Law / United States / 
West Virginia
Breach of Security of Consumer Information
W. Va. Code secs. 46A-2A-101 to 46A-2A-105
In force.
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected West Virginia resident of a breach of security involving personal information without unreasonable delay.
- Notify each nationwide consumer reporting agency if you are required to notify more than 1,000 persons of a breach.
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. It does not fold any of those into personal information.
- Expect this Act's notice duty to be enforced exclusively by the West Virginia Attorney General (or, for a licensed financial institution, its primary regulator), never by a private plaintiff, even though a violation is deemed an unfair trade practice.
These lines are LexLint's reading of the law's text. Also read by: West Virginia Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's office asks that notice of a breach be sent to it by email, citing this section.
- As of
- Guidance link
- https://ago.wv.gov/faq
- Guidance body
- West Virginia Office of the Attorney General
- Open questions
- When does a breach of the security of the system 'cause', or lead the entity to reasonably believe it has caused or will cause, 'identity theft or other fraud' so that notice to residents is required under W. Va. Code sec. 46A-2A-102(a)?
What it makes you log
Logging duty
Section 46A-2A-102 requires an individual or entity that owns or licenses computerized personal information to notify each resident whose unencrypted and unredacted information was or is reasonably believed to have been accessed and acquired by an unauthorized person where identity theft or other fraud has or will result, to notify the owner or licensee of data it only maintains, and to notify the nationwide consumer reporting agencies when more than 1,000 persons are notified. A duty to notify, with no instruction to document the breach or the decision that notice is not required, is not a log or record. Section 46A-2A-103 deems an entity that follows its own notification procedures in an information privacy or security policy to comply, which is a policy that states rules rather than a record of processing. Section 46A-2A-104 gives the Attorney General exclusive authority to bring an action (a licensed financial institution answers to its primary functional regulator), and no section of the article sets content fields, a retention period, an audit or a person who may demand a record.
- Kind
- None
- As of
What this law does
An individual or entity that owns or licenses computerized data including personal information must give notice of a breach of the security of the system, without unreasonable delay, to any West Virginia resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person, where the breach causes or is reasonably believed to cause identity theft or other fraud.
The Act's definition of entity includes governments, governmental subdivisions, agencies and instrumentalities, so the duty binds a public body as well as a private one. Personal information is name plus a Social Security number, driver's license or state ID number, or a financial account number with access credential; health information, biometric data, and genetic data are not folded into this definition, unlike South Dakota's narrower biometric fold-in researched alongside this state.
An entity required to notify more than 1,000 persons of a breach must also notify nationwide consumer reporting agencies.
A notice violation is deemed an unfair or deceptive act under West Virginia's general Consumer Credit and Protection Act, but the Attorney General has exclusive authority to bring that action (except against a licensed financial institution, enforced instead by its own primary regulator), which closes the private right of action that West Virginia's general unfair-trade-practices statute, W. Va. Code sec. 46A-6-106, would otherwise open for 'any person who purchases or leases goods or services' suffering an ascertainable loss.
The Act that enacted these sections, Senate Bill 340 of the 2008 Regular Session, was passed on and states that it is in effect ninety days from passage. No source stating the resulting day has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .