We track privacy and data protection developments across US federal and state law. Every article is reported from the underlying documents (statutes, agency orders, court filings and official registries) and links them so you can check the reporting yourself. We are not attorneys and none of this is legal advice. How we report.
Breach Notification
November 9, 2026
Arizona's breach article opens with a duty to investigate any security incident, then gives the data owner 45 days from the determination that a breach occurred. Above 1,000 individuals, filings go to three credit bureaus, the Attorney General and the state homeland security director. Only the Attorney General may enforce, under a penalty ceiling of $500,000.
Read more →
Genetic Privacy
November 9, 2026
Arizona protects genetic test results through a small chapter in its civil procedure title, not through a single privacy act. A.R.S. 12-2802 makes the results privileged to the person tested and lists who may receive them. Title 20 adds an insurer consent rule, and a separate consumer testing chapter borrows 12-2802 as its disclosure standard.
Read more →
GLBA
November 9, 2026
Arizona has no statute based on the NAIC data security model, but Chapter 11 of Title 20 governs how insurers, producers and support organizations handle personal information. It sets notice duties in section 20-2104, gives individuals access and correction rights, limits disclosure under section 20-2113 and provides limited private remedies.
Read more →
Breach Notification
November 9, 2026
Louisiana's breach chapter imposes a reasonable security duty and a record destruction duty before it reaches notice. Residents are told within 60 days of discovery, unless written reasons for delay reach the Attorney General inside that window. A separate regulation requires the Attorney General's copy within 10 days of resident notice, and R.S. 51:3075 allows a suit for actual damages.
Read more →
Employee Privacy
November 9, 2026
Louisiana's 2014 Personal Online Account Privacy Protection Act stops employers and educational institutions from asking for the login credentials to a personal online account. The definition of personal account is tightly drawn, the employer exceptions are longer than the school ones, and the chapter's only liability section limits exposure.
Read more →
Genetic Privacy
November 9, 2026
La. R.S. 22:1023 is a health insurance statute with reach beyond underwriting. It restricts insurers' use of genetic information, requires detailed signed authorizations, treats an insured's genetic information as property, and creates statutory damages of at least $50,000 or $100,000. A 2015 appellate decision read it to reach a diagnostic code inside an insurer's own systems.
Read more →
Genetic Privacy
November 9, 2026
North Carolina's genetic employment statute is one short section enacted in 1997. It forbids refusing employment or discharging someone because of requested genetic testing or counseling, or genetic information about the person or family. It reaches any public or private entity, but says nothing about remedies and does not regulate testing itself.
Read more →
Breach Notification
November 9, 2026
North Carolina's Identity Theft Protection Act does not limit its breach duty to computers: section 75-65 reaches personal information in any form. Every business that notifies a person also reports to the Attorney General's Consumer Protection Division, with no minimum count, and a violation is an unfair practice under G.S. 75-1.1, with private suits reserved for those injured.
Read more →
Data Security Rules
November 9, 2026
Article 2A of Chapter 75, the Identity Theft Protection Act, goes further than breach notice. Section 75-62 limits how a business may display, transmit, mail or sell Social Security numbers, section 75-64 sets rules for destroying records, and each section makes a violation a violation of G.S. 75-1.1. The two differ on private suits and on treble damages.
Read more →
Breach Notification
November 9, 2026
South Carolina's private-sector breach statute names the Department of Consumer Affairs, not the Attorney General. Section 39-1-90 sends filings above 1,000 persons to that Department, gives it power to set a per-resident fine, and lets an injured resident sue. Its text reaches computerized or other data, though its definition of a breach mentions only computerized data.
Read more →
Genetic Privacy
November 9, 2026
South Carolina's Chapter 93 of Title 38 regulates genetic information in health coverage, but two of its sections are written without limiting them to insurers. It bars issuers from using genetic information in coverage decisions and requires informed consent for genetic tests. Violations can draw department fines, unfair trade practice exposure and a private action.
Read more →
Data Security Rules
November 9, 2026
South Carolina added Chapter 99 to Title 38 through 2018 Act No. 171, signed May 3, 2018 and effective January 1, 2019, and its Department of Insurance describes it as the first enactment of the NAIC data security model. The chapter tracks the model closely, so its interest lies in the places where the wording, the timing and the later amendments part from it.
Read more →