Washington D.C. Personal Data Breach Complaint

Under D.C. law, responsibility for personal data protection primarily falls on two categories:

• Data Controllers: Entities that determine the purpose and means of processing personal information. They are typically businesses, government bodies, or institutions that collect personal data from users or customers.
• Data Processors: Individuals or companies processing data on behalf of data controllers, such as contractors, vendors, or employees. While they may not make decisions about the data, their actions can still trigger legal liability.

In many cases, third parties who obtain personal information unlawfully or use it for unauthorized purposes may also be held liable.

If you suspect your personal information has been compromised, you may:

• Contact the business or organization that collected your data and request a breach explanation.
• File a complaint with the Office of the Attorney General for the District of Columbia, which investigates consumer privacy violations.
• Submit a data breach notification to the Office of the Chief Technology Officer (OCTO) if the breach involves city agencies or contractors.

Depending on the nature of the breach, legal actions may include:

• Criminal complaint: If data was obtained through hacking or deception, offenders may face criminal charges under D.C. Code § 22–3227.02 (fraud and identity theft laws).
• Civil lawsuit: Victims can sue under D.C. consumer protection statutes for damages, including emotional distress and financial loss.

According to §28–3863 of the D.C. Code (Consumer Protection Procedures Act), plaintiffs may be entitled to actual damages, statutory damages up to $1,500 per violation, and injunctive relief.

Personal information includes any data that can identify an individual, such as:

• Full name
• Social Security Number
• Date of birth
• Home address
• Driver’s license or state ID number
• Financial account details
• Biometric data (e.g., fingerprints)
• Health information

Disclosing any of these without consent can trigger legal consequences, especially if it results in financial or emotional harm.

Gathering strong evidence is vital before pursuing any complaint. Consider the following:

• Call or chat recordings (must be part of the conversation): Use if someone admits to leaking your data.
• Email or message screenshots that show personal data being shared.
• Web or social media captures showing public exposure of your information.
• Expert forensic reports in cases involving malware or hacking (e.g., analysis from a digital forensics provider).

• Save all digital copies of messages, documents, and system logs.
• Use third-party timestamp services for online screenshots.
• Avoid contacting the offender after discovering the breach, as it may compromise your legal position.

D.C. Code § 28–3852 (Data Breach Notification) mandates businesses to inform affected residents without unreasonable delay if personal data has been exposed.