Disclosure of Breach of Security of Computerized Personal

Information by an Individual or Entity.

(a)General Rule. An individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Guam whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and COL 052809 CH. 48 NOTIFICATION OF BREACHES OF PERSONAL INFORMATION that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of Guam. Except as provided in subsection

(d)of this Section, or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the disclosure shall be made without unreasonable delay.

(b)Encrypted Information. An individual or entity must disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of Guam.

(c)An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery, if the personal information was, or if the entity reasonably believes was, accessed and acquired by an unauthorized person.

(d)Notice required by this Section may be delayed if a law enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice required by this Section must be made without unreasonable delay after the law enforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security.