Montana's Breach Statute, MCA 30-14-1704, and Its Insurance and State Agency Counterparts: Three Filing Routes

What MCA 30-14-1704 Covers

The breach section sits in part 17 of the Unfair Trade Practices and Consumer Protection chapter, headed "Impediment of Identity Theft." Section 30-14-1701 states the purpose of the part as enhancing "the protection of individual privacy" and impeding identity theft "as prohibited by 45-6-332." The history of section 30-14-1704 runs from Chapter 518, Laws of 2005, through amendments in Chapter 180, Laws of 2007 and Chapter 62, Laws of 2015.

The duty in subsection (1) falls on "any person or business that conducts business in Montana and that owns or licenses computerized data that includes personal information." It runs to any Montana resident "whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person." A person or business that maintains data it does not own notifies the owner or licensee "immediately following discovery" under subsection (2).

Two definitions shape the trigger. Subsection (4)(a) defines a breach as unauthorized acquisition that "materially compromises the security, confidentiality, or integrity of personal information" and "causes or is reasonably believed to cause loss or injury to a Montana resident." The harm element speaks of loss or injury generally, not identity theft. Subsection (4)(b) then lists the data elements that, with a first name or initial and last name, are personal information when either the name or the elements are unencrypted:

• a Social Security number;
• a driver's license number, state identification card number, or tribal identification card number;
• an account or card number with any required code or password permitting access to a financial account;
• medical record information as defined in 33-19-104, which covers information about an individual's physical or mental condition, medical history, claims history or treatment obtained from a provider, the individual or a family member;
• a taxpayer identification number; and
• an identity protection personal identification number issued by the Internal Revenue Service.

That definition applies "for purposes of this section." Part 17 has its own wider definition of personal information in section 30-14-1702(7), which adds passport and insurance policy numbers and treats a Social Security number alone as personal information; it governs the record destruction duty in 30-14-1703. Section 30-14-1702(1)(b) also excludes "industries regulated under Title 33" from the part's definition of business, while 30-14-1704 is addressed to any "person or business."

No subsection of 30-14-1704 sets a number of days. Disclosure is due "without unreasonable delay," consistent with law enforcement needs or with measures to determine scope and restore the system. A law enforcement agency may obtain a delay if it determines notice "will impede a criminal investigation and requests a delay." Methods are written, electronic consistent with 15 U.S.C. 7001, telephonic, or substitute notice above $250,000 in cost, above 500,000 persons, or without sufficient contact information. As codified, substitute notice consists of email "and" a website posting, "or" notice to local or statewide media. Subsection (6) deems a person that follows its own information security policy's notice procedures compliant if it does not unreasonably delay.

Notice to the Office of Consumer Protection

Subsection (8) is the filing requirement: any person or business required to notify "shall simultaneously submit an electronic copy of the notification and a statement providing the date and method of distribution of the notification to the attorney general's consumer protection office," with information identifying any notified individual removed. Where more than one individual is notified, one copy indicating the number of Montanans notified is submitted. The duty has no headcount threshold; it follows any required notification.

Montana's consumer reporting agency provision works differently from a headcount rule. Under subsection (7), a business that gives a notice which "suggests, indicates, or implies" that the individual may obtain a copy of their credit file must coordinate with the consumer reporting agency "as to the timing, content, and distribution of the notice," and that coordination "may not unreasonably delay" notice to individuals.

Insurance Licensees Under Title 33

Section 33-19-321, in the Insurance Information and Privacy Protection chapter, applies to "any licensee or insurance-support organization that conducts business in Montana" and shares its 2005, 2007 and 2015 session law history with the general section. Licensee, under 33-19-104, means a person licensed, authorized or registered under Title 33, or a surplus lines insurer. Three points distinguish it.

• Its breach definition omits the materiality and loss-or-injury elements: a breach is unauthorized acquisition that "compromises the security, confidentiality, or integrity" of personal information.
• The simultaneous copy and distribution statement under subsection (5) go "to the commissioner" rather than to the consumer protection office.
• Subsection (4) requires licensees, insurance-support organizations and persons receiving information from them to "develop and maintain an information security policy" and breach notice procedures.

State Agencies Under 2-6-1503

Title 2, chapter 6, part 15 governs "State Agency Protection of Personal Information." Section 2-6-1501 defines a state agency to include units of the legislative and executive branches, including colleges, universities and hospitals, and excludes "an entity of the judicial branch." Its personal information list adds tribal enrollment numbers and identification numbers issued by the District of Columbia and U.S. territories.

Under section 2-6-1503, an agency makes reasonable efforts to notify affected persons without unreasonable delay. A contractor holding agency data notifies the agency immediately and makes its own reasonable efforts to notify individuals; the agency need not repeat a notice the contractor gave properly, but must notify if the contractor does not, and may recover its costs. Subsection (5) sends the notification copy to both "the state's chief information security officer at the department of administration" and the attorney general's consumer protection office. Separately, section 2-6-1504, enacted by Chapter 227, Laws of 2023, requires an agency to notify the chief information security officer immediately of any "security incident," a broader category that includes potential threats and policy violations.

Enforcement

Section 30-14-1705 lets "the department," defined in 30-14-102 as the Department of Justice, sue to restrain a violation of part 17 by injunction or temporary restraining order when it has reason to believe a violation occurred and a proceeding is in the public interest. Subsection (3) makes a violation of the part a violation of 30-14-103, the Consumer Protection Act's general prohibition, with penalties under 30-14-142:

• a civil fine of up to $10,000 for each violation of an injunction or temporary restraining order;
• a civil fine of up to $10,000 for each willful violation, where the violator "knew or should have known" the conduct was unlawful; and
• for a fraudulent course of conduct, on conviction, a fine of up to $5,000, imprisonment of up to one year, or both.

Part 17 itself says nothing about private suits. Title 33 and the state agency part contain no penalty provision of their own in the sections read for this post.

The Montana Department of Justice's pages on breach reporting returned HTTP 403 to every request made for this post, so no list of notices received, guidance or enforcement release from the office was read, and the enforcement record here is zero. The one fetched item naming Montana is an Ohio Attorney General release of October 17, 2023, which lists Montana among 33 attorneys general in a $1.4 million settlement with Inmediata over state breach notification laws and HIPAA; it does not mention any Montana statute or Montana's share.

Frequently Asked Questions