What personal information$/$data does the second law cover?

Personal information that is covered by the second law includes names, addresses, social security numbers, credit card information, social security numbers, medical records, and racial or ethnic origins.

Under the second law, what activities constitute a data or security breach?

Activities such as unauthorized access of personal data, unauthorized disclosure of personal data, cyber attacks, and loss or theft of devices containing personal data constitute a data breach.

Under the second law, how fast must an entity give notice to affected individuals following a data breach?

Entities must notify the affected individuals no later than $60$ days following a data breach.

Under the second law, can notification to affected individuals be delayed at the request of law enforcement?

Notification can be delayed if law enforcement determines that it would impede an investigation or jeopardize security.

Under the second law, can entities avoid giving notification to affected individuals if the data that was breached was encrypted?

Under the second law, entities may avoid giving notification to affected individuals if the data that was breached was encrypted and the encryption key was not compromised.

Which law do you think provides an affected individual with more protection in the event of a data security breach? Why?