Browse Arkansas Code titles and sections

4-110-105. Disclosure of security breaches.

Arkansas Code — all titles (historical 2020) · legal_authorities

4-110-105. Disclosure of security breaches.

Source: Arkansas Code — historical release 78 (November 6, 2020) · 4-110-105

Stored review status: Historical 2020-11-06 source release; later amendments not reconciled; machine-extracted, not independently legally reviewed; source heading status: text_in_historical_source. A text match is a research starting point; applicability is not established.

Issuing source page ↗

Authority boundary: historical statutory source snapshot not current law.

Open the recorded source website ↗

Record provenance

Stable record: arkansas_code:legal_authorities:4-110-105
Source file: gov.ar.code.title.04.odt
Pages: Not recorded – Not recorded
Passage SHA-256: 4e61ad68ebe3d34e87d16dc478b2ca0dadd50b687f182943b3c493ad974e24eb

Source location: content.xml paragraph 38119

Stored source content

4-110-105. Disclosure of security breaches. (a)(1) Any person or business that acquires, owns, or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (2) The disclosure shall be made in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, or any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. (b)(1) A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee that there has been a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (2) If a breach of the security of a system affects the personal information of more than one thousand (1,000) individuals, the person or business required to make a disclosure of the security breach under subdivision (b)(1) of this section shall, at the same time the security breach is disclosed to an affected individual or within forty-five (45) days after the person or business determines that there is a reasonable likelihood of harm to customers, whichever occurs first, disclose the security breach to the Attorney General. (c)(1) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. (2) The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation. (d) Notification under this section is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers. (e) For purposes of this section, notice may be provided by one (1) of the following methods: (1) Written notice; (2) Electronic mail notice if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001, as it existed on January 1, 2005; or (3)(A) Substitute notice if the person or business demonstrates that: (i) The cost of providing notice would exceed two hundred fifty thousand dollars ($250,000); (ii) The affected class of persons to be notified exceeds five hundred thousand (500,000); or (iii) The person or business does not have sufficient contact information. (B) Substitute notice shall consist of all of the following: (i) Electronic mail notice when the person or business has an electronic mail address for the subject persons; (ii) Conspicuous posting of the notice on the website of the person or business if the person or business maintains a website; and (iii) Notification by statewide media. (f) Notwithstanding subsection (e) of this section, a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies affected persons in accordance with its policies in the event of a breach of the security of the system. (g)(1) A person or business shall retain a copy of the written determination of a breach of the security of a system and supporting documentation for five (5) years from the date of determination of the breach of the security of the system. (2) If the Attorney General submits a written request for the written determination of the breach of the security of the system, the person or business shall send a copy of the written determination of the breach of the security of the system and supporting documentation to the Attorney General no later than thirty (30) days after the date of receipt of the request. (3) The determination and documentation retained under this subsection are confidential and not subject to public disclosure.

Cross-references

Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.

Federal law — U.S. Code and appendices · legal_authorities

15 U.S.C. § 7001 — General rule of validity

**(a) In general** Notwithstanding any statute, regulation, or other rule of law (other than this subchapter and subchapter II), with respect to any transaction in or affecting interstate or foreign commerce— (1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and (2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation. **(b) Preservation of rights and obligations** This subchapter does not— (1) limit, alter, or otherwise affect any requirement imposed by a statute, regulation, or rule of law relating to the rights and obligations of persons under such statute, regulation, or rule of law other than a requirement that contracts or other records be written, signed, or in nonelectronic form; or (2) require any person to agree to use or accept electronic records or electronic signatures, other than a governmental agency with respect to a record other than a contract to which it is a party. **(c) Consumer disclosures** (1) **Consent to electronic records** — Notwithstanding subsection (a), if a statute, regulation, or other rule of law requires that information relating to a transaction or transactions in or affecting interstate or foreign commerce be provided or made available to a consumer in writing, the use of an electronic record to provide or make available (whichever is required) such information satisfies the requirement that such information be in writing if— (A) the consumer has affirmatively consented to such use and has not withdrawn such consent; (B) the consumer, prior to consenting, is provided wi

Source: Supplied U.S. Code snapshot — release unconfirmed · 15 U.S.C. § 7001

Stored review status: release_metadata_unconfirmed. The source passage cites 15 U.S.C. § 7001. This identifies an authority to review, not proof of applicability.

Federal law — U.S. Code and appendices · legal_authorities

15 U.S.C. § 7001 — General rule of validity

Page 2304 TITLE 15—COMMERCE AND TRADE § 7001 CHAPTER 96—ELECTRONIC SIGNATURES IN GLOBAL AND NATIONAL COMMERCE SUBCHAPTER I—ELECTRONIC RECORDS AND SIGNATURES IN COMMERCE Sec. 7001. General rule of validity. 7002. Exemption to preemption. 7003. Specific exceptions. 7004. Applicability to Federal and State govern- ments. 7005. Studies. 7006. Definitions. SUBCHAPTER II—TRANSFERABLE RECORDS 7021. Transferable records. SUBCHAPTER III—PROMOTION OF INTERNATIONAL ELECTRONIC COMMERCE 7031. Principles governing the use of electronic sig- natures in international transactions. SUBCHAPTER I—ELECTRONIC RECORDS AND SIGNATURES IN COMMERCE § 7001. General rule of validity (a) In general Notwithstanding any statute, regulation, or other rule of law (other than this subchapter and subchapter II), with respect to any trans- action in or affecting interstate or foreign com- merce— (1) a signature, contract, or other record re- lating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and (2) a contract relating to such transaction may not be denied legal effect, validity, or en- forceability solely because an electronic sig- nature or electronic record was used in its for- mation. (b) Preservation of rights and obligations This subchapter does not— (1) limit, alter, or otherwise affect any re- quirement imposed by a statute, regulation, or rule of law relating to the rights and obliga- tions of persons under such statute, regula- tion, or rule of law other than a requirement that contracts or other records be written, signed, or in nonelectronic form; or (2) require any person to agree to use or ac- cept electronic records or electronic signa- tures, other than a governmental agency

Source: Supplied 2024 U.S. Code historical extraction · 15 U.S.C. § 7001

Stored review status: historical_2024_not_currentness_verified. The source passage cites 15 U.S.C. § 7001. This identifies an authority to review, not proof of applicability.