Timing of Consumer Notification
“Most expedient time possible and without unreasonable delay.”
Method of Notice
Mail or phone. Email permitted if complies with E-SIGN.
Breach Definition
Illegal acquisition of unencrypted computerized data that materially compromises security, confidentiality, or integrity of personal information for one or more persons maintained by agency, individual or a commercial entity.
PII Definition

Idaho resident's first name or first initial and last name in combination with any of these, when either name or data elements are not encrypted:

  1. Social Security Number;
  2. Driver's license number or Idaho identification card number; or
  3. Account number, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to resident's financial account.
Third Party Notice
If data owner maintains covered information for someone else, it must notify them immediately following discovery of breach.
How to Notify
No specific content requirement.
Substitute Notice
All: (a) email if agency, individual or the commercial entity has email addresses for affected Idaho residents; (b) conspicuous posting of notice on website of agency, individual or the commercial entity if it maintains one; and (c) notification to major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
Not required.
This State's Law
State Government Agency Notification Required
Not required.