Walk It Through: The Breach Letter

No more than thirty calendar days, and the attorney general above five hundred.

A letter arrives saying a health app's servers were breached.

Two things a person in this spot might do. Picking one shows what the law says about it.

One breach letter from one app. What counts as personal information, the forms notice may take, and the exception for encrypted data are not worked through here.

A practice walkthrough, not a prediction of how any real one will go. Legal information, not legal advice.

Words this turns on

Terms with a legal meaning that is narrower than the everyday one. Each links to the definition and the authority behind it.

Breach of the security of the systemWhat a business notifies each affected consumer of in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after discovery. If more than five hundred Washington residents are notified from a single breach, the attorney general is told too.