The State Privacy Patchwork: Breach Notification for Financial Institutions
Roughly twenty states now have comprehensive consumer data privacy laws, and every state has some form of breach notification requirement. For a financial institution serving customers or members across state lines, a single incident may trigger obligations under multiple state regimes simultaneously, each with its own definitions, timelines, and thresholds.
The analysis required to sort that out is legal work, and it is considerably harder to perform for the first time during an active incident. This article covers the structure of the problem and what to prepare in advance.
Why There Is No Single Playbook
State breach notification laws differ across nearly every variable that matters. What categories of data trigger notification. Whether encryption creates a safe harbor, and under what conditions. Whether notification depends on a risk of harm assessment or follows automatically from unauthorized acquisition. How quickly notice must be provided. Whether the state attorney general must also be notified, and above what number of affected residents. What the notice itself must contain.
Because the obligations attach to the residency of the affected individual rather than the location of your institution, your exposure is defined by where your customers or members live, not by where you operate.
The GLBA Exemption Is Not Uniform
Financial institutions frequently assume that GLBA compliance resolves state privacy obligations. That assumption is unreliable and it is one of the more common sources of error in this area.
Some state privacy laws provide an entity-level exemption, excluding GLBA-covered financial institutions from the law entirely. Others provide only a data-level exemption, excluding data covered by GLBA while the law still applies to the institution for other data it holds, such as employee records or information about individuals who are not customers. And exemptions under comprehensive privacy laws are analytically distinct from exemptions under a state's breach notification statute, which may or may not exist.
Determining which state laws apply to your customer or member base, and what each requires, is a legal analysis that should be completed before an incident rather than during one. The work is largely the same either way. The difference is whether you are doing it under a running clock.
Federal Obligations Run in Parallel
State requirements sit alongside federal and sector obligations rather than replacing them.
Under the FTC Safeguards Rule, covered non-banking financial institutions must notify the FTC of a notification event involving unencrypted customer information of at least 500 consumers, no later than 30 days after discovery, through a form on the FTC website. Federally insured credit unions must notify the NCUA as soon as possible and no later than 72 hours after reasonably believing they have experienced a reportable cyber incident. Covered entities under NYDFS Part 500 must notify the Department within 72 hours of determining a cybersecurity incident has occurred, with a separate obligation to report an extortion payment within 24 hours of making it.
A single incident can therefore produce a federal regulator notification, a sector regulator notification, notifications to multiple state attorneys general, and direct notice to affected individuals, each on a different clock.
What to Prepare Before You Need It
A Customer or Member Footprint by State
Know which states your individuals reside in. This is the input to every subsequent question, and it is trivially available before an incident and frustrating to assemble during one.
A Pre-Built Obligation Map
For the states where you have meaningful concentration, document the notification trigger, timeline, attorney general threshold, and required notice content. This does not need to be exhaustive on day one. Covering the states holding the majority of your individuals removes most of the uncertainty from the early hours of a response.
Counsel Engaged in Advance
Outside counsel who already understands your data footprint, your vendor relationships, and your regulatory posture can begin useful analysis immediately. Counsel engaged for the first time during an incident spends the early hours learning your environment, and those are the hours you have the least of.
Pre-Drafted Notice Templates
Reviewed by counsel, adaptable to the facts, and deployable through communication channels that do not depend on systems which may be affected. This is a component of incident response preparation that many institutions have not completed.
The Practical Standard
Most notification frameworks contemplate notifying based on what is reasonably known, with updates as investigation continues, rather than waiting for complete certainty. Institutions that delay notification while pursuing a definitive answer often end up late on multiple obligations at once. Preparation is what makes acting on incomplete information feasible rather than reckless.
This article is provided for general information and does not constitute legal advice. State breach notification and privacy laws change frequently, vary substantially in their requirements, and their application depends on facts specific to your institution and to any given incident. Determining your obligations requires analysis by qualified legal counsel against current statutory text. Do not rely on any general description, including this one, in an actual incident.