Guam § 48 - Disclosure of Breach of Security of Computerized Personal

§ 48. Disclosure of Breach of Security of Computerized Personal

Information by an Individual or Entity.

(a) General Rule. An individual or entity that owns or licenses

computerized data that includes personal information shall disclose any

breach of the security of the system following discovery or notification of

the breach of the security of the system to any resident of Guam whose

unencrypted and unredacted personal information was or is reasonably

believed to have been accessed and acquired by an unauthorized person and

COL 052809

that causes, or the individual or entity reasonably believes has caused or

will cause, identity theft or other fraud to any resident of Guam. Except as

provided in subsection (d) of this Section, or in order to take any measures

necessary to determine the scope of the breach and to restore the reasonable

integrity of the system, the disclosure shall be made without unreasonable

delay.

(b) Encrypted Information. An individual or entity must disclose

the breach of the security of the system if encrypted information is accessed

and acquired in an unencrypted form, or if the security breach involves a

person with access to the encryption key and the individual or entity

reasonably believes that such breach has caused or will cause identity theft

or other fraud to any resident of Guam.

(c) An individual or entity that maintains computerized data that

includes personal information that the individual or entity does not own or

license shall notify the owner or licensee of the information of any breach

of the security of the system as soon as practicable following discovery, if

the personal information was, or if the entity reasonably believes was,

accessed and acquired by an unauthorized person.

(d) Notice required by this Section may be delayed if a law

enforcement agency determines and advises the individual or entity that the

notice will impede a criminal or civil investigation, or homeland or national

security. Notice required by this Section must be made without

unreasonable delay after the law enforcement agency determines that

notification will no longer impede the investigation or jeopardize national

or homeland security.