SB340 H JUD AM 2-28 #1



The Committee on the Judiciary moves to amend the Committee Substitute on page two, following the enacting section, by striking out the remainder of the Committee Substitute and inserting in lieu thereof the following language:
ARTICLE 2A. BREACH OF SECURITY OF CONSUMER INFORMATION.
§46A-2A-101. Definitions. As used in this article:
(1) "Breach of the security of a system" means the unauthorized access or acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or entity.
Good faith acquisition of personal information by an employee or agent of an individual or entity for the purposes of the individual or the entity is not a breach of the security of the system, provided that the personal information is not used for a purpose other than a lawful purpose of the individual or entity or subject to further unauthorized disclosure.
(2)"Entity" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities, or any other legal entity, whether for profit or not-for-profit.
(3)"Encrypted" means transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key.
(4)"Financial institution" has the meaning given that term in section 6809(3), United States Code Title 15, as amended. (5)"Individual" means a natural person.
(6)"Personal information" means the first name or first initial and last name linked to any one or more of the following data elements that relate to a resident of this state, when the data elements are neither encrypted nor redacted:
(A)Social security number;
(B)Driver's license number or state identification card number issued in lieu of a driver's license; or
(C)Financial account number, or credit card, or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial accounts.
The term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.
(7)"Notice" means:
(A)Written notice to the postal address in the records of the individual or entity;
(B) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures, set forth in Section 7001, United States Code Title 15, Electronic Signatures in Global and National Commerce Act; and
(C)Substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed $50,000, or that the affected class of residents to be notified exceeds 100,000 persons or that the individual or the entity does not have sufficient contact information or to provide notice as described in paragraphs (A), (B) or (C). Substitute notice consists of all of the following:
(i)E-mail notice if the individual or the entity has e-mail addresses for the members of the affected class of residents;
(ii)Conspicuous posting of the notice on the Web site of the individual or the entity if the individual or the commercial entity maintains a Web site; or
(iii)Notice to major statewide media.
(8)"Redact" means alteration or truncation of data such that no more than the last four digits of a social security number, driver's license number, state identification card number or account number is accessible as part of the personal information.
§46A-2A-102. Notice of breach of security of computerized personal information.
(a)An individual or entity that owns or licenses computerized data that includes personal information shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person. Except as provided in subsection (e) or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the notice shall be made without unreasonable delay.
(b)An individual or entity must give notice of the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key.
(c)An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery, if the personal information was or is the entity reasonably believes was accessed and acquired by an unauthorized person.
(d)The notice shall include:
(1)To the extent possible, a description of the categories of information that were reasonably believed to have been accessed or acquired by an unauthorized person, including social security numbers, drivers' license or state identification numbers and financial data;
(2)A telephone number or website address that the individual may use to contact the entity or the agent of the entity and from whom the individual may learn:
(A)What types of information the entity maintained about that individual or about individuals in general; and
(B)Whether or not the entity maintained information about that individual.
(3)The toll-free contact telephone numbers and addresses for the major credit reporting agencies and information on how to place a fraud alert or security freeze.
(e)Notice required by this section may be delayed if a law enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation, or homeland or national security.  Notice required by this section must be made without unreasonable delay after the law enforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security.
(f)(1) If an entity is required to notify more than 1,000 persons of a breach of security pursuant to this article, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined by 15 U.S.C. 1681a(p), of the timing, distribution and content of the notices.
(2) All consumer reporting agencies that compile and maintain files on a nationwide basis, as defined by 15 U.S.C. 1681a(p), shall provide contact information to the Attorney General for the purpose of facilitating the notice requirements of subdivision (1) of this subsection. Contact information provided pursuant to this subdivision shall be in a form prescribed by the Attorney General.
(3) Nothing in this subsection shall be construed to require the entity to provide to the consumer reporting agency the names or other personal identifying information of breach notice recipients. This subsection shall not apply to an entity who is subject to Title V of the Gramm Leach Bliley Act, 15 U.S.C. 6801, et. seq.
(g) The notice required by this section shall not be considered a debt communication as defined by the Fair Debt Collection Practice Act in 15 U.S.C. §1692a.
§46A-2A-103. Procedures deemed in compliance with security breach notice requirements.
(a)An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and that are consistent with the timing and delivery requirements of this article shall be deemed to be in compliance with the notification requirements of this article if it notifies residents of this state, and does so in accordance with its procedures in the event of a breach of security of the system.
(b)A financial institution that responds in accordance with the notification guidelines prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with this article.
(c)An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures or guidelines established by the entity's primary or functional regulator shall be in compliance with this article.
§46A-2A-104.Violations.
(a)Except as provided by paragraph (c) of this section, failure to comply with the notice provisions of this article constitutes an unfair or deceptive act of practice in violation of section one hundred four, article six, chapter forty-six-a of this code, which may be enforced by the attorney general pursuant to the enforcement provisions of this chapter.
(b)Except as provided by paragraph (c) of this section, the attorney general shall have authority to bring action. No civil penalty may be assessed in an action unless the court finds that the defendant has engaged in a course of repeated and willful violations of this article. No civil penalty shall exceed one hundred fifty thousand dollars per breach of security of the system or series of breaches of a similar nature that are discovered in a single investigation.
(c)A violation of this article by a licensed financial institution shall be enforceable exclusively by the financial institution's primary functional regulator.
(d) Nothing in this section shall be construed to prevent a resident of this state whose personal information was accessed and acquired by an unauthorized person in violation of this article from bringing a civil action for recovery of actual damages as a result of the violation.
§46A-2A-105. Applicability.
This article shall apply to the discovery or notification of a breach of the security of the system that occurs on or after the effective date of this article.