Law / United States / 
U.S. Virgin Islands
Disclosure of Breach of Security (Identity Theft and Privacy Protection)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://law.justia.com/codes/virgin-islands/2019/title-14/chapter-110/subchapter-i/2209/In force.
A breach notification rule binding public and private bodies.
What it requires
- Notify an affected Virgin Islands resident without unreasonable delay after discovering that unencrypted personal information (a name combined with a Social Security number, driver's license number, or financial account number with its access code) was acquired without authorization.
- Where direct notice is impractical because of cost, the number of residents affected, or insufficient contact information, give substitute notice by email, a conspicuous website posting, and notice to major territory-wide media.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Any person or business that conducts business in the Virgin Islands and owns or licenses computerized personal information must disclose a breach of security to an affected territory resident without unreasonable delay following discovery, and Section 2208 imposes the identical duty on a Virgin Islands government agency.
Covered personal information is a resident's first name or initial and last name combined with an unencrypted Social Security number, driver's license number, or financial account, credit, or debit card number together with any required access code, and excludes information lawfully made available to the public through government records.
Where direct notice would cost more than $100,000, would reach more than 50,000 residents, or the covered entity lacks sufficient contact information, substitute notice by email, a conspicuous website posting, and notice to major territory-wide media satisfies the duty. No statement of the day the sections came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .