Definitions. — Guam Code § 48

§ 48. Definitions.

As used in this Chapter:

(a) Breach of the security of a system means the unauthorized access

and acquisition of unencrypted and unredacted computerized data that

compromises the security or confidentiality of personal information

maintained by an individual or entity as part of a database of personal

COL 052809

information regarding multiple individuals and that causes, or the individual

or entity reasonably believes has caused or will cause, identity theft or other

fraud to any resident of Guam.

Good faith acquisition of personal information by an employee or

agent of an individual or entity for the purposes of the individual or the

entity is not a breach of the security of the system, provided, that the

personal information is not used for a purpose other than a lawful purpose

of the individual or entity or subject to further unauthorized disclosure.

(b) Entity includes corporations, business trusts, estates, partnerships,

limited partnerships, limited liability partnerships, limited liability

companies, associations, organizations, joint ventures, governments,

governmental subdivisions, agencies, or instrumentalities, or any other legal

entity, whether for profit or not-for-profit.

(c) Encrypted means transformation of data through the use of an

algorithmic process into a form in which there is a low probability of

assigning meaning without the use of a confidential process or key, or

securing the information by another method that renders the data elements

unreadable or unusable.

(d) Financial institution has the meaning given that term in Section

6809(3) of Title 15, United States Code.

(e) Individual means a natural person.

(f) Personal information means the first name, or first initial, and last

name in combination with and linked to any one or more of the following

data elements that relate to a resident of Guam, when the data elements are

neither encrypted nor redacted:

(1) Social Security number;

(2 )Driver’s license number or Guam identification card number

issued in lieu of a driver’s license; or

(3) Financial account number, or credit card or debit card

number, in combination with any required security code, access code,

or password that would permit access to a resident’s financial

accounts.

(4) The term does not include information that is lawfully

obtained from publicly available information, or from Federal, State,

COL 052809

or local government records lawfully made available to the general

public.

(g) Notice means:

(1) Written notice to the postal address in the records of the

individual or entity;

(2) Telephone notice;

(3) Electronic notice; or

(4) Substitute notice, if the individual or the entity required to

provide notice demonstrates that the cost of providing notice will

exceed Ten Thousand Dollars ($10,000), or that the affected class of

residents to be notified exceeds five thousand (5,000) persons, or that

the individual or the entity does not have sufficient contact information

or consent to provide notice as described in paragraphs 1, 2, or 3.

Substitute notice consists of any two (2) of the following:

(A) E-mail notice if the individual or the entity has e-mail

addresses for the members of the affected class of residents;

(B) Conspicuous posting of the notice on the Website of the

individual or the entity, if the individual or the commercial entity

maintains a Website; and

(C) Notice to major Guam media.

(h) Redact means alteration or truncation of data such that no more

than the following are accessible as part of the personal information:

(1) five (5) digits of a Social Security Number, or

(2) The last four (4) digits of a driver's license number, Guam

identification card number or financial account number.