At the same time as consumer notification, breach reporting must be made to the Attorney General’s Consumer Protection Office. Notifying the Commissioner of Insurance is required in some cases involving insurance related breaches.

If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.

Organizations may be fined or penalized for Vendor violations. Actions may be brought for temporary or permanent injunctive relief for violations. A civil action may be brought if there is a violation under the credit reporting laws.

A vendor discovering a breach or suspected breach must notify the data owner. The organization is responsible for reporting to regulator and consumer notification. Vendors in the business of destroying records must have measures in place for the destruction of records containing personal information so the records are unreadable or undecipherable. Under Montana’s Consumer Protection law, “an entity that destroys records” is included in the definition of “business”.