Banks advised to notify customers of data breaches

"If the institution determines that misuse of its information about a customer has occurred or is reasonably possible, it should notify the affected customer as soon as possible," the guidance states.

Notification may be delayed if a law enforcement agency believes that it will interfere with a criminal investigation.

The guidance defines sensitive customer information as a personal identification number (PIN), password, account number, or Social Security number, in conjunction with a customer's name, address, or phone number.

The guidance was issued earlier this week by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency, and the Office of Thrift Supervision.

The advisory comes in the wake of a string of breaches involving customer data at Choice Point, Bank of America, and LexisNexis.

California already has a security breach notification law while other states are eyeing similar requirements.

www.federalreserve.gov