The basics
South Carolina’s breach notification law (S.C. Code § 39-1-90) generally applies when unencrypted personal identifying information of South Carolina residents is acquired, or reasonably believed to be acquired, by an unauthorized person, and the breach creates a material risk of harm. Covered information generally means a person’s name combined with things like a Social Security number, driver’s license number, or financial account or card number with the code needed to use it.
When notification is required, the law calls for notifying affected residents without unreasonable delay, and when more than 1,000 people are notified at one time, also notifying the state’s Department of Consumer Affairs and the national consumer reporting agencies.
This is a legal question
This is a general overview, not legal advice. Whether a particular incident requires notice, when, to whom and with what wording depends on the facts and on the laws of every state where affected people live, plus any industry rules (HIPAA, financial regulations). Call an attorney who handles data privacy as soon as you suspect a breach.
What helps your attorney
That record is exactly what our incident response produces for website, domain and email incidents: preserved evidence, sealed with a fingerprint, and a written report.
- When it started, when it was found and how.
- Which systems were involved and what data was on them.
- Whether the data was encrypted.
- Evidence preserved before anything was cleaned or deleted.
- A written timeline of what you and your providers did.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.