Bill Text: DE SB101 | 2013-2014 | 147th General Assembly | Draft

Delaware Senate Bill 101 (Prior Session Legislation)

Draft

Bill Title: An Act To Amend Title 6 Of The Delaware Code Relating To The Statute Of Limitations For Digital Data Breaches

Spectrum: Partisan Bill (Democrat 3-0)

Status: (Introduced - Dead) 2013-06-04 - Assigned to Judiciary Committee in Senate [SB101 Detail]

Download: Delaware-2013-SB101-Draft.html

SPONSOR:	Sen. Sokola & Sen. Peterson

DELAWARE STATE SENATE

147th GENERAL ASSEMBLY

SENATE BILL NO. 101

AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO THE STATUTE OF LIMITATIONS FOR DIGITAL DATA BREACHES

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF DELAWARE:

Section 1. This Act may be cited as the "Statute of Limitations for Digital Data Breach."

Section 2. Amend Title 6, Subtitle II, Chapter 12B of the Delaware Code by making insertions as shown by underlining and deletions as shown by strikethrough as follows:

�12B-105 Statute of Limitations

The statute of limitations for a civil action under this Chapter shall be seven years from the date of the statutory violation.

Section 3. This Act shall apply retroactively and prospectively to its enactment into law.

SYNOPSIS

With the advent of electronic medical records, social networks, and increased smart phone usage, private and intimate details about people's lives have now become digital. Information stored digitally can be improperly disclosed and/or accessed more readily than information stored only on paper or microfilm. With personal information about an individual, an offender can obtain credit in that individual's name. Often, the use of the stolen identity does not occur until years after the theft. The out-of-pocket cost that an individual incurs in the wake of a data breach can include paying off fraudulent debt, law suits, resolution fees, and credit monitoring fees.

In 2010, the personal information of more than 22,000 retired Delaware state employees was posted on a website that was accessible to the public. The posted information included the retirees' Social Security Numbers, birthdates, and genders. The entity responsible for compiling the information did not encrypt the information to prevent identification. In the span of four days, the information was accessed approximately 100 times by servers outside the United States. A class action suit was filed against the entity in 2010 but was dismissed because the breach had not yet resulted in economic damages beyond the potential cost of credit monitoring. The retirees are however still in peril of later use of their stolen identifiable information that was accessed shortly after it was posted in August, 2010.

This legislation would clarify that a person who is a victim of a "Digital Data Breach" shall have 7 years from the date the personal information is posted in which to bring a civil action for damages.

Author: Senator Sokola