World423_JS_02

It has come to our attention that some of the data transferred by the "Diagnostics Analytics Module" related to residents of Colorado. Does Colorado Law require us to notify Colorado residents of this data transfer? 

Please respond to me here as a memo that outlines the requirements under the relevant laws and analyzes Northstar's situation in reference to the incident documentation.

Re: Colorado Data Transfer Notification 

I. Question Presented

Some of the data transferred by the "Diagnostics Analytics Module" related to residents of Colorado. Does Northstar need to notify any Colorado residents of the data transfer?

II. LAW

Colorado Statute 6-1-716, titled "Notification of Security Breach," dictates when notification obligations are triggered for security breaches under Colorado Law.

Section 6-1-716(2) titled "Disclosure of Breach" provides:

A covered entity that maintains, owns, or licenses computerized data that includes personal information about a resident of Colorado shall, when it becomes aware that a security breach may have occurred, conduct in good faith a prompt investigation to determine the likelihood that personal information has been or will be misused.  The covered entity shall give notice to the affected Colorado residents unless the investigation determines that the misuse of information about a Colorado resident has not occurred and is not reasonably likely to occur. Notice must be made in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to score the reasonable integrity of the computerized data system.

Section 6-1-716(b) defines "covered entity" as:

a person...that maintains, owns, or licenses personal information in the course of the person's business, vocation, or occupation. "Covered entity" does not include a person acting as a third-party service provider as defined in subsection (1)(i) of this section. 

Section 6-7-716-(h) defines "Security Breach" as:

the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity or personal information maintained by a covered entity. Good faith acquisition of personal information by an employee or agent of a covered entity for the covered entity's business purposes is not a security breach if the personal information is not used for a purpose unrelated to the lawful operation of the business or is not subject to further unauthorized disclosure.

Section 6-7-716-(g)(I) defines "Personal Information" as:

(A)...a Colorado resident's first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable: Social security number; student, military, or passport identification number; driver's license number or identification card number; medical information; health insurance identification number; or biometric data;

(B) A Colorado resident's username or e-mail address, in combination with a password or security questions and answers, that would permit access to an online account; or

(C) A Colorado resident's account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to that account.

(II) "Personal Information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records or widely distributed media.

III. Analysis

1. Is Northstar in possession of personal information of Colorado residents?'

In the present case Northstar inadvertently sent data to BlueQuill via the "Diagnostics Analytics Module (the "Module").  According to the "Analytics Module - for supervisory review.doc" the Module sent BlueQuill metadata which includes pseudonymous username identifiers and device identifiers. It is not possible to actually identify an individual from the either of the identifiers without additional information. BlueQuill did not receive any names, addresses, e-mails or other identifying information.  There is also no evidence that BlueQuill has the means to identify any of the individuals via the metadata they received. 

In order for information to be personal information it must contain the individual's first name or first initial and last name in combination with another element, such as Biometric data.  Northstar is in possession of personal information. However, it is important to note that the data that was transferred is not personal information because it does not contain anyone's first or last name. 

2. Is Northstar a covered entity?

Yes. Northstar is a covered entity because it maintains personal information. 

3. Did the transmission of the data by the Module constitute a security breach?

The Module's transmission of the data constitutes a security breach only if it comprised the personal data held by NorthStar. Here, there is no evidence that BlueQuill would be able to identify any person using the metadata, therefore the personal data was not compromised and the transmission of the data did not constitute a security breach.

IV. Conclusion

Northstar does not need to notify Colorado residents of the data transfer.