white_paper_on_data_protection_in_india_171127_final_v2

A research conducted by Ponemon Institute, sponsored by Arbor Networks and found that the
average security breach (in North America and EMEA regions) in the retail services sector
takes 197 days to detect and 98 days in the financial service sector. 734
Under Section 6 of the New Mexico Data Breach Notification Act, 2017 (New Mexico Data
Breach Act), a person that owns or licenses elements that include personal identifying
information of a New Mexico resident shall provide notification to each New Mexico resident
whose personal identifying information is reasonably believed to have been subject to a
security breach. Notification shall be made in the most expedient time possible, but not later
than 45 calendar days following discovery of the security breach.
The New Mexico Data Breach Act uses a time frame for notifying the individual in case of
breach. It provides that the notification should happen as soon as possible but also provides
an upper limit of 45 days for the purpose of notification to the affected individual. This
legislation solely provides for one time notification of the individual affected by the breach in
the manner prescribed under Section 7 of the said legislation.
This time frame allows the organisation to provide the individual with the information that
would help her/him understanding how the incident took place, what is being done in this
regard and the person or office to contact in case for following up. An argument in favour of
this manner of notification would be that it doesn‘t create a situation of panic, which might
happen if the individual is informed right at the time of initial detection. At the stage of initial
detection, the organisation itself is many times in the dark and won‘t have enough
information to answer the individual‘s queries and may result in an atmosphere of panic and
mistrust. This point needs to be deliberated upon further in the Indian context, where the
average individual‘s privacy awareness is at a very different level from what it is in the EU or
the US.
While fixing a time period for breach notification it is also important to take into
consideration the magnitude of the leak. If the number of individuals affected is in millions
then would it be prudent to put in a place a notification requirement like we see in the EU
GDPR where the data controller has only 72 hours to notify the individuals? It might be
within the ability of a large organisation to put automated reporting and breach notification
mechanisms in place. But that might not be the case with respect to SME and start-ups across
sectors. Building a notification matrix based on the size of the organisations could be a way to
tackle this problem, providing different time limits for notifying individuals. This could solve
this particular problem but at the risk of complicating the notification mechanism greatly.
734 Ponemon Institute LLC, ‗Advanced Threats in Retail – A Study of North America & EMEA‘, ARBOR
Networks, available at:
https://pages.arbornetworks.com/Global_Ponemon_Retail.html?utm_source=Ponemon&utm_medium=blog_pos
t&utm_term=AT&utm_content=<strong>white</strong><strong>paper</strong>&utm_campaign=Ponemon_Retail, (last accessed 21 November
2017); Ponemon Institute LLC, ‗Advanced Threats in Financial Services – A Study of North America &
EMEA‘, ARBOR Networks, available at:
https://pages.arbornetworks.com/Global_Ponemon_Financial_Services.html?utm_source=Ponemon&utm_medi
um=blog_post&utm_term=AT&utm_content=<strong>white</strong><strong>paper</strong>&utm_campaign=Ponemon_FinServ, (last accessed 21
November 2017).
164