OLYMPIA — Attorney General Bob Ferguson’s third annual Data Breach Report finds that data breaches affected nearly 3.4 million Washingtonians between July of 2017 and July of 2018 — an increase of 700,000, or 26 percent, over the previous year, and an increase of nearly 3 million, or more than 700 percent, compared to two years ago.
State law requires notice to the Attorney General when a breach impacts 500 or more Washingtonians, and the Attorney General’s Office received 51 such notices in fiscal year 2018. Ferguson’s report finds that malicious cyberattacks continue to be the leading cause of data breaches affecting Washingtonians.
In light of these trends, Ferguson’s report recommends a number of ways to strengthen Washington state’s data breach notification law.
“The number of Washingtonians impacted by data breaches increased for the second consecutive year,” Ferguson said. “We must strengthen our law to help Washingtonians secure their sensitive information.”
Ferguson’s report identifies several deficiencies in Washington state’s data breach notification law. For example, Washington’s law does not cover several types of sensitive information. If a malicious hacker obtains the combination of a Washingtonian’s email address and password, the law does not require anybody to notify that Washingtonian. Washington’s law also fails to ensure notice to Washingtonians when a breach exposes their tax ID number, passport number, health insurance policy number or DNA profile.
Furthermore, Washington state law allows too much time before a government agency or business that has discovered a breach must notify affected Washingtonians.
Ferguson’s report makes the following recommendations to strengthen Washington’s data breach notification law:
• Reduce the deadline to notify affected individuals of a breach to 30 days after the breach is discovered;
• Require preliminary notification to the Attorney General’s Office of a breach within 10 days after the breach’s discovery; and
• Expand the definition of personally identifiable information to include full dates of birth, usernames in combination with passwords, digital signatures, DNA profiles or other forms of biometric data, and identification numbers from passports and other sources.
Ferguson will introduce Attorney General request legislation in 2019 that will make these improvements to state law.
