North Carolina 2025-2026 Regular Session

North Carolina House Bill H608 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		GENERAL ASSEMBLY OF NORTH CAROLINA
2	2		SESSION 2025
3		-	H 1
4		-	HOUSE BILL 608
	3	+	H D
	4	+	HOUSE BILL DRH40322-ML-67
	5	+
5	6
6	7
7	8		Short Title: Protect Health and Gov't Personnel Info. (Public)
8		-	Sponsors: Representatives Rubin, Ball, Lofton, and R. Pierce (Primary Sponsors).
9		-	For a complete list of sponsors, refer to the North Carolina General Assembly web site.
10		-	Referred to: Judiciary 2, if favorable, State and Local Government, if favorable, Rules,
11		-	Calendar, and Operations of the House
12		-	April 1, 2025
13		-	H608 -v-1
	9	+	Sponsors: Representative Rubin.
	10	+	Referred to:
	11	+
	12	+	DRH40322 -ML-67
14	13		A BILL TO BE ENTITLED 1
15	14		AN ACT TO PROVIDE ADDITIONAL PROTECTIONS FOR PR OTECTED HEALTH 2
16	15		INFORMATION AND GOVERNMENT EMPLOYEE PERSONNEL INFORMATION. 3
17	16		Whereas, people throughout North Carolina provide sensitive health information to 4
18	17		their doctors, hospitals, and other health care providers, and they often provide sensitive health 5
19	18		information as part of key government programs like Medicare and Medicaid; and 6
20	19		Whereas, federal, State, and local government employees are frequently required to 7
21	20		provide sensitive personal information to the government as part of their hiring and employment, 8
22	21		and this sensitive information is entrusted to the government to care for in accordance with strict 9
23	22		procedures; and 10
24	23		Whereas, unauthorized copying of these sensitive forms of data can lead to lasting 11
25	24		injury to those affected; and 12
26	25		Whereas, North Carolina's Computer Trespass offense criminalizes unauthorized 13
27	26		copying of computer data but lacks an automatic minimum amount of damages for 14
28	27		misappropriation of protected health information or government personnel files; Now, therefore, 15
29	28		The General Assembly of North Carolina enacts: 16
30	29		SECTION 1. G.S. 14-458 reads as rewritten: 17
31	30		"§ 14-458. Computer trespass; penalty. 18
32	31		(a) Except as otherwise made unlawful by this Article, it shall be unlawful for any person 19
33	32		to use a computer or computer network without authority and with the intent to do any of the 20
34	33		following: 21
35	34		(1) Temporarily or permanently remove, halt, or otherwise disable any computer 22
36	35		data, computer programs, or computer software from a computer or computer 23
37	36		network. 24
38	37		(2) Cause a computer to malfunction, regardless of how long the malfunction 25
39	38		persists. 26
40	39		(3) Alter or erase any computer data, computer programs, or computer software. 27
41	40		(4) Cause physical injury to the property of another. 28
42	41		(5) Make or cause to be made an unauthorized copy, in any form, including, but 29
43	42		not limited to, any printed or electronic form of computer data, computer 30
44	43		programs, or computer software residing in, communicated by, or produced 31
45	44		by a computer or computer network. 32
46	45		(6) Falsely identify with the intent to deceive or defraud the recipient or forge 33
47		-	commercial electronic mail transmission information or other routing 34 General Assembly Of North Carolina Session 2025
48		-	Page 2 House Bill 608-First Edition
49		-	information in any manner in connection with the transmission of unsolicited 1
50		-	bulk commercial electronic mail through or into the computer network of an 2
51		-	electronic mail service provider or its subscribers. 3
52		-	For purposes of this subsection, a person is "without authority" when (i) the person has no 4
53		-	right or permission of the owner to use a computer, or the person uses a computer in a manner 5
54		-	exceeding the right or permission, or (ii) the person uses a computer or computer network, or the 6
55		-	computer services of an electronic mail service provider to transmit unsolicited bulk commercial 7
56		-	electronic mail in contravention of the authority granted by or in violation of the policies set by 8
57		-	the electronic mail service provider.provider, or (iii) in the case of computer data that is in a 9
58		-	personnel file of a local, State, or federal government employee, the person has no authority 10
59		-	under local, State, or federal law to view or otherwise access that information or has willfully 11
60		-	failed to follow the requirements of the local, State, or federal law granting such authority. For 12
61		-	purposes of this subsection, the term "personnel file" is as defined in G.S. 1-539.2A. 13
62		-	(b) Any person who violates this section shall be guilty of computer trespass, which 14
63		-	offense shall be punishable as a Class 3 misdemeanor. If there is damage to the property of 15
64		-	another and the damage is valued at less than two thousand five hundred dollars ($2,500) caused 16
65		-	by the person's act in violation of this section, the offense shall be punished as a Class 1 17
66		-	misdemeanor. If there is damage to the property of another valued at two thousand five hundred 18
67		-	dollars ($2,500) or more caused by the person's act in violation of this section, the offense shall 19
68		-	be punished as a Class I felony. 20
69		-	(c) Any person whose property or person is injured by reason of a violation of this section 21
70		-	may sue for and recover any damages sustained and the costs of the suit pursuant to 22
71		-	G.S. 1-539.2A. 23
72		-	(d) It is not a violation of this section for a person to act pursuant to Chapter 36F of the 24
73		-	General Statutes." 25
74		-	SECTION 2. G.S. 1-539.2A reads as rewritten: 26
75		-	"§ 1-539.2A. Damages for computer trespass. 27
76		-	(a) Any person whose property or person is injured by reason of a violation of 28
77		-	G.S. 14-458 may sue for and recover any damages sustained and the costs of the suit. Without 29
78		-	limiting the general of the term, "damages" shall include loss of profits. If the injury arises from 30
79		-	the transmission of unsolicited bulk commercial electronic mail, the injured person, other than 31
80		-	an electronic mail service provider, may also recover attorneys' fees and may elect, in lieu of 32
81		-	actual damages, to recover the lesser of ten dollars ($10.00) for each and every unsolicited bulk 33
82		-	commercial electronic mail message transmitted in violation of this section, or twenty-five 34
83		-	thousand dollars ($25,000) per day. The injured person shall not have a cause of action against 35
84		-	the electronic mail service provider which merely transmits the unsolicited bulk commercial 36
85		-	electronic mail over its computer network. If the injury arises from the transmission of unsolicited 37
86		-	bulk commercial electronic mail, an injured electronic mail service provider may also recover 38
87		-	attorneys' fees and costs and may elect, in lieu of actual damages, to recover the greater of ten 39
88		-	dollars ($10.00) for each and every unsolicited bulk commercial electronic mail message 40
89		-	transmitted in violation of this section, or twenty-five thousand dollars ($25,000) per day. 41
90		-	(a1) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 42
91		-	data that is protected health information, the injured person may sue and recover for each 43
92		-	violation the greater of the damages sustained or five thousand dollars ($5,000) and the costs of 44
93		-	the suit. 45
94		-	(a2) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 46
95		-	data that is in the personnel file of a local, State, or federal employee, the injured person may sue 47
96		-	and recover for each violation the greater of the damages sustained or five thousand dollars 48
97		-	($5,000) and the costs of the suit. 49
98		-	(b) A civil action under this section shall be commenced before expiration of the time 50
99		-	period prescribed in G.S. 1-54. In actions alleging injury arising from the transmission of 51 General Assembly Of North Carolina Session 2025
100		-	House Bill 608-First Edition Page 3
	46	+	commercial electronic mail transmission information or other routing 34
	47	+	information in any manner in connection with the transmission of unsolicited 35
	48	+	H.B. 608
	49	+	Mar 31, 2025
	50	+	HOUSE PRINCIPAL CLERK General Assembly Of North Carolina Session 2025
	51	+	Page 2 DRH40322-ML-67
	52	+	bulk commercial electronic mail through or into the computer network of an 1
	53	+	electronic mail service provider or its subscribers. 2
	54	+	For purposes of this subsection, a person is "without authority" when (i) the person has no 3
	55	+	right or permission of the owner to use a computer, or the person uses a computer in a manner 4
	56	+	exceeding the right or permission, or (ii) the person uses a computer or computer network, or the 5
	57	+	computer services of an electronic mail service provider to transmit unsolicited bulk commercial 6
	58	+	electronic mail in contravention of the authority granted by or in violation of the policies set by 7
	59	+	the electronic mail service provider.provider, or (iii) in the case of computer data that is in a 8
	60	+	personnel file of a local, State, or federal government employee, the person has no authority 9
	61	+	under local, State, or federal law to view or otherwise access that information or has willfully 10
	62	+	failed to follow the requirements of the local, State, or federal law granting such authority. For 11
	63	+	purposes of this subsection, the term "personnel file" is as defined in G.S. 1-539.2A. 12
	64	+	(b) Any person who violates this section shall be guilty of computer trespass, which 13
	65	+	offense shall be punishable as a Class 3 misdemeanor. If there is damage to the property of 14
	66	+	another and the damage is valued at less than two thousand five hundred dollars ($2,500) caused 15
	67	+	by the person's act in violation of this section, the offense shall be punished as a Class 1 16
	68	+	misdemeanor. If there is damage to the property of another valued at two thousand five hundred 17
	69	+	dollars ($2,500) or more caused by the person's act in violation of this section, the offense shall 18
	70	+	be punished as a Class I felony. 19
	71	+	(c) Any person whose property or person is injured by reason of a violation of this section 20
	72	+	may sue for and recover any damages sustained and the costs of the suit pursuant to 21
	73	+	G.S. 1-539.2A. 22
	74	+	(d) It is not a violation of this section for a person to act pursuant to Chapter 36F of the 23
	75	+	General Statutes." 24
	76	+	SECTION 2. G.S. 1-539.2A reads as rewritten: 25
	77	+	"§ 1-539.2A. Damages for computer trespass. 26
	78	+	(a) Any person whose property or person is injured by reason of a violation of 27
	79	+	G.S. 14-458 may sue for and recover any damages sustained and the costs of the suit. Without 28
	80	+	limiting the general of the term, "damages" shall include loss of profits. If the injury arises from 29
	81	+	the transmission of unsolicited bulk commercial electronic mail, the injured person, other than 30
	82	+	an electronic mail service provider, may also recover attorneys' fees and may elect, in lieu of 31
	83	+	actual damages, to recover the lesser of ten dollars ($10.00) for each and every unsolicited bulk 32
	84	+	commercial electronic mail message transmitted in violation of this section, or twenty-five 33
	85	+	thousand dollars ($25,000) per day. The injured person shall not have a cause of action against 34
	86	+	the electronic mail service provider which merely transmits the unsolicited bulk commercial 35
	87	+	electronic mail over its computer network. If the injury arises from the transmission of unsolicited 36
	88	+	bulk commercial electronic mail, an injured electronic mail service provider may also recover 37
	89	+	attorneys' fees and costs and may elect, in lieu of actual damages, to recover the greater of ten 38
	90	+	dollars ($10.00) for each and every unsolicited bulk commercial electronic mail message 39
	91	+	transmitted in violation of this section, or twenty-five thousand dollars ($25,000) per day. 40
	92	+	(a1) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 41
	93	+	data that is protected health information, the injured person may sue and recover for each 42
	94	+	violation the greater of the damages sustained or five thousand dollars ($5,000) and the costs of 43
	95	+	the suit. 44
	96	+	(a2) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 45
	97	+	data that is in the personnel file of a local, State, or federal employee, the injured person may sue 46
	98	+	and recover for each violation the greater of the damages sustained or five thousand dollars 47
	99	+	($5,000) and the costs of the suit. 48
	100	+	(b) A civil action under this section shall be commenced before expiration of the time 49
	101	+	period prescribed in G.S. 1-54. In actions alleging injury arising from the transmission of 50 General Assembly Of North Carolina Session 2025
	102	+	DRH40322-ML-67 Page 3
101	103		unsolicited bulk commercial electronic mail, personal jurisdiction may be exercised pursuant to 1
102	104		G.S. 1-75.4. 2
103	105		(c) The following definitions apply in this section: 3
104	106		(1) Damages. – Includes loss of profits. 4
105	107		(2) Personnel file. – Any employment-related or personal information gathered 5
106	108		by an employer about its employee. Employment-related information includes 6
107	109		information related to an individual's application, selection, promotion, 7
108	110		demotion, transfer, leave, salary, contract for employment, benefits, 8
109	111		suspension, performance evaluation, disciplinary actions, and termination. 9
110	112		Personal information includes an individual's home address, social security 10
111	113		number, medical history, personal financial data, marital status, dependents, 11
112	114		and beneficiaries. 12
113	115		(3) Protected health information. – As defined in 45 C.F.R. § 160.103." 13
114	116		SECTION 3. This act becomes effective July 1, 2025, and applies to offenses 14
115	117		committed on or after that date. 15