Ohio's Breach Statute, R.C. 1349.19: A 45-Day Ceiling, No State Filing and Escalating Daily Penalties

What Section 1349.19 Covers

The codified text of R.C. 1349.19 sits in chapter 1349, Ohio's consumer protection chapter, under the heading "Private disclosure of security breach of computerized personal information data." The Revised Code page lists an effective date of March 30, 2007 and names Senate Bill 126 of the 126th General Assembly as the latest legislation. The two companion sections that the breach statute relies on for enforcement, 1349.191 and 1349.192, each show House Bill 104 of the same General Assembly as their latest legislation, effective February 17, 2006.

The duty attaches to a "person" that owns or licenses computerized data that includes personal information. Division (A)(6) borrows the general definition of person in R.C. 1.59 but adds that a business entity counts "only if the business entity conducts business in this state." Business entity, in division (A)(2), expressly includes nonprofit groups and financial institutions chartered anywhere, along with their parents and subsidiaries. A resident, for this section, is an individual "whose principal mailing address as reflected in the records of the person is in this state," so the test turns on the address the holder has on file.

Personal information is narrow. Division (A)(7) requires a first name or initial and last name "in combination with and linked to" a Social Security number, a driver's license or state identification card number, or an account or card number together with the code or password that permits access to a financial account. The elements must not be encrypted, redacted or otherwise made unreadable, and division (A)(9) treats data as redacted when no more than the last four digits are accessible. Health, biometric and online credential data are not on the list. The definition of a "system" in division (A)(10) excludes routine internal office administration records if their use would not adversely affect an individual and there has been no unauthorized external breach of them.

The Material Risk Standard

Division (A)(1)(a) defines a breach as "unauthorized access to and acquisition of computerized data" that compromises the security or confidentiality of personal information and "causes, reasonably is believed to have caused, or reasonably is believed will cause a material risk of identity theft or other fraud to the person or property of a resident of this state." Two features follow from the wording. Access alone is not enough, because the definition joins access and acquisition with "and." And the harm test is part of the definition itself, then repeated in division (B)(1), which limits the disclosure duty to residents whose information was accessed and acquired where that event "causes or reasonably is believed will cause a material risk of identity theft or other fraud to the resident."

Two exclusions are written into division (A)(1)(b): good faith acquisition by an employee or agent for the person's purposes, if the information is not used unlawfully or further disclosed, and acquisition under a search warrant, subpoena, court order or a regulatory agency's order or duty. Division (B)(1) also lets the disclosure be made under a contract signed before the breach, provided the contract does not conflict with or waive the section, and division (H) declares any waiver of the section "contrary to public policy" and "void and unenforceable."

The 45-Day Clock

Division (B)(2) requires disclosure "in the most expedient time possible but not later than forty-five days following its discovery or notification of the breach." The clock is subject to two qualifications in the same sentence: the legitimate needs of law enforcement under division (D), and measures needed to determine the scope of the breach, "including which residents' personal information was accessed and acquired," and to restore the integrity of the data system. Division (D) allows delay where a law enforcement agency determines that notice "will impede a criminal investigation or jeopardize homeland or national security," and the delayed notice follows once the agency determines it will no longer do so.

A person that only stores or holds data on behalf of another person or a governmental entity has a different duty under division (C): it notifies that owner "in an expeditious manner," with no day count, if the access and acquisition carries the same material risk.

Division (E) lists the permitted methods: written notice; electronic notice, but only if the person's "primary method of communication with the resident" is electronic; telephone notice; and two forms of substitute notice. The general substitute route opens where contact information is insufficient, cost would exceed $250,000, or more than 500,000 residents are affected, and it combines email, a website posting and notice to media outlets reaching at least 75 percent of Ohio's population. The second route, in division (E)(5), is limited to a business entity with ten employees or fewer whose notice costs would exceed $10,000. It substitutes a paid quarter-page advertisement in a local newspaper, run once a week for three consecutive weeks, together with a website posting and notice to local media. The section prescribes no content for the notice to residents.

Consumer Reporting Agency Notice

Division (G) is the only notice the section requires beyond residents and data owners. A person that discovers circumstances requiring disclosure "to more than one thousand residents of this state involved in a single occurrence" must notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers nationwide "of the timing, distribution, and content of the disclosure." Division (A)(3) defines those agencies by the public record and credit account information they assemble. The same division adds that the bureau notice may not be used as a reason to delay notice to residents or owners.

No division requires notice to the Attorney General or any other state office. Division (F) removes two groups entirely: a financial institution, trust company or credit union, or its affiliate, that federal law requires to notify customers of a security breach and that is examined for compliance by its functional regulator; and any covered entity as defined in 45 C.F.R. 160.103, the HIPAA definition. Ohio's public offices are governed instead by R.C. 1347.12, which uses the same material risk definition and the same 45-day outer limit for state agencies and agencies of political subdivisions, and which also excludes agencies that are HIPAA covered entities.

Attorney General Enforcement Under 1349.192

Division (I) of the breach section authorizes the Attorney General to investigate and sue under sections 1349.191 and 1349.192. Section 1349.191 lets the office open an investigation on complaints or its own inquiries, administer oaths and subpoena witnesses and records, including records located outside Ohio. A subpoenaed person may petition the common pleas court in Franklin County, or in its home or principal-business county, to extend, modify or quash the subpoena within 20 days of service. Division (A)(2) of that section defines "business" by reference to 1349.19, which itself defines only "business entity."

Section 1349.192(A)(1) gives the Attorney General "the exclusive authority to bring a civil action in a court of common pleas" for injunctions and civil penalties against a person that fails to comply with 1349.19, or a public agency that fails to comply with 1347.12. Once the court finds a failure, it "shall impose" a penalty for each day of intentional or reckless noncompliance, scaled by duration:

• Up to $1,000 for each day of the first 60 days.
• Up to $5,000 for each day from the 61st day through the 90th day.
• Up to $10,000 for each day from the 91st day onward.

In setting the amount, division (A)(3) directs the court to consider all relevant factors, including whether the officer or employee with supervisory responsibility for compliance acted in bad faith. Penalties are deposited in the consumer protection enforcement fund under R.C. 1345.51, and division (B) makes the defendant liable for the Attorney General's investigation and litigation costs. Division (C) preserves other remedies available by law. Neither section names a private right of action.

No Ohio enforcement action citing section 1349.19 by number was located for this post, so the record of actions under that section stands at zero. Three Attorney General releases on breaches were fetched, and each is described here only as far as it goes. A September 26, 2018 release announced Ohio's role as a co-lead state in a $148 million settlement with Uber over its delay in notifying drivers of a 2016 breach that reached more than 12,000 Ohio drivers, stating that the breach "triggered laws in Ohio and other states requiring the company to notify affected individuals"; Ohio's share was $5,585,868. An October 17, 2023 release reported a $1.4 million, 33-state settlement with the health-care clearinghouse Inmediata, of which Ohio received $56,041, resolving allegations under "state breach notification laws" and HIPAA. A February 16, 2023 release on a $200,000 fine against DNA Diagnostics Center refers to the Consumer Sales Practices Act rather than to the breach statute. None of the three names the Ohio provision on which its notice claims rested.

Frequently Asked Questions