Law note · Alaska
Alaska Personal Information Protection Act, violations and enforcement
A governmental agency that violates the breach notification duty is liable to the state for a civil penalty of up to $500 per unnotified resident (capped at $50,000) and may be enjoined, enforced by the Department of Administration.
A non-governmental information collector's violation is instead deemed an unfair or deceptive act or practice under Alaska's Unfair Trade Practices and Consumer Protection Act (AS 45.50.471-45.50.561), which arms a private plaintiff, but this Act caps what that private plaintiff may recover: damages under the Act's general private and class action provision (AS 45.50.531, ordinarily treble damages or $500, whichever is greater) are limited here to actual economic damages not exceeding $500, and damages under the Act's fees-and-costs provision (AS 45.50.537) are limited to actual economic damages.
The non-governmental violator is also liable to the state for the same $500-per-resident, $50,000-total civil penalty as a governmental agency, though not the Act's ordinary civil penalties.
What it asks of an app
- Expect a violation of Alaska's breach notification duty by a non-governmental information collector to be pursued as an unfair or deceptive act or practice, which can arm a private plaintiff, not only the state.
- Do not assume a private plaintiff's recovery follows the general treble-damages rule of Alaska's Unfair Trade Practices Act. A breach notification violation caps recovery to actual economic damages not exceeding $500 under one cross-referenced remedy, and to actual economic damages under the other.
- Expect a civil penalty of up to $500 for each unnotified Alaska resident, capped at $50,000 total, regardless of whether the violator is a government agency or a private information collector.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Alaska Statutes text, Alaska State Legislature