2013 Indiana Code TITLE 24. TRADE REGULATION ARTICLE 4.9. DISCLOSURE OF SECURITY BREACH CHAPTER 2. DEFINITIONS
Download as PDF
IC 24-4.9-2
Chapter 2. Definitions
IC 24-4.9-2-1
Applicability
Sec. 1. The definitions in this chapter apply throughout this
article.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-2
"Breach of the security of data"
Sec. 2. (a) "Breach of the security of data" means unauthorized
acquisition of computerized data that compromises the security,
confidentiality, or integrity of personal information maintained by a
person. The term includes the unauthorized acquisition of
computerized data that have been transferred to another medium,
including paper, microfilm, or a similar medium, even if the
transferred data are no longer in a computerized format.
(b) The term does not include the following:
(1) Good faith acquisition of personal information by an
employee or agent of the person for lawful purposes of the
person, if the personal information is not used or subject to
further unauthorized disclosure.
(2) Unauthorized acquisition of a portable electronic device on
which personal information is stored, if all personal information
on the device is protected by encryption and the encryption key:
(A) has not been compromised or disclosed; and
(B) is not in the possession of or known to the person who,
without authorization, acquired or has access to the portable
electronic device.
As added by P.L.125-2006, SEC.6. Amended by P.L.136-2008,
SEC.2; P.L.137-2009, SEC.3.
IC 24-4.9-2-3
"Data base owner"
Sec. 3. "Data base owner" means a person that owns or licenses
computerized data that includes personal information.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-4
"Doing business in Indiana"
Sec. 4. "Doing business in Indiana" means owning or using the
personal information of an Indiana resident for commercial purposes.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-5
Encrypted data
Sec. 5. Data are encrypted for purposes of this article if the data:
(1) have been transformed through the use of an algorithmic
process into a form in which there is a low probability of
assigning meaning without use of a confidential process or key;
or
(2) are secured by another method that renders the data
unreadable or unusable.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-6
"Financial institution"
Sec. 6. "Financial institution" means a financial institution as
defined in:
(1) IC 28-1-1-3, other than a consumer finance institution
licensed to make supervised or regulated loans under IC 24-4.5;
or
(2) 15 U.S.C. 6809(3).
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-7
"Indiana resident"
Sec. 7. "Indiana resident" means a person whose principal mailing
address is in Indiana, as reflected in records maintained by the data
base owner.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-8
"Mail"
Sec. 8. "Mail" has the meaning set forth in IC 23-1-20-15.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-9
"Person"
Sec. 9. "Person" means an individual, a corporation, a business
trust, an estate, a trust, a partnership, an association, a nonprofit
corporation or organization, a cooperative, or any other legal entity.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-10
"Personal information"
Sec. 10. "Personal information" means:
(1) a Social Security number that is not encrypted or redacted;
or
(2) an individual's first and last names, or first initial and last
name, and one (1) or more of the following data elements that
are not encrypted or redacted:
(A) A driver's license number.
(B) A state identification card number.
(C) A credit card number.
(D) A financial account number or debit card number in
combination with a security code, password, or access code
that would permit access to the person's account.
The term does not include information that is lawfully obtained from
publicly available information or from federal, state, or local
government records lawfully made available to the general public.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-11
Redacted data or personal information
Sec. 11. (a) Data are redacted for purposes of this article if the
data have been altered or truncated so that not more than the last four
(4) digits of:
(1) a driver's license number;
(2) a state identification number; or
(3) an account number;
is accessible as part of personal information.
(b) For purposes of this article, personal information is "redacted"
if the personal information has been altered or truncated so that not
more than five (5) digits of a Social Security number are accessible
as part of personal information.
As added by P.L.125-2006, SEC.6.
Disclaimer: These codes may not be the most recent version. Indiana may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
