(1) A licensee shall provide notice to the commissioner about notification events. Upon discovery of a notification event, if the notification event involves the information of any consumers in this state, the licensee shall notify the commissioner as soon as possible, but in no event later than seventy-two (72) hours after discovery of the notification event. The notice shall be made in a format specified by the commissioner and include the following information:(a) The name and contact information of the reporting licensee;(b) A description of the types of information that were involved in the notification event;(c) If the information is possible to determine, the date or date range of the notification event;(d) The number of consumers affected or potentially affected by the notification event;(e) A general description of the notification event; and(f) Whether a law enforcement official has provided the licensee with a written determination that notifying the public of the notification event would impede a criminal investigation or cause damage to national security, and a means for the commissioner to contact the law enforcement official.
(a) The name and contact information of the reporting licensee;
(b) A description of the types of information that were involved in the notification event;
(c) If the information is possible to determine, the date or date range of the notification event;
(d) The number of consumers affected or potentially affected by the notification event;
(e) A general description of the notification event; and
(f) Whether a law enforcement official has provided the licensee with a written determination that notifying the public of the notification event would impede a criminal investigation or cause damage to national security, and a means for the commissioner to contact the law enforcement official.
(2) Pursuant to subsection (1)(f) of this section, a law enforcement official may request an initial delay of up to thirty (30) days following the date when notice was provided to the commissioner. The delay may be extended for an additional period of up to sixty (60) days if the law enforcement official seeks an extension in writing. Additional delay may be permitted only if the commissioner determines that public disclosure of a notification event continues to impede a criminal investigation or cause damage to national security.
(3) A notification event under this section shall be treated as discovered as of the first day on which the notification event is known to the licensee. The licensee shall be deemed to have knowledge of a notification event if the notification event is known to any of the licensee’s employees, officers or other agents, excluding the person committing the notification event.
(4) If a licensee becomes aware of a notification event in a system maintained by a service provider, the licensee shall treat such event as it would under subsection (1) of this section. However, the computation of the licensee’s deadlines shall begin on the day after the service provider notifies the licensee of the notification event or the licensee otherwise has actual knowledge of the event, whichever is sooner.