[§487R-4]  Reporting requirements.  A
government agency shall submit a written report to the legislature within
twenty days after the discovery of a material occurrence of unauthorized access
to personal information records in connection with or after its disposal by or
on behalf of the government agency.  The report shall contain information
relating to the nature of the incident, the number of individuals affected by
the incident, and any procedures that have been implemented to prevent the
incident from reoccurring.  In the event that a law enforcement agency informs
the government agency that the report may impede a criminal investigation or
jeopardize national security, the report to the legislature may be delayed
until twenty days after the law enforcement agency has determined that the
report will no longer impede the investigation or jeopardize national security.
[L 2006, c 136, pt of §2]