South Carolina's Section 39-1-90: Consumer Affairs, a $1,000-Per-Resident Fine and a Private Suit

Where the Duty Sits

Section 39-1-90 of the South Carolina Code is titled "Business data, breach of security; notifications, definitions, penalties, and exceptions." It was added by 2008 Act No. 190, effective July 1, 2009, and last amended by 2013 Act No. 15, effective April 23, 2013. Its companion for government, section 1-11-490, comes from the same 2008 act.

Subsection (A) applies to "a person conducting business in this State, and owning or licensing computerized data or other data that includes personal identifying information." Person takes its meaning from section 37-20-110(10): "a natural person, an individual, or an organization as defined in Section 37-1-301(20)." A party that maintains data it does not own notifies the owner or licensee "immediately following discovery" under subsection (B).

Computerized Data, Other Data and a Mismatch in the Text

The opening words reach beyond electronic systems: "computerized data or other data." The same phrase appears in subsection (B). The definition that controls what must be disclosed reads differently. Under (D)(1), a breach of the security of the system is "unauthorized access to and acquisition of computerized data that was not rendered unusable through encryption, redaction, or other methods that compromises the security, confidentiality, or integrity of personal identifying information." Neither provision mentions paper. The phrase "other data" in the operative language is not limited by medium, while the defined trigger speaks only of computerized data.

No appellate decision resolving that difference was read for this post. The Department of Consumer Affairs' guidance page for businesses does not address it either. The state agency companion uses the same pairing, with "computerized data or other data" in its operative language and computerized data in its breach definition.

A Harm Test Written Twice

Harm enters at both ends. Subsection (A) limits disclosure to a resident whose information was, or is reasonably believed to have been, acquired by an unauthorized person "when the illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to the resident." The definition in (D)(1) repeats nearly the same condition. The section does not call for documenting a no-harm decision or filing it with an agency.

The two sections describe protected data differently. The private-sector section speaks of information "not rendered unusable through encryption, redaction, or other methods," while the state agency section's operative subsection still says "unencrypted and unredacted." Good faith acquisition by an employee or agent for business purposes is excluded if the information is not used or subject to further unauthorized disclosure.

The Open-Ended Fourth Category

Under (D)(3), personal identifying information is a first name or initial and last name linked to a resident's Social Security number, driver's license or state identification number, or financial account or card number with any required code, or the catch-all in (D)(3)(d): "other numbers or information which may be used to access a person's financial accounts or numbers or information issued by a governmental or regulatory entity that uniquely will identify an individual." That last clause is not tied to a specific credential or document, so it reaches identifiers beyond the three that precede it. Publicly available information and lawfully available government records are excluded.

Timing and Methods

No day count appears in the section. The statute calls for disclosure "in the most expedient time possible and without unreasonable delay," consistent with law enforcement needs under subsection (C) or with measures to determine the scope of the breach and restore system integrity. Subsection (C) allows delay where a law enforcement agency determines notification impedes a criminal investigation.

Notice may be written, electronic, telephonic, or substitute. Electronic notice qualifies if electronic communication is the person's primary method of communication with the individual or is consistent with federal and state electronic records law. Substitute notice opens above $250,000 in cost, 500,000 persons, or insufficient contact information, and consists of email, website posting "or" notification to major statewide media. The section prescribes no content for a resident's notice. Subsection (F) treats a person following its own procedures as compliant if they are consistent with the section's timing.

Consumer Affairs, Not the Attorney General

Subsection (K) is the only provision that sends information to a state office. When a business provides notice to more than 1,000 persons at one time, it notifies "the Consumer Protection Division of the Department of Consumer Affairs and all consumer reporting agencies that compile and maintain files on a nationwide basis" of the timing, distribution and content of the notice. The Attorney General does not appear anywhere in the section.

The Department describes the filing in terms the statute does not use. Its business guidance says a notice goes to the agency at "1,000 or more" residents and lists items it says the notice should include: the dates of breach, awareness and consumer notification, the method and number of residents, a copy of the consumer letter, and action taken to avoid future breaches. Its security breach notices page states the threshold as more than 1,000 residents and notes that businesses reporting fewer may decide whether to provide a copy. The page lists notices received since 2015. A Department release reports that 41 businesses reported breaches affecting 1,131,320 South Carolina residents between January 1 and June 30, 2026. Financial businesses accounted for 12 of those filings and 801,652 of the residents; four hospitality breaches reached 154,455 residents and three education sector breaches reached 91,842.

Agencies have a matching route. Section 1-11-490(I) requires the same notice to the Consumer Protection Division and the bureaus when an agency notifies more than 1,000 persons at one time.

Two Civil Tracks and an Administrative Fine

Private liability is set out by state of mind. Under subsection (G), a resident "who is injured by a violation of this section, in addition to and cumulative of all other rights and remedies available at law" may do the following:

• bring an action "to recover damages in case of a wilful and knowing violation";
• bring an action "limited to actual damages resulting from a violation in case of a negligent violation";
• seek an injunction to enforce compliance; and
• recover attorney's fees and court costs if successful.

Subsection (H) adds an administrative route: a person who "knowingly and wilfully violates this section is subject to an administrative fine in the amount of one thousand dollars for each resident whose information was accessible by reason of the breach, the amount to be decided by the Department of Consumer Affairs." The fine is measured by residents whose information was accessible, not those notified, and the Department sets the figure.

State agencies are treated differently on both counts. Section 1-11-490(G) gives injured residents a damages action without the wilful and negligent tiers, and 1-11-490(H) caps the agency fine at "up to one thousand dollars" per resident. Subsections (I) and (J) of 39-1-90 exclude a bank or financial institution subject to and in compliance with Gramm-Leach-Bliley privacy and security provisions and deem compliant a financial institution following the 2005 federal interagency guidance.

What the Department and the Attorney General Have Published

The Department's enforcement actions page, fetched for this post, contains no entry under section 39-1-90, and the record of actions under the section therefore stands at zero. Separately, the Attorney General has announced multistate breach results in general terms. An October 8, 2020 release reports a judgment against Community Health Systems covering 400,903 South Carolina patients, part of a $5 million payment to 28 states, and a release on the 23andMe bankruptcy settlement reports $280,000 to South Carolina for a breach reaching 80,181 residents. Neither cites section 39-1-90, and the statute itself gives the Attorney General no role.

Frequently Asked Questions