Law note · Idaho
Identity Theft Act, breach notification enforcement and penalties
An affected entity's own primary regulator, not a private plaintiff, enforces the notice duty: the primary regulator may bring a civil action to compel compliance and enjoin further violations, and an agency, individual, or commercial entity that intentionally fails to give notice is subject to a fine of up to $25,000 per breach. The chapter creates no private right of action.
What it asks of an app
- Expect a violation of Idaho's breach notice duty to be enforced by your primary regulator, not by a private plaintiff.
- Avoid an intentional failure to give required notice; it carries a civil fine of up to $25,000 per breach.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Idaho statute text, Idaho Code Title 28, Chapter 51, Idaho Legislature