When must the national consumer reporting agencies be notified about a security breach?
Except in certain situations, in the event that the security breach requires notification of more than 1,000 people, the entity must also notify, without unreasonable delay, the national consumer reporting agencies regarding the timing, distribution, and content of the notices. Are there any other ways by which the notification requirement may be met? Entities that maintain, as part of their information privacy or security policies, their own notification procedures that are in line with the security breach notification law’s timing requirement and that include West Virginia resident notification may follow those procedures. Financial institutions responding in accordance with the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice are deemed to be in compliance with the security breach notification law. Furthermore, entities that comply with their primary or functional regulator’s notification requirements or procedures
