US Laws, Codes, Statutes & Cases

                                  TITLE  28
                           COMMERCIAL TRANSACTIONS
                                  CHAPTER 51
                                IDENTITY THEFT
    28-51-105.  DISCLOSURE OF BREACH OF SECURITY OF COMPUTERIZED PERSONAL
INFORMATION BY AN AGENCY, INDIVIDUAL OR A COMMERCIAL ENTITY. (1) An agency,
individual or a commercial entity that conducts business in Idaho and that
owns or licenses computerized data that includes personal information about a
resident of Idaho shall, when it becomes aware of a breach of the security of
the system, conduct in good faith a reasonable and prompt investigation to
determine the likelihood that personal information has been or will be
misused. If the investigation determines that the misuse of information about
an Idaho resident has occurred or is reasonably likely to occur, the agency,
individual or the commercial entity shall give notice as soon as possible to
the affected Idaho resident. Notice must be made in the most expedient time
possible and without unreasonable delay, consistent with the legitimate needs
of law enforcement and consistent with any measures necessary to determine the
scope of the breach, to identify the individuals affected, and to restore the
reasonable integrity of the computerized data system.
    (2)  An agency, individual or a commercial entity that maintains
computerized data that includes personal information that the agency,
individual or the commercial entity does not own or license shall give notice
to and cooperate with the owner or licensee of the information of any breach
of the security of the system immediately following discovery of a breach, if
misuse of personal information about an Idaho resident occurred or is
reasonably likely to occur. Cooperation includes sharing with the owner or
licensee information relevant to the breach.
    (3)  Notice required by this section may be delayed if a law enforcement
agency advises the agency, individual or commercial entity that the notice
will impede a criminal investigation. Notice required by this section must be
made in good faith, without unreasonable delay and as soon as possible after
the law enforcement agency advises the agency, individual or commercial entity
that notification will no longer impede the investigation.