Missouri has become the latest state to legislate heavy civil penalties on companies that fail to protect consumer data. The new law, which takes effect August 28, is the latest in a patchwork of industry regulations covering forty four states and the federal government.
Among the provisions are requirements that companies and organizations must alert affected individuals immediately upon discovering a security breach, cooperate with law enforcement, notify the attorney general’s office if the breach affects more than 1,000 individuals at a time. The companies must share the details of the breach with customers, describe what was lost and provide means of protection. Violators can face civil penalties of as much as $150,000 a breach.
In calender year 2008 656 breaches, affecting 35.7 million records
