AB288-AA1-AA1,2,3
5"
(2) Required notice. An entity that knows of the unauthorized use of
6unencrypted personal identifying information that was obtained while in the
7custody of the entity shall make reasonable efforts to notify each individual who is
8the subject of the information unless the entity knows that the individual is already
9aware of this unauthorized use. The notice shall indicate that the entity knows of
10the unauthorized use of personal identifying information. Notice shall be given in
11a manner and time frame that is reasonable, taking into consideration the number
12of notices to be given and methods of communication available to the entity. The
1notice shall be issued not more than 30 days after the entity gained knowledge of the
2unauthorized use of the personal identifying information, except that notice may be
3deferred upon request of or advice from law enforcement officials.".
