Data Privacy Map - South Dakota

Highlights

Covered Entities: An information holder (person or business) that conducts business in South Dakota, and that owns or licenses computerized personal or protected information of South Dakota residents.

Consumer Notification: Notification must be provided to any South Dakota resident whose “personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person.”
Regulatory Notification: Notification must be provided to the South Dakota Attorney General of any “breach of system security that exceeds two hundred fifty residents …”

Notification Timeline: Notification must be provided no later than 60 days from the discovery or notification of the breach, unless a longer period of time is required due to the legitimate needs of law enforcement.

Data Format: Electronic

Citations: S.D. Codified Laws § 22-40-19 to § 22-40-26.

More Details

Definitions:

• Breach: Unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder.
• Personal Information (PI):
  • An individual’s first name / first initial and last name, in combination with any one or more of the following data elements:
    • Social security number;
    • Driver license number or other unique identification number created or collected by a government body;
    • Account, credit card, or debit card number, in combination with any required security code, access code, password, routing number, PIN, or any additional information that would permit access to a person's financial account;
    • Health information as defined in 45 CFR 160.103; or
    • An identification number assigned to a person by the person's employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes.
• Protected Information:
  • A username or email address, in combination with a password, security question answer, or other information that permits access to an online account; and
  • Account number or credit or debit card number, in combination with any required security code, access code, or password that permits access to a person's financial account.
• Medical Information: N/A
• Health Insurance Information: As defined in 45 CFR 160.103, any information, including genetic information, recorded in any form or medium, that: relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care thereto, or the past, present, or future payment therefor.

Safe Harbors:

• Encryption: Notification is not required if the data is rendered unusable, unreadable, or indecipherable without the use of a decryption process or key.
• Good Faith: Notification is not required if the disclosure is a good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the information holder, if the personal or protected information is not used or subject to further unauthorized disclosure.
• Risk of Harm: An information holder is not required to make a disclosure if, following an appropriate investigation and notice to the Attorney General, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder shall document the determination under this section in writing and maintain the documentation for not less than three years.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. If the notification is delayed, the notification shall be made not later than thirty days after the law enforcement agency determines that notification will not compromise the criminal investigation.

Direct Notice:

• Timing: Notification must be provided no later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement.
• Format: N/A
• Content: N/A
• Method: Notification must be provided via written notice or electronic notice, if the electronic notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 in effect as of January 1, 2018, or if the information holder's primary method of communication with the resident of this state has been by electronic means.

Substitute Notice:

Substitute notice may be provided if the information holder demonstrates that (1) the cost of providing notice would exceed $250,000, (2) the affected class of persons to be notified exceeds 500,000, or (3) the information holder does not have sufficient contact information. Substitute notice must consist of each of the following:

• Email notice, if the information holder has an email address for the subject persons;
• Conspicuous posting of the notice on the information holder's website, if the information holder maintains a website page; and
• Notification to statewide media.

Remediation Services:

N/A

Regulatory Notice:

Notification must be provided to the South Dakota Attorney General of any breach of system security where the impact exceeds 250 residents.

Credit Reporting Agencies Notice:

If an information holder discovers circumstances that require notification pursuant to § 22-40-20, the information holder shall also notify, without unreasonable delay, all consumer reporting agencies.

Third-Party Notice:

N/A

HIPAA:

Notwithstanding any other provisions in §§ 22-40-19 to 22-40-26, inclusive, any information holder that is regulated by federal law or regulation, including the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, as amended), and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator is deemed to be in compliance with this chapter if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.

Private Action:

N/A

Associated Regulations:

N/A