Data protection in Washington, DC is a serious legal duty. Any business, nonprofit, or association that holds a resident’s personal information must keep reasonable safeguards around it and report a breach quickly. This guide covers what DC law requires, who you must notify and when, and the security measures that prevent most incidents.
Key Takeaways
- DC law covers businesses, nonprofits, and associations, and the security standard scales with your size and the sensitivity of your data.
- Residents must be told of a breach “without unreasonable delay.” The DC Attorney General must be informed in writing when 50 or more residents are affected.
- HIPAA or GLBA compliance satisfies DC’s security standard but does not remove the Attorney General notice.
Table of Contents
What Washington DC Law Requires for Data Protection
Washington, DC law requires that any business, nonprofit, or association that does business in the District or holds a resident’s personal information to:
- 1. Maintain reasonable security protections
- 2. Notify residents promptly after a breach
The protection standard scales with the size of the organization and the sensitivity of the data. Both duties sit in Title 28 of the DC Code.
Reasonable safeguards.
Section 28-3852.01 requires procedures and practices “appropriate to the nature of the personal information and the nature and size of the entity or operation.” So, a 40-person association is not held to a bank’s standard.
Vendor contracts.
If you give resident data to a nonaffiliated service provider, a written agreement must require that provider to keep reasonable security as well.
Safe destruction.
Retired laptops, drives, and paper files that contain personal information must be disposed of with reasonable steps against unauthorized access.
Prompt notice.
Section 28-3852 requires notice to affected residents “in the most expedient time possible and without unreasonable delay.”
What Counts as Personal Information Under DC Law
Under DC Code § 28-3851, personal information is a person’s name combined with an identifier such as a Social Security number, driver’s license number, financial account number, medical information, health insurance details, genetic data, or biometric data. A username or email address paired with a password or security answer that opens an email account also counts.
The 2020 amendment (D.C. Law 23-98) added the medical, genetic, health insurance, and biometric categories, which is why a records system that looked harmless in 2015 may now hold regulated data. A donor record with a bank account number also falls under this law. So, what exactly happens when personal information gets leaked?
When You Must Notify Residents and the Attorney General
DC requires a notice to be sent to affected residents in the most expedient time possible and without unreasonable delay. And, if a breach affects 50 or more District residents, you must also notify the DC Attorney General in writing (no later than when residents are told). However, law enforcement can ask you to delay the notice if it would impede an investigation.
Here’s where the notices go to and when.
Residents
The notice should describe the categories of information taken, give your contact details, list the major credit reporting agencies and the right to a free security freeze, and point them to the Federal Trade Commission and the DC Attorney General’s office.
If a Social Security number or taxpayer identification number is involved, you must offer each affected resident at least 18 months of identity theft protection at no cost, under Section 28-3852.02.
Attorney General
The written notice covers 11 items, including the cause of the breach, the remedial action taken, any known foreign country involvement, and a sample resident notice. You cannot wait to send this out simply because the total number of affected residents is still unknown.
Credit Reporting Agencies
If you notify more than 1,000 people, that also means you must notify the nationwide consumer reporting agencies.
Organizations You Maintain Data For
If your organization maintains data that it does not own – such as a vendor hosting a client’s records – you must tell the data owner in the most expedient time possible after discovery.
Will HIPAA or GLBA Compliance Cover You in DC?
Partly.
An organization that complies with the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), or the HITECH Act is deemed compliant with DC’s security requirements. It is also deemed compliant with resident notice if it follows those federal notice rules. Organizations must, however, still send written notice to the DC Attorney General.
What a Data Breach Violation Costs in DC
A violation of DC’s breach law is an unfair or deceptive trade practice. The DC Attorney General can seek injunctive relief and restitution, plus civil penalties of up to $5,000 per violation for a first offense and up to $10,000 per violation for a repeat offense. Residents can also sue for damages.
4 Ways to Protect Data in Microsoft 365 and Other Cloud Tools
1. Multifactor authentication (MFA).
Require multifactor authentication for every account. Microsoft Entra Conditional Access policies can enforce MFA and block sign-ins from countries or regions where your staff doesn’t work (for example, Honduras).
2. Same-day offboarding.
Disable the account (including revoking contractor and volunteer access) and reassign the mailbox on the last day.
3. Data loss prevention (DLP).
Rules (set up in Microsoft Purview) help prevent sensitive information, such as Social Security or credit card numbers, from being accidentally emailed or shared outside your organization.
4. Encryption.
DC’s definition of a breach generally excludes data that has been rendered unusable through encryption or redaction. So, encrypted laptops and storage can change whether you have to send notices or not.
What Should a Data Breach Response Plan Include?
An incident response plan names who makes decisions, who gets called, what evidence gets preserved, and who files the notices. When developing your process, you should:
- Create a call list. Your IT provider or security team, cyber insurance carrier, legal counsel, law enforcement, and a communications lead. Include with after-hours numbers.
- Map out cyber insurance notification rules.
- Craft a plan for informing customers, vendors, partners, staff, and other parties whose information may be compromised. This includes the process for updating them about the progress of your response and recovery activities.
- Create a plan for mitigating potential follow-up attacks.
- Have a plan for if your incident meets the 50 resident threshold. That means knowing the Attorney General’s 11 required items. Also, maintain a draft resident notice so you can easily fill in the details after an event occurs.
- Write down the process you will follow to investigate the incident, identify learning points, and assess how you can improve your cybersecurity policy.
- Repair damaged equipment and networks.
- Maintain details about the process for restoring or recovering lost data via your multiple backups.
This is not an exhaustive list, but it’s a good starting point. Make sure you walk through your plan (also known as a tabletop exercise) once a year to evaluate your processes and see what works/doesn’t work.
How Managed IT Services Help Protect Your Data
A managed IT services provider gives an organization a complete IT team that applies these controls every day and responds when an incident occurs.
Teal builds managed detection and response (MDR), which is round-the-clock monitoring by security specialists who investigate and contain threats, directly into its managed IT services – which are important for data protection. We also handle offboarding, MFA, and Microsoft 365 settings as routine management.
The business case can be measured in cost avoided as well as time and stress saved. A breach notice, 18 months of identity protection, and an Attorney General inquiry cost a lot of money and leadership time. All of which a nonprofit or growing business would rather spend on its mission/customers.
Sharing a managed IT provider’s security team with their other clients also means fewer internal hires you need to cover monitoring and after-hours response.
Data Protection in Washington, DC Starts Before the Clock Does
Washington DC law gives organizations a standard to meet and a clock to beat. The ones that meet both are the ones who treat account hygiene, Microsoft 365 controls, and a written response plan as routine work. If you want a team that does all that work for you, see how Teal’s managed cybersecurity services protect data for businesses, nonprofits, and associations across the DC region.
This article provides general information, not legal advice. Confirm your obligations with proper counsel.
