---
jurisdiction: "District of Columbia"
slug: district-of-columbia
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-11"
canonicalUrl: https://openagreements.org/legal/privacy/district-of-columbia
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/district-of-columbia · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# District of Columbia Consumer Privacy Law[^about]

The District of Columbia has no comprehensive consumer-privacy statute; privacy enforcement runs through the Consumer Protection Procedures Act — whose private right of action extends to testers, nonprofits, and public-interest organizations — and a 2020-strengthened breach and data-security law.


## At a glance

| Question | District of Columbia |
| --- | --- |
| **Summary** | The District of Columbia has no omnibus privacy act, but its Consumer Protection Procedures Act lets consumers, testers, nonprofits, and public-interest organizations sue over deceptive data practices, and its breach law adds a reasonable-security duty, Attorney General notice at 50 affected residents, and 18 months of free identity-theft protection when a released Social Security or taxpayer identification number triggers that remedy. |
| **Main law** | Consumer Protection Procedures Act (CPPA), D.C. Code §§ 28-3901 et seq., plus the consumer security-breach subchapter, D.C. Code §§ 28-3851–3853 — the District has no comprehensive consumer-privacy law |
| **Privacy policy required?** | No District statute mandates a consumer privacy policy or fixes its contents; a policy that misstates practices is an unfair or deceptive trade practice under CPPA § 28-3904(e)–(f), and GLBA, HIPAA, and COPPA supply contents where they apply |
| **Who does it cover?** | Breach notice reaches a person or entity conducting business in the District that owns or licenses covered electronic data; security, destruction, and vendor-contract duties use the separate conduct triggers in § 28-3852.01; the CPPA reaches merchants supplying consumer goods or services; the District government itself is carved out |
| **Can consumers sue?** | Yes — CPPA § 28-3905(k)(1) grants standing to consumers, qualifying individual testers, nonprofits, and public-interest organizations, with treble or $1,500-per-violation damages; for § 28-3904(kk), the damages remedy is actual damages rather than treble or statutory damages |
| **Who enforces it?** | Office of the Attorney General for the District of Columbia (CPPA consumer complaints run through the Department of Licensing and Consumer Protection) |

## Which privacy laws apply to your business in the District of Columbia? {#which-privacy-laws-apply}

**Short answer.** The District of Columbia has no comprehensive consumer-privacy statute — no general rights of access, deletion, correction, or opt-out, and no controller-processor framework. Two District laws do the work instead. The Consumer Protection Procedures Act (CPPA) makes it a violation for any person to engage in an unfair or deceptive trade practice, whether or not any consumer is in fact misled, deceived, or damaged [^q1-cppa-udap]. The breach-notice duty applies to a person or entity conducting business in the District that owns or licenses covered electronic data and discovers a breach [^q1-breach-notice-scope]. Separate security, vendor-contract, and destruction duties apply under their own conduct triggers in § 28-3852.01 [^q1-security-duty-scope] [^q1-vendor-security] [^q1-destruction], while the definition of person or entity broadly covers private individuals and organizations but excludes the District government itself [^q1-breach-person-entity].

Because there is no omnibus act, District residents have no statutory rights to access, delete, or correct their data, no right to opt out of sale or targeted advertising, and no recognized universal opt-out signal under District law. What fills the gap is the CPPA plus the federal overlay. The CPPA is liberally construed: it must be construed and applied liberally, and it establishes an enforceable right to truthful information from merchants about consumer goods and services purchased, leased, or received in the District [^q1-cppa-liberal]. Misleading privacy settings, undisclosed data sharing, and broken security promises all plead as unfair or deceptive trade practices — which matters here because the CPPA carries a broad private right of action, covered in the consumer-lawsuit section below. The federal layer then applies as it does everywhere: FTC Act § 5 reaches deceptive or unfair privacy practices generally, the Gramm-Leach-Bliley Act governs financial institutions, HIPAA governs covered health entities, and COPPA governs services directed to children under 13. This note is written to stay durable: if the Council later enacts an omnibus law, a program built to the CPPA-plus-overlay framework upgrades rather than restarts.

## What must your privacy policy say in the District of Columbia? {#privacy-policy-contents}

**Short answer.** No District statute requires a general consumer privacy policy or fixes what it must contain. The binding rule is that whatever you publish must be true: the CPPA makes it a violation to misrepresent as to a material fact which has a tendency to mislead, or to fail to state a material fact if the failure tends to mislead [^q2-cppa-misrepresent], and FTC Act § 5 separately declares unfair or deceptive acts or practices in commerce unlawful [^q2-ftc-act]. A privacy policy that misstates how you collect, use, share, or secure data is actionable under both.

The CPPA expressly directs courts to give FTC Act § 5 interpretations due consideration and weight: in construing an unfair or deceptive trade practice, courts must give due consideration and weight to how the Federal Trade Commission and the federal courts interpret FTC Act § 5 [^q2-cppa-ftc-alignment]. Federal deception doctrine on privacy promises, omissions, and broken security commitments is therefore an important interpretive guide under District law. Where a sectoral regime applies, it supplies the contents: a HIPAA covered entity must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties [^q2-hipaa-notice], a GLBA financial institution must provide a notice that complies with 15 U.S.C. § 6803 before disclosing nonpublic personal information to a nonaffiliated third party [^q2-glba-notice], and COPPA requires covered child-directed operators to provide website notice of child-data collection, use, and disclosure practices [^q2-coppa-notice]. For everyone else, build the policy as best practice — categories of data collected, purposes, third-party sharing, and how users exercise any choices you offer — and then honor it. The stakes of a mismatch are higher in the District than in most sectoral jurisdictions: a misstatement needs no proof that any consumer was actually misled, and it is enforceable not just by the Attorney General but by the CPPA's unusually broad private-plaintiff classes, covered below.

## What must your contracts with vendors say about D.C. residents' data? {#vendor-contracts}

**Short answer.** The District has no omnibus data-processing-agreement statute — no prescribed processing instructions, audit rights, or subprocessor flow-downs. But unlike most sectoral jurisdictions, it does impose one targeted contract duty: a person or entity that discloses a District resident's personal information to a nonaffiliated third-party service provider under a written agreement must require, by that agreement, that the provider implement and maintain reasonable security procedures and practices appropriate to the information and reasonably designed to protect it from unauthorized access, use, modification, and disclosure [^q3-vendor-security].

That clause — added by the 2020 breach-law overhaul — makes a security term in every D.C.-facing vendor agreement a statutory requirement, not just hygiene. It is narrower than a comprehensive-state data processing agreement: it addresses security only, not processing purposes, deletion, or assistance duties. Where a federal regime applies, it adds its own contracting layer: the GLBA Safeguards Rule requires financial institutions to oversee service providers and to require them by contract to implement and maintain appropriate safeguards [^q3-glba-safeguards], and HIPAA requires a business-associate agreement with mandatory data-protection, breach-reporting, and subcontractor terms before sharing protected health information [^q3-hipaa-baa]. The practical drafting move for a vendor template touching D.C. residents is to fold the statutory security clause into the broader best-practice set — processing limited to documented instructions, confidentiality, breach notification back to your business, and return or deletion of data at the end of the engagement — so one rider satisfies the District requirement and the federal overlays at once.

## Does District of Columbia law require you to protect personal data? {#security-safeguards}

**Short answer.** Yes. Since the 2020 breach-law overhaul, any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of a District resident must implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information and to the nature and size of the entity or operation [^q4-safeguards-duty]. This is an affirmative data-security duty that applies before any breach occurs; the quoted duty does not include a separate size threshold, although the reasonableness standard scales to the nature and size of the entity or operation.

The duty extends through the data lifecycle: when destroying records that contain the personal information of a consumer, employee, or former employee — including electronic records and the devices that hold them — the person or entity must take reasonable steps to protect against unauthorized access to or use of that information [^q4-destruction]. The statute scales the standard to the data and the organization rather than defining *reasonable security safeguards* with a control list, so what is reasonable for a small retailer differs from what is reasonable for a data-rich platform. Entities already regulated federally get a deemed-compliance provision: a person or entity subject to and in compliance with the security requirements of the Gramm-Leach-Bliley Act, HIPAA, or the HITECH Act is deemed to comply with this section [^q4-deemed-compliance]. The teeth come from the enforcement bridge covered below — a violation of the security duty, like a violation of the notice duties, is an unfair or deceptive trade practice under the CPPA.

## When must you notify people of a data breach in the District of Columbia? {#breach-notification}

**Short answer.** Promptly. Any person or entity that conducts business in the District and owns or licenses electronic data including personal information must notify every District resident whose personal information was included in a breach, in the most expedient time possible and without unreasonable delay [^q5-resident-notice]. If the breach affects 50 or more District residents, written notice must also go promptly to the Office of the Attorney General — no later than when residents are notified [^q5-ag-notice]. And when a breach requires notification under § 28-3852(a) or (b) and includes or is reasonably believed to include Social Security or taxpayer identification numbers, the entity must offer identity-theft protection services at no cost for at least 18 months to each District resident whose Social Security number or taxpayer identification number was released [^q5-credit-monitoring].

The trigger is broad. A *breach of the security of the system* means the unauthorized acquisition of computerized or other electronic data — or any equipment or device storing such data — that compromises the security, confidentiality, or integrity of personal information [^q5-breach-def]. *Personal information* covers far more than Social Security numbers: a name or other identifier combined with a government ID number, a financial-account or card number with its access code, medical information, genetic information, health-insurance information, or biometric data [^q5-personal-info] — and, standing alone, a username or e-mail address combined with a password or other means of authentication that permits access to the person's e-mail account [^q5-credentials]. Two exclusions matter operationally. Properly encrypted or redacted data is outside the definition unless the protection itself was compromised. And the risk-of-harm exit is not unilateral: an acquisition falls outside the definition only if the entity reasonably determines, after a reasonable investigation *and consultation with the Office of the Attorney General and federal law enforcement*, that harm to the individual is unlikely [^q5-harm-exclusion]. The Attorney General notice must include eleven enumerated items, from the cause of the breach to a sample of the resident notice [^q5-ag-notice]. Entities that give notice under the GLBA or HIPAA/HITECH breach-notification regimes can satisfy the resident-notice duty that way, but that does not eliminate any Attorney General notice required by § 28-3852(b-1) [^q5-deemed-compliance].

## Can a consumer sue your business in the District of Columbia over privacy? {#consumer-lawsuit}

**Short answer.** Yes — and not only consumers. The CPPA grants a private right of action to a consumer; to an individual tester when the trade practice involves consumer goods or services purchased or received to test qualities for personal, household, or family purposes; to a nonprofit organization on behalf of itself, members, or the general public; and to a public interest organization on behalf of a consumer or class that could sue as consumers, subject to the sufficient-nexus dismissal rule [^q6-standing]. A prevailing plaintiff may recover treble damages or $1,500 per violation, whichever is greater, plus punitive damages, attorney's fees, and an injunction [^q6-remedies]. Data-breach and data-security failures are privately actionable too: a violation of the breach subchapter is an unfair or deceptive trade practice [^q6-bridge], enumerated in the CPPA's list of violations [^q6-kk]. For § 28-3904(kk), the damages remedy is actual damages rather than treble or $1,500-per-violation statutory damages, and actual damages exclude dignitary damages; fees and injunctive relief remain separately listed [^q6-remedies].

The standing grants do real work, but they carry conditions. Testers must fit the consumer-goods-or-services testing language, nonprofits must stay within the nonprofit route, and public-interest organizations can sue only where the represented consumer or class could sue as consumers and the organization has a sufficient nexus to the interests represented [^q6-standing]. Public-interest and general-public claims also face a stay rule: an overlapping Attorney General action under § 28-3909 stays those private claims until the Attorney General action is resolved, and public-interest or general-public plaintiffs must notify OAG within 10 days after filing [^q6-stay]. CPPA claims belong in D.C. Superior Court [^q6-remedies], where the statutory grants, rather than the federal injury-in-fact doctrine, frame who can sue. The two-track damages design is a deliberate split: privacy *deception* claims (a privacy policy or setting that misrepresents practices, under § 28-3904(e) or (f)) carry the full treble-or-$1,500-per-violation remedy, while *breach* claims routed through § 28-3904(kk) have an actual-damages remedy. Even on the breach track, fee-shifting and injunctive relief remain available [^q6-remedies], so the carve-out narrows the damages exposure without closing the courthouse door.

## Who enforces privacy law in the District of Columbia? {#enforcement}

**Short answer.** There is no privacy-specific regulator; public enforcement runs through the CPPA and the breach subchapter. A consumer can begin an administrative case by filing a complaint with the Department of Licensing and Consumer Protection describing the trade practice [^q7-complaint], and in that administrative path the Attorney General for the District of Columbia represents the Department in court proceedings under the Act [^q7-ag-role]. For data breaches and security failures, the breach subchapter's rights and remedies are cumulative with every other remedy available under law [^q7-cumulative]. Cumulative remedies do not erase the CPPA stay and notice rules: an overlapping Attorney General action under § 28-3909 stays public-interest-organization or general-public private claims until the Attorney General action is resolved, and those plaintiffs must notify OAG within 10 days after filing [^q7-stay].

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-11. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not District of Columbia. This article synthesizes District of Columbia primary law and is not legal advice from a District of Columbia-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^q1-cppa-udap]: **D.C. Code § 28-3904** — "It shall be a violation of this chapter for any person to engage in an unfair or deceptive trade practice, whether or not any consumer is in fact misled, deceived, or damaged thereby" *D.C. Code § 28-3904.* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3904>

[^q1-breach-notice-scope]: **D.C. Code § 28-3852(a)** — "Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach." *D.C. Code § 28-3852(a).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3852>

[^q1-security-duty-scope]: **D.C. Code § 28-3852.01(a)** — "To protect personal information from unauthorized access, use, modification, disclosure, or a reasonably anticipated hazard or threat, a person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District shall implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity or operation." *D.C. Code § 28-3852.01(a).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q1-vendor-security]: **D.C. Code § 28-3852.01(b)** — "A person or entity that uses a nonaffiliated third party as a service provider to perform services for a person or entity and discloses personal information about an individual residing in the District under a written agreement with the third party shall require by the agreement that the third party implement and maintain reasonable security procedures and practices" *D.C. Code § 28-3852.01(b).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q1-destruction]: **D.C. Code § 28-3852.01(c)** — "When a person or entity is destroying records, including computerized or electronic records and devices containing computerized or electronic records, that contain personal information of a consumer, employee, or former employee of the person or entity, the person or entity shall take reasonable steps to protect against unauthorized access to or use of the personal information" *D.C. Code § 28-3852.01(c).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q1-breach-person-entity]: **D.C. Code § 28-3851** — "‘Person or entity’ means an individual, firm, corporation, partnership, company, cooperative, association, trust, or any other organization, legal entity, or group of individuals. The term ‘person or entity’ shall not include the District of Columbia government or any of its agencies or instrumentalities." *D.C. Code § 28-3851(2A).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3851>

[^q1-cppa-liberal]: **D.C. Code § 28-3901** — "This chapter shall be construed and applied liberally to promote its purpose. This chapter establishes an enforceable right to truthful information from merchants about consumer goods and services that are or would be purchased, leased, or received in the District of Columbia." *D.C. Code § 28-3901(c).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3901>

[^q2-cppa-misrepresent]: **D.C. Code § 28-3904(e)–(f)** — "(e) misrepresent as to a material fact which has a tendency to mislead; (e-1) represent that a transaction confers or involves rights, remedies, or obligations which it does not have or involve, or which are prohibited by law; (f) fail to state a material fact if such failure tends to mislead;" *D.C. Code § 28-3904(e)–(f).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3904>

[^q2-ftc-act]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>

[^q2-cppa-ftc-alignment]: **D.C. Code § 28-3901(d)** — "In construing the term ‘unfair or deceptive trade practice’ due consideration and weight shall be given to the interpretation by the Federal Trade Commission and the federal courts of the term ‘unfair or deceptive act or practice,’ as employed in section 5(a) of An Act To create a Federal Trade Commission" *D.C. Code § 28-3901(d).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3901>

[^q2-hipaa-notice]: **HIPAA Notice of Privacy Practices** — "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information" *45 C.F.R. § 164.520.* <https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information>

[^q2-glba-notice]: **GLBA Privacy Notice** — "a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title" *15 U.S.C. § 6802(a).* <https://www.law.cornell.edu/uscode/text/15/6802#:~:text=a%20financial%20institution%20may%20not%2C,section%206803%20of%20this%20title>

[^q2-coppa-notice]: **COPPA Online Notice** — "to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information" *15 U.S.C. § 6502(b)(1)(A)(i).* <https://www.law.cornell.edu/uscode/text/15/6502#:~:text=to%20provide%20notice%20on%20the,disclosure%20practices%20for%20such%20information>

[^q3-vendor-security]: **D.C. Code § 28-3852.01(b)** — "A person or entity that uses a nonaffiliated third party as a service provider to perform services for a person or entity and discloses personal information about an individual residing in the District under a written agreement with the third party shall require by the agreement that the third party implement and maintain reasonable security procedures and practices that: (1) Are appropriate to the nature of the personal information disclosed to the nonaffiliated third party; and (2) Are reasonably designed to protect the personal information from unauthorized access, use, modification, and disclosure." *D.C. Code § 28-3852.01(b).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q3-glba-safeguards]: **GLBA Safeguards Rule** — "Requiring your service providers by contract to implement and maintain such safeguards" *16 C.F.R. § 314.4(f)(2).* <https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards>

[^q3-hipaa-baa]: **HIPAA Business Associate Contracts** — "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;" *45 C.F.R. § 164.504(e).* <https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,with%20respect%20to%20such%20information%3B>

[^q4-safeguards-duty]: **D.C. Code § 28-3852.01(a)** — "To protect personal information from unauthorized access, use, modification, disclosure, or a reasonably anticipated hazard or threat, a person or entity that owns, licenses, maintains, handles, or otherwise possesses personal information of an individual residing in the District shall implement and maintain reasonable security safeguards, including procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity or operation." *D.C. Code § 28-3852.01(a).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q4-destruction]: **D.C. Code § 28-3852.01(c)** — "When a person or entity is destroying records, including computerized or electronic records and devices containing computerized or electronic records, that contain personal information of a consumer, employee, or former employee of the person or entity, the person or entity shall take reasonable steps to protect against unauthorized access to or use of the personal information" *D.C. Code § 28-3852.01(c).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q4-deemed-compliance]: **D.C. Code § 28-3852.01(d)** — "A person or entity who is subject to and in compliance with requirements for security procedures and practices contained in Title V of the Gramm-Leach-Bliley Act, approved November 12, 1999 (113 Stat. 1436; 15 U.S.C. § 6801 et seq .), or the Health Insurance Portability Accountability Act of 1996, approved August 21, 1996 (Pub. L. No. 104-191; 110 Stat. 1936), or the Health Information Technology for Economic and Clinical Health Act, approved February 17, 2009 (Pub. L. No.111-5; 123 Stat. 226), and any rules, regulations, guidance and guidelines thereto, shall be deemed to be in compliance with this section" *D.C. Code § 28-3852.01(d).* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.01]>

[^q5-resident-notice]: **D.C. Code § 28-3852(a)** — "Any person or entity who conducts business in the District of Columbia, and who, in the course of such business, owns or licenses computerized or other electronic data that includes personal information, and who discovers a breach of the security of the system, shall promptly notify any District of Columbia resident whose personal information was included in the breach. The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (d) of this section, and with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system." *D.C. Code § 28-3852(a).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3852>

[^q5-ag-notice]: **D.C. Code § 28-3852(b-1)** — "In addition to giving the notification required under subsection (a) of this section, and subject to subsection (d) of this section, the person or entity required to give notice shall promptly provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia if the breach affects 50 or more District residents. This notice shall be made in the most expedient manner possible, without unreasonable delay, and in no event later than when notice is provided under subsection (a) of this section." *D.C. Code § 28-3852(b-1).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3852>

[^q5-credit-monitoring]: **D.C. Code § 28-3852.02** — "When a person or entity experiences a breach of the security of the system that requires notification under § 28-3852(a) or (b) , and such breach includes or is reasonably believed to include a social security number or taxpayer identification number, the person or entity shall offer to each District resident whose social security number or tax identification number was released identity theft protection services at no cost to such District resident for a period of not less than 18 months. The person or entity that experienced the breach of the security of its system shall provide all information necessary for District residents to enroll in the services required under this section." *D.C. Code § 28-3852.02.* <https://code.dccouncil.gov/us/dc/council/code/sections/[28-3852.02]>

[^q5-breach-def]: **D.C. Code § 28-3851(1)(A)** — "‘Breach of the security of the system’ means unauthorized acquisition of computerized or other electronic data or any equipment or device storing such data that compromises the security, confidentiality, or integrity of personal information maintained by the person or entity who conducts business in the District of Columbia." *D.C. Code § 28-3851(1)(A).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3851>

[^q5-personal-info]: **D.C. Code § 28-3851(3)(A)** — "An individual's first name, first initial and last name, or any other personal identifier, which, in combination with any of the following data elements, can be used to identify a person or the person's information: (I) Social security number, Individual Taxpayer Identification Number, passport number, driver's license number, District of Columbia identification card number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual; (II) Account number, credit card number or debit card number, or any other number or code or combination of numbers or codes, such as an identification number, security code, access code, or password, that allows access to or use of an individual's financial or credit account; (III) Medical information; (IV) Genetic information and deoxyribonucleic acid profile; (V) Health insurance information, including a policy number, subscriber information number, or any unique identifier used by a health insurer to identify the person that permits access to an individual's health and billing information; (VI) Biometric data of an individual generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic, that is used to uniquely authenticate the individual's identity when the individual accesses a system or account;" *D.C. Code § 28-3851(3)(A)(i)(I)–(VI).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3851>

[^q5-credentials]: **D.C. Code § 28-3851(3)(A)(ii)** — "A user name or e-mail address in combination with a password, security question and answer, or other means of authentication, or any combination of data elements included in sub-sub-subparagraphs (I) through (VI) of sub-subparagraph (i) that permits access to an individual's e-mail account." *D.C. Code § 28-3851(3)(A)(ii).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3851>

[^q5-harm-exclusion]: **D.C. Code § 28-3851(1)(B)(iii)** — "Acquisition of personal information of an individual that the person or entity reasonably determines, after a reasonable investigation and consultation with the Office of the Attorney General for the District of Columbia and federal law enforcement agencies, will likely not result in harm to the individual." *D.C. Code § 28-3851(1)(B)(iii).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3851>

[^q5-deemed-compliance]: **D.C. Code § 28-3852(g)** — "The person or entity shall, in all cases, provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia as required under subsection (b-1) of this section." *D.C. Code § 28-3852(g).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3852>

[^q6-standing]: **D.C. Code § 28-3905(k)(1)** — "A consumer may bring an action seeking relief from the use of a trade practice in violation of a law of the District. (B) An individual may, on behalf of that individual, or on behalf of both the individual and the general public, bring an action seeking relief from the use of a trade practice in violation of a law of the District when that trade practice involves consumer goods or services that the individual purchased or received in order to test or evaluate qualities pertaining to use for personal, household, or family purposes. (C) A nonprofit organization may, on behalf of itself or any of its members, or on any such behalf and on behalf of the general public, bring an action seeking relief from the use of a trade practice in violation of a law of the District, including a violation involving consumer goods or services that the organization purchased or received in order to test or evaluate qualities pertaining to use for personal, household, or family purposes. (D) (i) Subject to sub-subparagraph (ii) of this subparagraph, a public interest organization may, on behalf of the interests of a consumer or a class of consumers, bring an action seeking relief from the use by any person of a trade practice in violation of a law of the District if the consumer or class could bring an action under subparagraph (A) of this paragraph for relief from such use by such person of such trade practice. (ii) An action brought under sub-subparagraph (i) of this subparagraph shall be dismissed if the court determines that the public interest organization does not have sufficient nexus to the interests involved of the consumer or class to adequately represent those interests." *D.C. Code § 28-3905(k)(1)(A)–(D).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>

[^q6-remedies]: **D.C. Code § 28-3905(k)(2)** — "Any claim under this chapter shall be brought in the Superior Court of the District of Columbia and may recover or obtain the following remedies: (A) (i) Treble damages, or $1,500 per violation, whichever is greater, payable to the consumer; (ii) Notwithstanding sub-subparagraph (i) of this subparagraph, for a violation of § 28-3904(kk) a consumer may recover or obtain actual damages. Actual damages shall not include dignitary damages, including pain and suffering. (B) Reasonable attorney’s fees; (C) Punitive damages; (D) An injunction against the use of the unlawful trade practice;" *D.C. Code § 28-3905(k)(2).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>

[^q6-bridge]: **D.C. Code § 28-3853(b)** — "A violation of this subchapter , or any rule issued pursuant to the authority of this subchapter , is an unfair or deceptive trade practice pursuant to § 28-3904(kk)" *D.C. Code § 28-3853(b).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3853>

[^q6-kk]: **D.C. Code § 28-3904(kk)** — "violate any provision of subchapter 2 of Chapter 38 of this title" *D.C. Code § 28-3904(kk).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3904>

[^q6-stay]: **D.C. Code § 28-3905(k)(7)** — "Commencement of an action by the Attorney General under § 28-3909 , including the maintenance of an action previously commenced and pending as of [October 1, 2021], shall serve to stay until the resolution of the Attorney General's action any civil action that includes any claim that is: (i) Made pursuant to this subsection by a public interest organization or on behalf of the general public; and (ii) Based in whole or in part on any matter complained of in the action commenced by the Attorney General. (B) A plaintiff that is a public interest organization or is acting on behalf of the general public shall provide notice to the Office of the Attorney General within 10 days of the filing of an action that includes a claim made under this subsection." *D.C. Code § 28-3905(k)(7).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>

[^q7-complaint]: **D.C. Code § 28-3905(a)** — "A case is begun by filing with the Department a complaint plainly describing a trade practice and stating the complainant’s (and, if different, the consumer’s) name and address, the name and address (if known) of the respondent, and such other information as the Director may require." *D.C. Code § 28-3905(a).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>

[^q7-ag-role]: **D.C. Code § 28-3905(i)(4)** — "The Attorney General for the District of Columbia shall represent the Department in all proceedings described in this subsection." *D.C. Code § 28-3905(i)(4).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>

[^q7-cumulative]: **D.C. Code § 28-3853(c)** — "The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law." *D.C. Code § 28-3853(c).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3853>

[^q7-stay]: **D.C. Code § 28-3905(k)(7)** — "Commencement of an action by the Attorney General under § 28-3909 , including the maintenance of an action previously commenced and pending as of [October 1, 2021], shall serve to stay until the resolution of the Attorney General's action any civil action that includes any claim that is: (i) Made pursuant to this subsection by a public interest organization or on behalf of the general public; and (ii) Based in whole or in part on any matter complained of in the action commenced by the Attorney General. (B) A plaintiff that is a public interest organization or is acting on behalf of the general public shall provide notice to the Office of the Attorney General within 10 days of the filing of an action that includes a claim made under this subsection." *D.C. Code § 28-3905(k)(7).* <https://code.dccouncil.gov/us/dc/council/code/sections/28-3905>
