Laserfiche WebLink
Response to Suspected Breach <br />Upon the report of a suspected breach, the city administrator shall take any and all actions necessary <br />to secure the data and to protect the data from continued or repeated breach and shall conduct a <br />preliminary internal assessment of the scope of the breach. <br /> <br />If the breach is suspected on a city computing system that contains or has network access to Not <br />Public Data, the city administrator shall consult with city IT personnel and consider control measures, <br />including, but not limited to, removing the computer system from the city network. <br /> <br />Determination of Breach <br />The city administrator, in conjunction with the city attorney, shall determine whether a breach has <br />occurred. Due consideration should be given to the potential for damage to individuals if no breach <br />is determined and notice is not provided. Contact the League of Minnesota Cities (LMCIT) Claims <br />Department. LMCIT may provide a breach coach to assist with the handling of a data security <br />breach or cyber event. <br /> <br />Notice <br />If it is determined that a breach has occurred, the city administrator shall provide notice to all data <br />subjects affected by the breach. The city administrator, in conjunction with the city attorney, shall <br />determine whether notice is required to be provided and to whom such notice is to be provided. At <br />a minimum, individuals shall be notified if their private or confidential data was, or is reasonably <br />believed to have been, acquired by an unauthorized person. If specific individuals cannot be <br />identified, notice should be sent to groups of individuals likely to have been affected, such as all <br />whose information is stored in the database or files involved in the breach. Appropriate measures <br />should also be taken to prevent notice lists from being over-inclusive. The forms of notice to be <br />provided are attached. <br /> <br />1. Timing. Notice shall be provided to all affected data subjects without unreasonable delay, <br />subject to: <br />a) The legitimate needs of a law enforcement agency; and <br />b) any measures necessary to determine the scope of the breach and restore the <br />reasonable security of the data. <br /> <br />Immediate notification may be appropriate in the event of a breach that could have <br />immediate deleterious impact on individuals whose data may have been acquired by an <br />unauthorized person. <br /> <br />2. Content. The notice shall generally include the following information: <br />a) A general description of what happened, and when, to the extent known. <br />b) The nature of the individual’s private or confidential information that was involved <br />(not listing the specific private/confidential data). <br />c) Information about what the city has done to protect the individual’s <br />private/confidential information from further disclosure. <br />d) City assistance (such as website information or phone number of a city resource) for <br />further information about the incident.