(a) A violation of the notification provisions of this chapter is an unlawful trade practice under the Alabama Deceptive Trade Practices Act, Chapter 19 of this title, but does not constitute a criminal offense under Section 8-19-12. The Attorney General shall have the exclusive authority to bring an action for civil penalties under this chapter.

Attorney's Note

Under the Alabama Code, punishments for crimes depend on the classification. In the case of this section:
ClassPrisonFine
Violationup to 30 daysup to $200
For details, see Ala. Code § 13A-5-7

Terms Used In Alabama Code 8-38-9

  • Common law: The legal system that originated in England and is now in use in the United States. It is based on judicial decisions rather than legislative action.
  • Damages: Money paid by defendants to successful plaintiffs in civil cases to compensate the plaintiffs for their injuries.
  • following: means next after. See Alabama Code 1-1-1
  • Jurisdiction: (1) The legal authority of a court to hear and decide a case. Concurrent jurisdiction exists when two courts have simultaneous responsibility for the same case. (2) The geographic area over which the court has authority to decide cases.
  • person: includes a corporation as well as a natural person. See Alabama Code 1-1-1
  • preceding: means next before. See Alabama Code 1-1-1
  • President pro tempore: A constitutionally recognized officer of the Senate who presides over the chamber in the absence of the Vice President. The President Pro Tempore (or, "president for a time") is elected by the Senate and is, by custom, the Senator of the majority party with the longest record of continuous service.
  • state: when applied to the different parts of the United States, includes the District of Columbia and the several territories of the United States. See Alabama Code 1-1-1
  • Statute: A law passed by a legislature.
  • year: means a calendar year; but, whenever the word "year" is used in reference to any appropriations for the payment of money out of the treasury, it shall mean fiscal year. See Alabama Code 1-1-1
(1) A violation of this chapter does not establish a private cause of action under Section 8-19-10. Nothing in this chapter may otherwise be construed to affect any right a person may have at common law, by statute, or otherwise.
(2) Any covered entity or third-party agent who is knowingly engaging in or has knowingly engaged in a violation of the notification provisions of this chapter is subject to the penalty provisions set out in Section 8-19-11. For the purposes of this chapter, knowingly shall mean willfully or with reckless disregard in failing to comply with the notice requirements of Sections 8-38-5 and 8-38-6. Civil penalties assessed under Section 8-19-11, shall not exceed five hundred thousand dollars ($500,000) per breach.
(b)

(1) Notwithstanding any remedy available under subdivision (2) of subsection (a), a covered entity that violates the notification provisions of this chapter shall be liable for a civil penalty of not more than five thousand dollars ($5,000) per day for each consecutive day that the covered entity fails to take reasonable action to comply with the notice provisions of this chapter.
(2) The office of the Attorney General shall have the exclusive authority to bring an action for damages in a representative capacity on behalf of any named individual or individuals. In such an action brought by the office of the Attorney General, recovery shall be limited to actual damages suffered by the person or persons, plus reasonable attorney’s fees and costs.
(3) It is not a violation of this chapter to refrain from providing any notice required under this chapter if a court of competent jurisdiction has directed otherwise.
(4) To the extent that notification is required under this chapter as the result of a breach experienced by a third-party agent, a failure to inform the covered entity of the breach shall subject the third-party agent to the fines and penalties set forth in this chapter.
(5) Government entities shall be subject to the notice requirements of this chapter. A government entity that acquires and maintains sensitive personally identifying information from a government employer, and which is required to provide notice to any individual under this chapter, must also notify the employing government entity of any individual to whom the information relates.
(6) All government entities are exempt from any civil penalty authorized by this chapter; provided, however, the Attorney General may bring an action against any state, county, or municipal official or employee, in his or her official capacity, who is subject to this chapter for any of the following:

a. To compel the performance of his or her duties under this chapter.
b. To compel the performance of his or her ministerial acts under this chapter.
c. To enjoin him or her from acting in bad faith, fraudulently, beyond his or her authority, or under mistaken interpretation of the law.
(7) By February 1 of each year, the Attorney General shall submit a report to the Governor, the President Pro Tempore of the Senate, and the Speaker of the House of Representatives describing the nature of any reported breaches of security by government entities or third-party agents of government entities in the preceding calendar year along with recommendations for security improvements. The report shall identify any government entity that has violated any of the applicable requirements in this chapter in the preceding calendar year.
  Previous section
Next section  
 Chapter 38 Contents