When a person or entity experiences a breach of the security of the system that requires notification under § 28-3852(a) or (b), and such breach includes or is reasonably believed to include a social security number or taxpayer identification number, the person or entity shall offer to each District resident whose social security number or tax identification number was released identity theft protection services at no cost to such District resident for a period of not less than 18 months. The person or entity that experienced the breach of the security of its system shall provide all information necessary for District residents to enroll in the services required under this section.
(June 17, 2020, D.C. Law 23-98, § 2(a)(5), 67 DCR 3923.)