Name of legislation
Industry
targeted
Breach provisions
Security provisions
information exists, the
Secretary must provide
credit protection services in accordance
with regulations issued
by the VA Secretary.
154
The VA must notify
individuals affected by
the breach within
60 days of the breach
155
Financial Services Modernization Act: (GrammLeach-Bliley Act)
Institutions
engaged in the
financial services industry
§ 501(b) of the GrammLeach-Bliley Act
(GLBA)
156
When a breach occurs,
the institution must
conduct an investigation to determine the
likelihood that the
information has been or
will be misused. If misuse has occurred or is
reasonably possible, the
institution must notify
the affected customer as
soon as possible, except
in cases where a law
enforcement determination that notification
will interfere with a
criminal
investigation
157
Fair Credit Reporting Act Retail
businesses
158
15 U.S.C. § 1681
When identity theft is
suspected, the credit
reporting agency must
include a fraud alert in
(continued)
154 38 U.S.C. § 5724(a)(2).
155 VA Handbook 6500.2, Section 4(c), p. 48. July 28, 2016. Available online at: https://www.va.
gov/vapubs/viewPublication.asp?Pub_ID¼843&FType¼2.
156 See “Guidance on Response Programs for Unauthorized Access to Customer Information and
Customer Notice”, Federal Deposit Insurance Program, 1 April 2005. Available online at: https://
www.fdic.gov/news/news/financial/2005/fil2705.html.
157 Saikali (2012).
158 FACTA includes a “truncation” requirement that applies to anyone who accepts credit or debit
cards as a form of payment. According to this requirement, the business entity may not print a
receipt that contains more than the last five digits of the card number or print the card’s expiration
date on any receipt given the customer at the point of the transaction. Transactions where the
consumer enters the account number by handwriting or the business uses an imprint of the card are
not bound by this requirement. Under the provisions of the Act, any person who negligently violates
the truncation requirement may be required to pay actual damages and attorneys’ fees. See
15 U.S.C. §§ 1681o(a) and 1681n(a).
430
S. M. Boyne
Industry
targeted
Breach provisions
Security provisions
information exists, the
Secretary must provide
credit protection services in accordance
with regulations issued
by the VA Secretary.
154
The VA must notify
individuals affected by
the breach within
60 days of the breach
155
Financial Services Modernization Act: (GrammLeach-Bliley Act)
Institutions
engaged in the
financial services industry
§ 501(b) of the GrammLeach-Bliley Act
(GLBA)
156
When a breach occurs,
the institution must
conduct an investigation to determine the
likelihood that the
information has been or
will be misused. If misuse has occurred or is
reasonably possible, the
institution must notify
the affected customer as
soon as possible, except
in cases where a law
enforcement determination that notification
will interfere with a
criminal
investigation
157
Fair Credit Reporting Act Retail
businesses
158
15 U.S.C. § 1681
When identity theft is
suspected, the credit
reporting agency must
include a fraud alert in
(continued)
154 38 U.S.C. § 5724(a)(2).
155 VA Handbook 6500.2, Section 4(c), p. 48. July 28, 2016. Available online at: https://www.va.
gov/vapubs/viewPublication.asp?Pub_ID¼843&FType¼2.
156 See “Guidance on Response Programs for Unauthorized Access to Customer Information and
Customer Notice”, Federal Deposit Insurance Program, 1 April 2005. Available online at: https://
www.fdic.gov/news/news/financial/2005/fil2705.html.
157 Saikali (2012).
158 FACTA includes a “truncation” requirement that applies to anyone who accepts credit or debit
cards as a form of payment. According to this requirement, the business entity may not print a
receipt that contains more than the last five digits of the card number or print the card’s expiration
date on any receipt given the customer at the point of the transaction. Transactions where the
consumer enters the account number by handwriting or the business uses an imprint of the card are
not bound by this requirement. Under the provisions of the Act, any person who negligently violates
the truncation requirement may be required to pay actual damages and attorneys’ fees. See
15 U.S.C. §§ 1681o(a) and 1681n(a).
430
S. M. Boyne