Help! My Nevada small business was hacked…
As businesses enjoy increasing efficiency with new technology, one of the downfalls faced by many small businesses is the risk and cost of a security breach to that business’s operations. Many small businesses use a variety of software and online services to assist their day-to-day activities, and a security breach can impose significant costs from which a small business may have difficulties recovering. Statistics show that, especially during the pandemic, data breaches, hacks, and ransomware use are all on the rise – and it’s not just big companies that are affected.
In addition, a Nevada small business may face legal obligations with which it must comply when faced with a data breach. If, in the course of its business, a Nevada small business collects from its customers or clientele certain personal information, it is subject to certain reporting obligations if that information is later subject to a data breach. (See Nevada’s statute on security and privacy of personal information). The types of “personal information” subject to the law are a person’s first and last name plus any one of the following: social security number, driver’s license number, driver authorization card, or ID card, account number, credit card number, debit card number in combination with any access code that would permit access to a person’s account, a medical or heath ID number, and/or any information that would permit access to an online account.
The statute requires that any “data collector,” including a small business, who maintains records containing the “personal information” defined by the statute “shall implement and maintain reasonable security measures” to protect those records from unauthorized access. If a breach occurs, then the business must disclose to its customers or clients that their personal information was or may have been acquired by an unauthorized person such as the hacker. The business can do this via written, electronic notification individually, on its website, or notification via statewide media. Failure to notify its customers and consumers of a breach may result in civil penalties and litigation.
Nevada’s data breach statute is a good reminder to small businesses to ensure they are taking precautions to protect and prevent unauthorized disclosure of their clients’ and customers’ personal information. If you have questions on Nevada’s security and privacy statute, please contact an attorney at Lemons, Grundy & Eisenberg.