AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO COMPUTER SECURITY BREACHES.
HB381 amends Delaware’s data breach notification law in Chapter 12B of Title 6. The bill clarifies what counts as “notice” after a computer security breach by expressly recognizing written, telephonic, electronic, and substitute notice. It also expands and specifies the conditions for substitute notice, allowing it when the cost of notice would exceed $75,000, when more than 100,000 Delaware residents are affected, or when the business lacks sufficient contact information. Substitute notice must include email notice when available, website posting, notice to major statewide media and the company’s social media platforms, and notice to the Attorney General.
The bill also tightens and clarifies the timing rules for breach notifications. It keeps the general requirement that notice be given without unreasonable delay and no later than 60 days after determining a breach, while preserving exceptions for shorter federal deadlines and law-enforcement delays. If a business cannot identify all affected Delaware residents within 60 days despite reasonable diligence, it must notify those residents as soon as practicable once identified and must notify the Attorney General within 60 days of determining the breach, unless substitute notice has already been provided.
HB381 further clarifies compliance for entities already regulated under other state or federal privacy and security regimes, including HIPAA and the Gramm-Leach-Bliley Act. If such an entity follows breach procedures required by its primary regulator and notifies affected Delaware residents under those procedures, it is deemed compliant with the Delaware chapter’s notice requirements. The bill’s stated purpose is to clarify when businesses must notify the Attorney General of a computer security breach.
The bill’s impact is primarily on businesses, regulated entities, and any organization that handles Delaware residents’ personal information. It updates the state’s breach-notification framework, potentially reducing ambiguity about when substitute notice is allowed, how quickly notice must be given, and when regulated entities can rely on existing federal or state breach procedures. It also reinforces the Attorney General’s role in receiving breach notices and may affect compliance practices for companies responding to cyber incidents.
There is no recorded committee transcript or vote history in the provided materials, so no direct evidence of debate, support, or opposition is available. Based on the bill text, the measure appears technical and administrative rather than controversial, with its main focus on clarifying compliance obligations rather than creating new substantive privacy rights or penalties.
HB381 amends Delaware’s data breach notification statute in Title 6, Chapter 12B, by refining the definition of notice, setting explicit thresholds for substitute notice, and clarifying deadlines for notifying both affected residents and the Attorney General. It also confirms that certain regulated entities complying with their existing breach procedures under HIPAA, the Gramm-Leach-Bliley Act, or similar regulatory frameworks are deemed compliant with Delaware’s notice requirements when they notify residents accordingly. The bill primarily affects businesses, financial institutions, healthcare entities, and other custodians of personal information that must respond to security breaches.
No committee discussion or vote record was provided, so there is no documented legislative debate to gauge support or opposition. The bill’s text and synopsis suggest a generally practical, technical measure intended to clarify existing law and improve breach-notice administration, which typically indicates neutral to favorable sentiment among sponsors and stakeholders focused on compliance certainty.
The main points of potential contention are the expanded substitute-notice provisions and the timing rules for Attorney General notification. Businesses may favor the clearer thresholds and the ability to use substitute notice when direct notice is impracticable, while consumer advocates may scrutinize whether the thresholds are too permissive or whether substitute notice is less effective than direct notice. Another possible issue is the compliance safe harbor for entities already regulated under federal or other state regimes, which may be seen as reducing duplicative obligations but could also be viewed as limiting Delaware-specific oversight.