CHAPTER 2. DEFINITIONS
IC 24-4.9-2
Chapter 2. Definitions
IC 24-4.9-2-1
Applicability
Sec. 1. The definitions in this chapter apply throughout thisarticle.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-2
"Breach of the security of data"
Sec. 2. (a) "Breach of the security of data" means unauthorizedacquisition of computerized data that compromises the security,confidentiality, or integrity of personal information maintained by aperson. The term includes the unauthorized acquisition ofcomputerized data that have been transferred to another medium,including paper, microfilm, or a similar medium, even if thetransferred data are no longer in a computerized format.
(b) The term does not include the following:
(1) Good faith acquisition of personal information by anemployee or agent of the person for lawful purposes of theperson, if the personal information is not used or subject tofurther unauthorized disclosure.
(2) Unauthorized acquisition of a portable electronic device onwhich personal information is stored, if all personal informationon the device is protected by encryption and the encryption key:
(A) has not been compromised or disclosed; and
(B) is not in the possession of or known to the person who,without authorization, acquired or has access to the portableelectronic device.
As added by P.L.125-2006, SEC.6. Amended by P.L.136-2008,SEC.2; P.L.137-2009, SEC.3.
IC 24-4.9-2-3
"Data base owner"
Sec. 3. "Data base owner" means a person that owns or licensescomputerized data that includes personal information.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-4
"Doing business in Indiana"
Sec. 4. "Doing business in Indiana" means owning or using thepersonal information of an Indiana resident for commercial purposes.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-5
Encrypted data
Sec. 5. Data are encrypted for purposes of this article if the data:
(1) have been transformed through the use of an algorithmicprocess into a form in which there is a low probability of
assigning meaning without use of a confidential process or key;or
(2) are secured by another method that renders the dataunreadable or unusable.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-6
"Financial institution"
Sec. 6. "Financial institution" means a financial institution asdefined in:
(1) IC 28-1-1-3, other than a consumer finance institutionlicensed to make supervised or regulated loans under IC 24-4.5;or
(2) 15 U.S.C. 6809(3).
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-7
"Indiana resident"
Sec. 7. "Indiana resident" means a person whose principal mailingaddress is in Indiana, as reflected in records maintained by the database owner.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-8
"Mail"
Sec. 8. "Mail" has the meaning set forth in IC 23-1-20-15.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-9
"Person"
Sec. 9. "Person" means an individual, a corporation, a businesstrust, an estate, a trust, a partnership, an association, a nonprofitcorporation or organization, a cooperative, or any other legal entity.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-10
"Personal information"
Sec. 10. "Personal information" means:
(1) a Social Security number that is not encrypted or redacted;or
(2) an individual's first and last names, or first initial and lastname, and one (1) or more of the following data elements thatare not encrypted or redacted:
(A) A driver's license number.
(B) A state identification card number.
(C) A credit card number.
(D) A financial account number or debit card number incombination with a security code, password, or access codethat would permit access to the person's account.
The term does not include information that is lawfully obtained from
publicly available information or from federal, state, or localgovernment records lawfully made available to the general public.
As added by P.L.125-2006, SEC.6.
IC 24-4.9-2-11
Redacted data or personal information
Sec. 11. (a) Data are redacted for purposes of this article if thedata have been altered or truncated so that not more than the last four(4) digits of:
(1) a driver's license number;
(2) a state identification number; or
(3) an account number;
is accessible as part of personal information.
(b) For purposes of this article, personal information is "redacted"if the personal information has been altered or truncated so that notmore than five (5) digits of a Social Security number are accessibleas part of personal information.
As added by P.L.125-2006, SEC.6.