Companies Need to have Policies in Place if Personal Client Information is Stolen

      An Indiana-based third-party debt collection and billing service recently reported a theft involving one or more of its servers that may have stored a significant amount of personal customer information.  Over 30 states have adopted laws requiring that companies notify individuals of such security breaches.  Many states, including Indiana, have enacted laws that require companies to notify individuals when an individual's personal information such as a social security number or driver's license number has been stolen.  For example, under Indiana law, a company that owns or licenses personal information concerning an Indiana resident is required to notify the resident in the event that: (1) the resident's unencrypted personal information was or may have been acquired by an unauthorized person (or encrypted personal information was or may have been acquired by an unauthorized person with access to the encryption key); and (2) the breach has resulted in or could result in identity deception, identity theft, or fraud affecting the Indiana resident.  Indiana law authorizes the attorney general to seek civil penalties of up to $150,000 if a company fails to send the required notice.  Notifying individuals can be both time consuming and costly.

      In light of these recent events, companies should confirm that all interested parties have a plan for ensuring that such notification obligations are fulfilled.  Companies should also take a moment to review their current contracts to determine whether the issues surrounding notification and the associated costs have been adequately addressed.  If you have questions regarding this topic, you may contact your regular Ice Miller attorney or you may contact Michael McNally or Brad Stohry.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice.  The reader must consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.