US Virgin Islands. Breach notification. Act
VI breach lawUS Virgin Islands data breach notification law (14 V.I.C. §§ 2208 (government), 2209 (private) (Identity Theft Prevention Act))
Partly verified
Low confidence.Citation confirmed via NCSL only; Perkins Coie USVI page and statute text could not be fetched.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about US Virgin Islands residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence, financial account numbers with codes.
- Key themes
- Unique features
Early California-style law; injured customers have a private right of action.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: the US Virgin Islands requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; no regulator notice
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Civil action for damages by injured customers; injunctive relief
§3Dates
- Key dates
- Adopted
- In force
- No amendment identified
§4Text and authority
- Text
- No authoritative text located.
- Authority
- US Virgin Islands Department of Justice (Attorney General)
§5Where it applies
- Domestic law of
- US Virgin Islands
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Citation confirmed via NCSL only; Perkins Coie USVI page and statute text could not be fetched.