District of Columbia data breach notification law

Fifty residents and the Attorney General

A business must promptly give written notice to the Office of the Attorney General for the District of Columbia if the breach affects 50 or more District residents. That notice comes no later than the notice to residents.

Entities that follow notice rules under GLBA or HIPAA still give written notice to the DC Attorney General. At that level, even a contained incident can reach the regulator.

What the definition reaches

Personal information starts with an individual's first name, first initial and last name, or any other personal identifier, which in combination with listed data elements can be used to identify a person. The listed elements are:

• Social Security number, ITIN, passport, driver's license, DC ID, military ID or other government ID number
• an account or card number, or any code that allows access to a financial or credit account
• medical information, genetic information and a DNA profile
• health insurance information
• biometric data used for authentication

A combination of these that would enable identity theft without a name also counts, and so does a username or email address with a password, security question and answer, or other authentication for an email account.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarking is on by default in every room, as a per-room setting. Recipients confirm their email with a six-digit code and need no account, and NDA acceptance is available on Professional and Business. The result is a dated record of each reader inside a shared room, exportable as CSV, which helps when the number of people involved has to be counted rather than estimated.