Identity Theft Protection Act

North Carolina's Identity Theft Protection Act mandates that businesses must notify individuals affected by data breaches and implement protective measures to safeguard personal information.

JurisdictionNorth Carolina
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

The North Carolina Identity Theft Protection Act (ITPA) imposes several key requirements on businesses:

  • Notification of Security Breaches: Businesses must notify affected individuals "without unreasonable delay" when there is a security breach involving personal information. The notification must include:
  • A description of the incident
  • The type of information breached
  • Steps taken to protect from further unauthorized access
  • Contact information for inquiries
  • Advice on monitoring accounts and credit reports

Source: [NC DOJ Security Breach Information]

  • Protection of Social Security Numbers: Businesses are prohibited from:
  • Intentionally communicating or making SSNs available to the public
  • Printing SSNs on cards required to access products or services
  • Requiring SSNs to be transmitted over the Internet unless the connection is secure or encrypted

Source: [NC General Statute § 75-62]

  • Secure Disposal of Records: Businesses must implement and monitor compliance with policies for proper disposal of records containing personal information, including:
  • Shredding
  • Erasing
  • Modifying records to make personal information unreadable or undecipherable

Source: [NC General Statute § 75-64]

Compliance Challenges

Organizations face several challenges in complying with the ITPA:

  • Determining What Constitutes a Security Breach: The law's definition of a security breach can be open to interpretation, making it difficult for businesses to know when notification is required.

Source: [NC Bar Association Analysis]

  • Timely Notification: The requirement to notify "without unreasonable delay" can be challenging, especially for smaller businesses without dedicated IT security teams.

Source: [Poyner Spruill LLP Analysis]

  • Implementing Secure Disposal Methods: Ensuring all employees follow proper disposal procedures for both physical and electronic records can be difficult to monitor and enforce.

Source: [Smith Debnam Law Firm Article]

Implementation Best Practices

To effectively implement ITPA requirements, businesses should:

  • Develop a Written Information Security Program (WISP): Create a comprehensive plan outlining security measures, breach response procedures, and employee training protocols.

Source: [SANS Institute WISP Template]

  • Conduct Regular Risk Assessments: Regularly evaluate potential vulnerabilities in your data handling processes and update security measures accordingly.

Source: [NIST Risk Assessment Framework]

  • Implement Multi-Factor Authentication: Use MFA for all accounts accessing sensitive personal information to reduce the risk of unauthorized access.

Source: [NC IT Statewide Information Security Manual]

  • Encrypt Sensitive Data: Use strong encryption for personal information both in transit and at rest.

Source: [NIST Encryption Guidelines]

Recent Updates

As of 2023, there have been no major recent updates to the ITPA. However, there have been proposed amendments:

  • House Bill 904 (2019): Proposed changes included expanding the definition of "personal information" and requiring faster breach notifications.

Source: [NC Legislature HB 904]

  • Ongoing Discussions: Lawmakers continue to consider updates to strengthen the law in light of evolving cyber threats.

Source: [NC Attorney General's Office Updates]

Related Regulations

The ITPA interacts with several other regulations:

  • HIPAA: For healthcare organizations, HIPAA requirements for protecting health information overlap with ITPA requirements.

Source: [HHS HIPAA for Professionals]

  • GLBA: Financial institutions must comply with both GLBA and ITPA data protection requirements.

Source: [FTC Gramm-Leach-Bliley Act]

  • CCPA: While not directly applicable in NC, the California Consumer Privacy Act sets a higher standard for data protection that may influence future ITPA amendments.

Source: [California Attorney General CCPA Information]

Industry Impact

The ITPA has significant impacts across various industries:

  • Healthcare: Medical providers must integrate ITPA requirements with existing HIPAA compliance measures, potentially increasing compliance costs.

Source: [NC Medical Society Guidance]

  • Financial Services: Banks and credit unions face additional data protection requirements beyond federal regulations.

Source: [NC Bankers Association Resources]

  • Retail: Businesses collecting customer data for loyalty programs or online sales must ensure robust data protection measures.

Source: [NC Retail Merchants Association]

Sources

Recent developments

  • — Reporting on the newly introduced bipartisan **Stop Identity Fraud and Identity Theft Act**, which would place the Treasury Department at the center of a government‑wide effort to strengthen online identity verification and combat identity theft and fraud.[6] (source)
  • — Industry and policy commentators note that the bill responds to rising organized criminal and foreign‑adversary exploitation of online identity verification systems, with particular focus on protecting government benefit programs and mitigating deepfake‑enabled fraud.[6] (source)
  • — The proposal is seen as a significant **policy update** in federal identity‑theft protection, shifting more responsibility to Treasury and promoting NIST‑aligned digital identity standards, which could influence how banks, fintechs, and government agencies design identity‑proofing.[6] (source)
  • — Analysts highlight potential **industry impacts**, including future requirements or incentives for state DMVs and financial institutions to adopt more secure digital identity credentials that can reduce account‑opening fraud and synthetic identities.[6] (source)
  • — Privacy and consumer‑protection advocates are closely watching the legislation’s implementation details, particularly how it balances enhanced identity‑proofing with minimizing data collection and guarding against misuse of digital identity systems.[6] (source)
  • — Press release announcing the introduction of the **Stop Identity Fraud and Identity Theft Act**, a federal bill designed to strengthen digital identity infrastructure, support secure digital credentials, and address emerging threats like AI‑driven deepfakes associated with identity theft.[4] (source)
  • — The bill builds on existing federal digital identity guidelines, creates state innovation grants for modernizing identity systems, and explicitly keeps participation in digital IDs voluntary for both states and individuals, reflecting privacy and civil‑liberties concerns.[4] (source)
  • — Lawmakers frame the legislation as a response to “rapidly rising identity fraud and theft,” signaling congressional momentum toward broader identity‑theft protection that complements existing laws such as the Identity Theft and Assumption Deterrence Act and related enforcement frameworks.[4][5] (source)
  • — The bill’s grant program for state identity‑fraud prevention is expected to spur investment in secure digital versions of existing credentials (e.g., driver’s licenses), which may drive new vendor activity and standards alignment in the identity‑verification market.[4] (source)
  • — While not branded as an “Identity Theft Protection Act,” this latest federal proposal functions as a major **identity theft protection policy development**, aiming to modernize the framework for preventing, detecting, and mitigating identity fraud across multiple industries and government programs.[4] (source)

Read the full guide to Identity Theft Protection Act

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates