Additional data breach reporting requirements

Beginning June 11, cities are required to notify residents if the last four digits of their social security number (SSN) are compromised during a data breach.

Passed into law during the 2020 session, HB 6187 expands notification requirements to include the last four digits of SSNs. As data breaches become more frequent, these expanded requirements provide additional protections for residents’ personal information. Before June 11, cities are required to notify residents only when their full SSN, among other identifying information, is compromised during a data breach.

We encourage cities to review their current process for reporting data breaches and include the last four digits of SSN as reportable information.