14 Va. Admin. Code § 5-430-70

Current through Register Vol. 40, No. 22, June 17, 2024

Section 14VAC5-430-70 - Consumer notification provisions

A. Licensees, except those exempted under subsection A 1 or A 2 of § 38.2-629 of the Code of Virginia, that determine a cybersecurity event has occurred and has caused or has a reasonable likelihood of causing identity theft or other fraud to consumers whose information was accessed or acquired shall notify those consumers in accordance with § 38.2-626 of the Code of Virginia, subject to any applicable numerical threshold.

B. Each licensee required to notify consumers of a cybersecurity event that does not intend to notify consumers based on a belief that the cybersecurity event does not have a reasonable likelihood of causing identity theft or other fraud to the consumers shall notify the commissioner, without unreasonable delay, of its position and provide an explanation supporting the licensee's position.

Derived from Virginia Register Volume 37, Issue 21, eff. 6/1/2021.

Statutory Authority: §§ 12.1-13 and 38.2-223 of the Code of Virginia.