The Port of Bellingham’s (“Port”) Human Resources Department (“HR”) utilizes the cloud-based software Dayforce as the Port’s human resource information system.  The Personal Information of Port employees and job applicants is stored in Dayforce.  Personal Information for purposes of this policy is defined as follows:
 
<ol style="margin-bottom:0in;margin-top:0px;">
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">An individual’s first name or first initial and last name in combination with any one or more of the following data elements:
<ol style="list-style-type:lower-alpha;margin-bottom:0in;margin-top:0px;">
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Social security number;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Driver’s license number or Washington identification card number;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Account number or credit or debit card, in combination with any required security code, access code, or password that would permit access to an individual’s financial account, or any other numbers or information that can be used to access a person’s financial account;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Full date of birth;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Private key that is unique to an individual and that is used to authenticate or sign an electronic record;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Student, military, or passport identification number;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Health insurance policy number or health insurance identification number; </li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Any information about medical history or mental or physical condition or a about a health care professional’s medical diagnosis or treatment of the consumer; or</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">Biometric data generated by automatic measurements of an individual’s biological characteristics such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a special individual.</li>
</ol>
</li>
</ol>
 
<ol style="margin-bottom:0in;margin-top:0px;" start="2">
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 0px;font-size:11pt;font-family:Calibri, sans-serif;">A username or email address in combination with a password or security questions and answers that would permit access to an online account; and</li>
</ol>
 
<ol style="margin-bottom:0in;margin-top:0px;" start="3">
<li style="text-align:justify;line-height:115%;margin:0in 0in 8pt 0px;font-size:11pt;font-family:Calibri, sans-serif;">Any of the data elements described above that are not combined with the first name or first initial and last name if (1) encryption, redaction, or other methods has not rendered the data element or combination of data elements unusable; and (2) the data element or combination of data elements would enable a person to commit identity theft against an employee or job applicant. </li>
</ol>
At any given time, the Port may have all or only part of the Personal Information identified above stored in Dayforce as to any particular employee or job applicant.  To the extent such Personal Information is in Dayforce, the Personal Information is secured, which means that it is encrypted in a manner that meets or exceeds the national institute of standards and technology standard or is otherwise modified so that the personal information is rendered unreadable, unusable or undecipherable by an unauthorized person. 
 
If an instance arises in which the Port reasonably believes that a Breach of its Dayforce account has occurred, the Port shall notify the Port employee or job applicant of the Breach.  A Breach occurs when (1) an unauthorized person has acquired Personal Information from the Port’s Dayforce account, and (2) the Port reasonably believes that such Personal Information was (a) not Secured or (b) an unauthorized person acquired the confidential process, encryption key, or other means to decipher Secured Personal Information.
 
At such a time as the Port reasonably believes notification is warranted under this Policy, the Port will notify impacted employees and job applicants no more than thirty (30) days after the Port discovers the Breach.  The Port may delay notification for longer than thirty (30) days if law enforcement has determined that notification will impede a criminal investigation into the Breach.  The Port may also delay notification if such a delay is necessary for the Port to complete measures to determine the scope of the Breach and restore the reasonable integrity of its Dayforce account. 
 
If the Port learns that the Personal Information subject to the Breach is that of an out-of-state resident, the Port shall comply with any applicable laws and regulations that relate to notifying the out-of-state resident of the Breach.  
 
Form of Notification
 
For any required notification under this Policy, the Port will either (1) issue a written notice to the employee or job applicant or (2) issue an electronic notice if the employee or job applicant has executed the Port’s Consent to Electronic Transmission Form.  The Form is in the Port’s shared drive or may otherwise be available upon request to HR.  
 
The Port’s notification shall contain, at a minimum, the following information:
 
<ul style="margin-bottom:0in;margin-top:0px;">
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 4.2px;font-size:11pt;font-family:Calibri, sans-serif;">The name and contact information for the Port;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 4.2px;font-size:11pt;font-family:Calibri, sans-serif;">A list of the data, as listed above under the definition of Personal Information, subject to the Breach;</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 0in 4.2px;font-size:11pt;font-family:Calibri, sans-serif;">A timeframe of exposure, if known (i.e., date of the breach and date of the discovery of the Breach); and</li>
<li style="text-align:justify;line-height:115%;margin:0in 0in 8pt 4.2px;font-size:11pt;font-family:Calibri, sans-serif;">The toll-free telephone numbers and addresses of the major credit reporting agencies.</li>
</ul>
The Port may use the Notification Letter template available in the Port’s shared drive. 
 
DATA BREACH RESPONSE TEAM
 
HR shall be responsible for responding to a Breach of the Port’s Dayforce account.  HR shall immediately notify the Port’s Dayforce account representative or manager and the Port’s Information Technology Department (“IT”) upon discovery of the Breach.  HR and IT shall work together to quickly assess the scope of the Breach and secure the Port’s Dayforce account.  HR shall notify law enforcement of the Breach if appropriate.  
 
If the Port discovers that the Breach involves the Personal Information of more than five hundred (500) Washington residents, the HR Department shall promptly notify the Washington State Attorney General’s Office of the Breach.