Request for Records on Data Breaches Affecting State Residents (Virginia Attorney General)

Karl Grindal filed this request with the Virginia Attorney General of Virginia.
Multi Request Request for Records on Data Breaches Affecting State Residents
Est. Completion None
Status
Payment Required

Communications

From: Tom Nash


To Whom It May Concern:

Pursuant to the Virginia Freedom of Information Act, I hereby request the following records:

Under the Virginia Freedom of Information Act, §2.2-3704 et seq., I am requesting an opportunity to obtain copies of public records that the Virginia Attorney General collects to monitor data breach notification reports affecting Virginia residents. This breach notification is mandatory under Va. Code §§ 18.2-186.6 that states that "In the event an individual or entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General..."

Under the Freedom of Information Act, I would like to request an export of the database Virginia's Office of Attorney General uses to monitor these notification reports. Specific attributes of interest would include: company name, date of breach, date of reporting, individuals affected in Virginia, total individuals affected, industry of affected business, type of breach (hacking, theft, etc.), type of information (name, act#, password), a textual description, etc. A model of the data I'm using from North Carolina is posted here: https://iapp.org/media/pdf/resource_center/North_Carolina_State_Data_Breaches.pdf. Records would be requested in full to include all years of collection, as well as any non-PII metadata. However, as regulations or law may necessitate further redaction, please provide "segregable" data wherever possible. Ideally records would be shared in an excel or .csv file format or another machine readable format.

I request a waiver of fees if possible. If fees for search and processing are expected to exceed $40 please contact me before proceeding. I intend for these records to be employed in academic research, which will produce quantitative comparative analysis of state reported data breaches. This research is in the public interest as it will advance our understanding of the nature of cybersecurity threats directed at the American private sector. Thank you for your consideration of this request.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 5 business days, as the statute requires.

Please note that I am a citizen of Virginia, and am using MuckRock's services to help manage and track my request.

Sincerely,

Tom Nash

From: Virginia Attorney General

Dear Mr. Nash:

Please see attached regarding your Freedom of Information Act correspondence – received October 13, 2020.

Sincerely,

Meaghan E. O'Brien
FOIA Officer
Office of the Attorney General
202 North 9th Street
Richmond, Virginia 23219
http://www.ag.virginia.gov
[cid:image001.jpg@01D6A70F.CC2652E0]<http://www.ag.virginia.gov/>
[cid:image002.jpg@01D6A70F.CC2652E0]<https://www.facebook.com/AGMarkHerring>[cid:image003.jpg@01D6A70F.CC2652E0]<https://twitter.com/AGMarkHerring>

From: Muckrock Staff

Hello,

Attached is Tom Nash's proof of Virginia residency for this request. Please let us know if we can provide any more information and thank you for your help with this request.

Sincerely,
MuckRock

[attachment redacted]

From: Virginia Attorney General

Tom Nash,

Is this an additional request you wish to make regarding data breach notifications, or are you following up on the request regarding data breach notifications you emailed us regarding yesterday? We sent the attached deposit request labeled (2) regarding data breaches, and I just responded to the request you emailed us regarding yesterday labeled (3).

Tyler Barnes
Assistant General Counsel

  • Nash, Tom (3) - Correspondence regarding request received 06-07-2023

  • Nash, Tom (2) - Correspondence regarding request received 06-15-2023 REVISED

Files

pages

Close