# Standards and Regulatory References — Breach Credit Monitoring

## GDPR Context
- **Art. 34(1)**: Controller must communicate the breach and "describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." Credit monitoring is a standard mitigation measure.
- **Art. 83(2)(c)**: Mitigating factor for fines: "any action taken by the controller or processor to mitigate the damage suffered by data subjects." Offering credit monitoring demonstrates mitigation effort.
- **EDPB Guidelines 9/2022**: While not mandating credit monitoring, the EDPB recognizes it as a reasonable mitigation measure for breaches involving financial or identity data.

## US State Law Requirements
- Many US states require or strongly recommend offering credit monitoring for breaches involving SSN or financial data:
  - California: Not explicitly required by statute but AG office expects it for SSN/financial breaches.
  - Connecticut: Requires 24 months of identity theft prevention for SSN breaches.
  - Delaware: Requires 1 year of credit monitoring for SSN breaches.
  - Massachusetts: Requires 18 months of credit monitoring for SSN breaches.
  - New York: SHIELD Act does not mandate but AG guidance strongly recommends.

## Enforcement Precedents
- **ICO — British Airways (2020)**: BA's offer of credit monitoring was considered a mitigating factor in reducing the penalty.
- **HHS/OCR — Anthem (2018)**: Anthem offered 2 years of credit monitoring and identity repair services as part of its $16M settlement.
- **FTC — Equifax (2019)**: $575M settlement included up to $425M for consumer restitution including 10 years of free credit monitoring.
- **Multi-state AG — T-Mobile (2022)**: $350M settlement required 2 years of McAfee identity theft protection for affected customers.

## Industry Standards
- **PCI DSS v4.0**: Does not mandate credit monitoring but recommends it as part of incident response for payment card breaches.
- **NIST Privacy Framework**: Identifies mitigation of harm to affected individuals as a core principle; credit monitoring is a recognized mitigation mechanism.