Louisiana R.S. 51:3074: A Security Duty, a 60-Day Limit and an Attorney General Extension Route

A Security Statute That Also Requires Notice

The chapter calls itself the Database Security Breach Notification Law, but the first two duties in R.S. 51:3074 are not about notice. Subsection A directs any person conducting business in the state or owning or licensing computerized personal data, and any agency doing so, to "implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure." Subsection B requires "all reasonable steps" to destroy records no longer to be retained, by shredding, erasing or otherwise making the personal information unreadable.

These sections matter to the rest of the chapter because the enforcement clause in subsection J is not confined to notice failures; it applies to "a violation of a provision of this Chapter." The legislative findings in 51:3072 cover identity theft and state that "expeditious notification of possible misuse of a person's personal information is imperative."

The history line on 51:3074 ends with Act 382 of 2018, effective August 1, 2018, which reenacted the section under a title reading in part "to require certain security procedures and practices." The Senate's original version of SB 361 proposed a deadline of forty-five days; the enrolled act and the code say sixty.

Who Is Covered and What Counts

Section 51:3073 defines "agency" to include the state, its political subdivisions and their bodies, and "person" to include individuals and any legal entity. Government therefore sits inside the chapter by name. Personal information is a resident's first name or initial and last name combined with one or more of five data elements, where the name or the element is not encrypted or redacted:

• a Social Security number;
• a driver's license or state identification card number;
• an account, credit or debit card number with any required code permitting access to a financial account;
• a passport number; or
• biometric data, meaning data generated by automatic measurements of a biological characteristic such as fingerprints, voice print, eye retina or iris that is used by the owner or licensee to uniquely authenticate an individual's identity when accessing a system or account.

A breach under 3073(2) is framed around the compromise of the system: "the compromise of the security, confidentiality, or integrity of computerized data that results in, or there is a reasonable likelihood to result in, the unauthorized acquisition of and access to personal information." The definition therefore extends to a reasonable likelihood of acquisition, although subsection C of 51:3074 speaks of information actually or reasonably believed to have been acquired. Only computerized data is within the definition.

The Sixty-Day Limit and How It Moves

Under subsection C, the owner or licensee notifies any resident whose information "was, or is reasonably believed to have been, acquired by an unauthorized person." Subsection D puts a custodian that does not own the data on notice to the owner. Subsection E applies one standard to both notifications: "in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach," consistent with law enforcement needs or "any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system."

The sixty days are not unconditional, and the condition has a filing attached. When notice is delayed because of a law enforcement determination under subsection F, or because the person or agency decides those scoping measures are needed, the person or agency "shall provide the attorney general the reasons for the delay in writing within the sixty day notification period." The next sentence says that "upon receipt of the written reasons, the attorney general shall allow a reasonable extension of time" for notice. The extension is stated in mandatory terms and the Attorney General's office is the only recipient; no length is set.

Notice may be written, electronic consistent with 15 U.S.C. 7001, or substitute. Substitute notification opens at cost above $100,000, an affected class above 100,000, or insufficient contact information, and it needs all three of email, website posting and major statewide media. An agency or person following its own notification policy that respects the section's timing is treated as compliant under subsection H.

The Written No-Harm File

Subsection I removes the notice duty "if after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to the residents of this state." The decision has a paper trail. A copy of "the written determination and supporting documentation" is kept for five years from discovery, and if the Attorney General asks in writing, it goes to that office no later than thirty days after receipt of the request. The subsection then applies R.S. 51:1404(A)(1)(c) to what is sent; that provision bars public disclosure of trade secrets and privileged or confidential commercial or financial information.

The exception is phrased in terms of a "person or business," and unlike surrounding subsections it does not name an agency.

The Attorney General's Regulation

Subsection E's written reasons concern delay. The routine filing is found elsewhere, in the Administrative Code. Section 51:3077 says the chapter "shall not take effect until rules are promulgated by the attorney general's office," and the rule on point is LAC 16:III.701, promulgated under R.S. 51:3071 et seq. at LR 33:466 (March 2007). Whenever notice to Louisiana citizens is required under 51:3074, the person or agency gives "written notice detailing the breach of the security of the system to the Consumer Protection Section of the Attorney General's Office," and the notice "shall include the names of all Louisiana citizens affected by the breach."

Paragraph B sets the timing and the consequence: notice "shall be timely if received within 10 days of distribution of notice to Louisiana citizens," failure "may be punishable by a fine not to exceed $5,000 per violation," and "each day notice is not received by the attorney general shall be deemed a separate violation." The rule contains no minimum number of affected citizens. Paragraph C gives a Baton Rouge mailing address. The Attorney General also operates an online reporting form offering initial and supplemental notices, and it asks for the approximate number of affected residents and the dates of discovery and consumer notice.

Private Action and Unfair Practice Liability

Section 51:3075 is one sentence: "A civil action may be instituted to recover actual damages resulting from the failure to disclose in a timely manner to a person that there has been a breach of the security system resulting in the disclosure of a person's personal information." The remedy named is actual damages, and the wording is tied to untimely disclosure, not to the security duty in subsection A.

Subsection J of 3074 runs on a different track: "A violation of a provision of this Chapter shall constitute an unfair act or practice pursuant to R.S. 51:1405(A)." Section 51:1405 is the core prohibition of the Unfair Trade Practices and Consumer Protection Law. Section 51:1407 lets the Attorney General seek injunctions and allows a court to impose a civil penalty, up to $5,000 per violation where the practice was entered into with intent to defraud. Section 51:1409 gives a private action for ascertainable loss, individually and not in a representative capacity, with treble damages if the practice was knowingly used after notice from the Attorney General, and a one-year prescriptive period.

Two carve-outs affect financial entities. Section 51:3076 deems a financial institution that complies with the 2005 federal interagency guidance on response programs to be in compliance with the chapter. Separately, 51:1406 says the Unfair Trade Practices Law does not apply to federally insured financial institutions and certain regulated licensees. This chapter contains no exclusion specific to HIPAA entities.

Record of Enforcement

No fetched Attorney General release cites R.S. 51:3071 et seq. by name or number, so the record of actions under the chapter stands at zero for this post. The Louisiana Attorney General's site was reachable; the search of its posted news was not exhaustive. The nearest documented matter is a release on the 23andMe bankruptcy settlement, which gives Louisiana $258,668 from a coalition of 42 attorneys general and 68,814 affected Louisiana residents, without identifying the state law involved. Louisiana is also listed among the attorneys general in the Blackbaud settlement described in an Arizona Attorney General release of October 5, 2023.

Frequently Asked Questions