arise when a business notifies exactly 1,000 persons, as the Department's page states, or only when it notifies "more than one thousand persons at one time" under S.C. Code Ann. 39-1-90(K)?
What it makes you log
Logging duty
Section 39-1-90 requires a person conducting business in this State to notify an affected resident, and the owner or licensee of data the person only maintains, of a breach of the security of the system, and when more than one thousand persons are notified to tell the Consumer Protection Division and nationwide consumer reporting agencies of the timing, distribution and content of the notice. It requires no log, register or retained file of breaches or notices, names no audit, and gives no party a right to a record. A person's own notification procedures kept in an information security policy (subsection (F)) are a policy, not a record. The duty runs to a person conducting business in this State (an establishment prong) and the notice is owed to a resident of this State (a residence prong).
- Kind
- None
- As of
What this law does
A person conducting business in South Carolina that owns or licenses computerized data including personal identifying information must disclose a breach of the security of the system to an affected South Carolina resident in the most expedient time possible and without unreasonable delay, where the breach creates a material risk of harm.
Personal identifying information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, or another government-issued identifying number; biometric, genetic, or health data is not folded into this definition. If a business notifies more than 1,000 persons at one time, it must also notify the Consumer Protection Division of the Department of Consumer Affairs and nationwide consumer reporting agencies.
The current definition of personal identifying information took effect ; the notification duty itself took effect . A resident injured by a violation may bring a civil action for damages (willful and knowing violations) or actual damages (negligent violations), seek an injunction, and recover attorney's fees, an express, direct private right of action rather than one reached indirectly through a deeming clause.
An administrative fine of $1,000 per affected resident is also available to the Department of Consumer Affairs for a knowing and willful violation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .