Virginia recently updated its data breach notification law to require notification when payroll data is compromised, HealthITSecurity reports. The amendment applies to employers or payroll service providers when there is unauthorized access and personal information is acquired, including unencrypted data containing taxpayer identification numbers in combination with income tax withholding information. The amendment also stated: "Good faith acquisition of personal information by an employee or agent of an individual or entity for the purposes of the individual entity is not a breach of the security of the system, provided that the personal information is not used for a purpose other than a lawful purpose of the individual or entity or subject to further unauthorized disclosure." 
Full Story