OK
Oklahoma House Bill HB2657

Oklahoma 2023 Regular Session

Oklahoma House Bill HB2657 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11
22
33 Req. No. 6145 Page 1 1
44 2
55 3
66 4
77 5
88 6
99 7
1010 8
1111 9
1212 10
1313 11
1414 12
1515 13
1616 14
1717 15
1818 16
1919 17
2020 18
2121 19
2222 20
2323 21
2424 22
2525 23
2626 24
2727
2828 STATE OF OKLAHOMA
2929
3030 1st Session of the 59th Legislature (2023)
3131
3232 HOUSE BILL 2657 By: Steagall
3333
3434
3535
3636
3737
3838 AS INTRODUCED
3939
4040 An Act relating to information privacy; enacting the
4141 Oklahoma Privacy Act of 2023; declarin g public
4242 policy; defining terms; clarifying scope of act;
4343 prohibiting supporting agencies from disclosing or
4444 communicating certain confidential information;
4545 declaring a penalty; mandating that supporting
4646 agencies keep an accounting of th ird-party access to
4747 certain information; directing supporting agencies to
4848 establish rules related to records; directing
4949 supporting agencies to instruct employees and
5050 contractors; directing supporting agencies to
5151 establish safeguards; directing The Office of
5252 Management and Enterprise Services to provide report ;
5353 directing the Director of the Office of Management
5454 and Enterprise Services to provide certification to
5555 the Oklahoma Attorney General; creating civil
5656 remedies; clarifying standing; clarifying fees and
5757 court costs; creating criminal penalties; amending 21
5858 O.S. 2021, Sections 1952 and 1953, which relate to
5959 the Oklahoma Computer Crimes Act; adding terms;
6060 adding unlawful acts; providing for codification;
6161 providing an effective date; and declaring an
6262 emergency.
6363
6464
6565
6666
6767
6868 BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKL AHOMA:
6969 SECTION 1. NEW LAW A new section of law to be codified
7070 in the Oklahoma Statutes as Section 400 of Title 51, unless there is
7171 created a duplication in numbering, reads as follows:
7272
7373 Req. No. 6145 Page 2 1
7474 2
7575 3
7676 4
7777 5
7878 6
7979 7
8080 8
8181 9
8282 10
8383 11
8484 12
8585 13
8686 14
8787 15
8888 16
8989 17
9090 18
9191 19
9292 20
9393 21
9494 22
9595 23
9696 24
9797
9898 A. This section and Sections 2 through 10 of this act shall be
9999 known and may be cited as the "Oklahoma Privacy Act of 2023".
100100 B. All statutes hereinafter enacted and codified as p art of the
101101 Oklahoma Privacy Act of 2023 shall be considered and deemed part of
102102 the Oklahoma Privacy Act of 2023 .
103103 SECTION 2. NEW LAW A new section of law to be codified
104104 in the Oklahoma Statutes as Section 401 of Title 51, unless there is
105105 created a duplication i n numbering, reads as f ollows:
106106 It is the public policy of the State o f Oklahoma to protect and
107107 limit the use of personally identifiable information of its public
108108 employees when such personally identifiable informat ion is held by
109109 or accessible to other supporting state agencies.
110110 SECTION 3. NEW LAW A new section of la w to be codified
111111 in the Oklahoma Statutes as Section 402 of Title 51, unless there is
112112 created a duplication in numbering, reads as follows:
113113 The following terms contained in the Oklahoma Privacy Act of
114114 2023 shall be defined as follows :
115115 1. "Agency" means any constitutionally or statutorily created
116116 entity within the executive branch such as an authority, board,
117117 bureau, commission, committee, department, executive branch
118118 instrumentality, interstate commission, office, public body, or
119119 public trust designated to act on behalf of the state or through
120120 which the state is a beneficiary ;
121121
122122 Req. No. 6145 Page 3 1
123123 2
124124 3
125125 4
126126 5
127127 6
128128 7
129129 8
130130 9
131131 10
132132 11
133133 12
134134 13
135135 14
136136 15
137137 16
138138 17
139139 18
140140 19
141141 20
142142 21
143143 22
144144 23
145145 24
146146
147147 2. "Appointing authority " shall be defined in accordance with
148148 Section 840-1.3 of Title 74 of the Oklahoma Statutes;
149149 3. "Chief administrative officer " shall be defined in
150150 accordance with Section 102 of Title 61 of the Oklahoma Statutes;
151151 4. "Communication" means a process by which information is
152152 exchanged, transmitted, broadcast, conveyed, shared, or otherwise
153153 disclosed verbally or in written form either in person or through
154154 other physical or digital means;
155155 5. "Disclose" means to make known; to publish; to open or
156156 expose to view; to actively or passively allow access to or viewing
157157 by another person;
158158 6. "Maintain" means and includes accumulate, collect,
159159 disseminate, distribute, gather, ho ld, manage, store, or use; and
160160 7. "Record" means any item, collection, or grouping of
161161 information about a person that is maintained either physically or
162162 digitally by an agency, including, but not limited to, a person's
163163 education, financial transactions, medical history, and criminal or
164164 employment history, personnel records, and that contains a person's
165165 name, or identifying number, symbol, or other identifying particu lar
166166 assigned to the person, such as a finger print, voice print,
167167 physical or digital image or any other type of individual digital or
168168 biometric identifier s.
169169
170170 Req. No. 6145 Page 4 1
171171 2
172172 3
173173 4
174174 5
175175 6
176176 7
177177 8
178178 9
179179 10
180180 11
181181 12
182182 13
183183 14
184184 15
185185 16
186186 17
187187 18
188188 19
189189 20
190190 21
191191 22
192192 23
193193 24
194194
195195 SECTION 4. NEW LAW A new section of law to be codified
196196 in the Oklahoma Statutes as Section 403 of Title 51, unless there is
197197 created a duplication in numberi ng, reads as follows:
198198 This act shall apply to all agencies, as defined in paragraph 1
199199 of Section 3 of this act. This act shall not apply to judges,
200200 justices, the Council on Judicial Complaints or the Legislature.
201201 The Legislative and Judicial Branches shall guard and protect the
202202 personally identifiable information of their constituents and public
203203 employees in accordance with rules adopted pursuant to the authority
204204 granted to them respectively by the Oklahoma Constitution.
205205 SECTION 5. NEW LAW A new section of law to b e codified
206206 in the Oklahoma Statutes as Section 404 of Title 51, unless there is
207207 created a duplication in numbering, reads as follows:
208208 A. Any supporting agency, including the Office of Management
209209 and Enterprise Services, or a supporting contracting entity , which
210210 maintains, holds or possesses access to records of another agency
211211 supported by the supporting agency shall not disclose or communicate
212212 to any other person any record belonging to, created by or
213213 pertaining to the supported agency when the record is one that may
214214 be treated as confidential by the supported agency pursuant to
215215 Section 24A.7 of Title 51 of the Oklahoma Statutes unless written
216216 consent of the appointing authority or chief administrative officer
217217 of the supported agency to which the record belongs or to which the
218218 record pertains or was created is obtained prior to disclosure.
219219
220220 Req. No. 6145 Page 5 1
221221 2
222222 3
223223 4
224224 5
225225 6
226226 7
227227 8
228228 9
229229 10
230230 11
231231 12
232232 13
233233 14
234234 15
235235 16
236236 17
237237 18
238238 19
239239 20
240240 21
241241 22
242242 23
243243 24
244244
245245 B. Any person employed by or retained as a contract employee by
246246 a supporting agency who discloses or communicates any records
247247 belonging to or pertaining to or created by a supported agency when
248248 such a record is one that may be treated as confidential by the
249249 supported agency pursuant to Section 24A.7 of Title 51 of the
250250 Oklahoma Statutes shall be subject to civil liability and the
251251 criminal penalties as provided for in Sections 8 and 10 of this act.
252252 C. No person appointed pursuant to Section 10.3 of Title 74 of
253253 the Oklahoma Statutes, nor any other employee or appointee of the
254254 Office of Governor shall serve as or be considered an appointing
255255 authority, chief administrative offi cer, officer or employee of any
256256 agency whereby a board or commission exercises administrative or
257257 governing authority over the agency pursuant to state statute or the
258258 Oklahoma Constitution .
259259 SECTION 6. NEW LAW A new section of law t o be codified
260260 in the Oklahoma Statutes as Section 405 of Title 51, unless there is
261261 created a duplication in numbering, reads as follows:
262262 Accounting of third-party access. Any supporting agency,
263263 including the Office of Management and Enterprise Services , or a
264264 supporting contractin g entity, which has capability or capacity to
265265 access computers, digital or electronic files, servers, cloud
266266 storage, digital and physical records of any kind, state-issued
267267 phones or other electronic devi ces assigned to, under the control of
268268 or belonging to a supported agency shall maintain:
269269
270270 Req. No. 6145 Page 6 1
271271 2
272272 3
273273 4
274274 5
275275 6
276276 7
277277 8
278278 9
279279 10
280280 11
281281 12
282282 13
283283 14
284284 15
285285 16
286286 17
287287 18
288288 19
289289 20
290290 21
291291 22
292292 23
293293 24
294294
295295 1. An access log of all routine instances where access is
296296 voluntarily granted by the assigned user to a public employee
297297 employed by a supporting agency or to an employee of a supporting
298298 contracting entity:
299299 a. the access log shall include the date, time, and name
300300 of the public employee or employee of a contracting
301301 entity who initiated or executed the access, and
302302 b. the access log required in this paragraph shall be
303303 maintained for no less than two (2) years and shall be
304304 subject to public inspection upon request;
305305 2. An access log of all instances of where access was achieved
306306 by a public employee empl oyed by a supporting agency or by an
307307 employee of a supporting contracting entity but without the
308308 knowledge and consent of a user in a supported agency:
309309 a. the access log shall include the date, time, and name
310310 of the public employee or e mployee of a contrac ting
311311 entity who initiated or executed the access ,
312312 b. the access log required in this paragraph shall be
313313 maintained for no less than five (5) years and shall
314314 be subject to public inspection upon request , and
315315 c. violations of this subparagraph shall be subje ct to
316316 the same civil liability and criminal penalties
317317 provided for in Sections 8 and 10 of this act.
318318
319319 Req. No. 6145 Page 7 1
320320 2
321321 3
322322 4
323323 5
324324 6
325325 7
326326 8
327327 9
328328 10
329329 11
330330 12
331331 13
332332 14
333333 15
334334 16
335335 17
336336 18
337337 19
338338 20
339339 21
340340 22
341341 23
342342 24
343343
344344 SECTION 7. NEW LAW A new section of law to be codified
345345 in the Oklahoma Statutes as Section 406 of Title 51, unless there is
346346 created a duplication in numbering, reads as follows:
347347 A. Any supporting agency, including the Office of Management
348348 and Enterprise Services , or a supporting contracting entity, which
349349 maintains, holds or possesses access to records of another agency
350350 supported by the supporting agency shall:
351351 1. Establish rules of conduct for employees or contractors
352352 involved in the design, development, operation, or maintenance of
353353 any system of records, or in maintainin g any record, or in allowing
354354 access to any record belonging to or pertaining to another agency
355355 when the record is one that may be trea ted as confidential by the
356356 other agency pursuant to Section 24A.7 of Title 51 of the Oklahoma
357357 Statutes;
358358 2. Instruct each such employee or contractor with respect to
359359 such rules and the requirements of this act, including the penalties
360360 for noncompliance; and
361361 3. Establish appropriate administrative, technical, digital,
362362 and physical safeguards to ensure the security and confidentiality
363363 of such records and to protect a gainst any anticipated threats or
364364 hazards to their security or integrity which could result i n their
365365 unlawful disclosure or communication.
366366 B. The Office of Management and Enterprise Services shall
367367 provide a report to the Governor, the Attorney General, th e Speaker
368368
369369 Req. No. 6145 Page 8 1
370370 2
371371 3
372372 4
373373 5
374374 6
375375 7
376376 8
377377 9
378378 10
379379 11
380380 12
381381 13
382382 14
383383 15
384384 16
385385 17
386386 18
387387 19
388388 20
389389 21
390390 22
391391 23
392392 24
393393
394394 of the Oklahoma House and President Pro Tempore of the Oklahoma
395395 State Senate within thirty (30) days after the effective date of
396396 this act verifying the agency 's compliance with this act and
397397 describing in detail the steps which have been taken to ensure
398398 continuing and on-going compliance with the requirements of this
399399 act.
400400 C. The Director of the Office of Management and Enterprise
401401 Services shall:
402402 1. Within ten (10) days of the ef fective date of this act,
403403 certify to the Attorney General that all records belonging to,
404404 created by or pertaining to all other supported agencies where the
405405 records which are maintained, held or where the supporting agency
406406 possesses access to records are those that may be treated as
407407 confidential by the supported agency pursuant to Section 24A.7 of
408408 Title 51 of the Oklahoma Statutes:
409409 a. have been retrieved from any previous recipient or
410410 continuing access is now denied to any previous
411411 recipient who, under this act and Section 24A.7 of
412412 Title 51 of the Oklahoma Statutes , is not entitled to
413413 have or to retain access to the record or records in
414414 question,
415415 b. who the persons are who previously received records or
416416 access to records belonging to, created by or
417417 pertaining to a supported agency that falls under
418418
419419 Req. No. 6145 Page 9 1
420420 2
421421 3
422422 4
423423 5
424424 6
425425 7
426426 8
427427 9
428428 10
429429 11
430430 12
431431 13
432432 14
433433 15
434434 16
435435 17
436436 18
437437 19
438438 20
439439 21
440440 22
441441 23
442442 24
443443
444444 Section 24A.7 of Title 51 of the Oklahoma Statutes
445445 where prior written consent of the appointing
446446 authority or chief administrative officer of the
447447 supported agency would be required under this act, and
448448 c. which specific officers, public employees and contract
449449 employees of the Office of Management and Enterpris e
450450 Services, who have previously provided or have allowed
451451 access to records protected under Section 24A.7 of
452452 Title 51 of the Oklahoma Statutes where prior written
453453 consent of the appointing authority or chief
454454 administrative officer of the supported agency would
455455 be required under this act;
456456 2. The certification required pursuant to this subsection shall
457457 be submitted to the Attorney General under penalty of perjury .
458458 SECTION 8. NEW LAW A new section of law to be codified
459459 in the Oklahoma Statutes as Section 407 of Title 51, unless there is
460460 created a duplication in numbering, reads as follows:
461461 A. Civil remedies.
462462 1. In any action pursuant to this act, the court may award any
463463 or all of the following types of relief by requiring the State of
464464 Oklahoma to:
465465 a. comply with the provisions of the Oklahoma Privacy Act
466466 of 2023,
467467
468468 Req. No. 6145 Page 10 1
469469 2
470470 3
471471 4
472472 5
473473 6
474474 7
475475 8
476476 9
477477 10
478478 11
479479 12
480480 13
481481 14
482482 15
483483 16
484484 17
485485 18
486486 19
487487 20
488488 21
489489 22
490490 23
491491 24
492492
493493 b. compensate the complainant for damages suffered as a
494494 result of disclosure prohibited by the Oklahoma
495495 Privacy Act of 2023,
496496 c. pay the complainant an amount equal to the amo unt
497497 provided in subparagraph b of this paragraph as
498498 liquidated damages, if the court determines that the
499499 agency willfully failed to comply with the provisions
500500 of the Oklahoma Privacy Act of 2023,
501501 d. pay actual and compensatory damages, and
502502 e. pay punitive damages. Punitive damages awarded
503503 pursuant to this subparagraph shal l be determined in
504504 accordance with applicable state law ;
505505 B. Equity powers. The court shall use, if it deems
506506 appropriate, its full equity powers, including temporary or
507507 permanent injunctions, temporary restraining orders, and contempt
508508 orders, to vindicate fully the rights of persons under the Oklahoma
509509 Privacy Act of 2023.
510510 SECTION 9. NEW LAW A new section of l aw to be codified
511511 in the Oklahoma Statutes as Section 408 of Title 51, unless there is
512512 created a duplication in numbering, r eads as follows:
513513 A. Standing. An action pursuant to the Oklahoma Privacy Act of
514514 2023 may be initiated only by a person claiming privacy and
515515 confidentiality rights as provided under this act.
516516 B. Fees and court costs.
517517
518518 Req. No. 6145 Page 11 1
519519 2
520520 3
521521 4
522522 5
523523 6
524524 7
525525 8
526526 9
527527 10
528528 11
529529 12
530530 13
531531 14
532532 15
533533 16
534534 17
535535 18
536536 19
537537 20
538538 21
539539 22
540540 23
541541 24
542542
543543 1. No fees or court costs shall be c harged against or imposed
544544 upon any person claiming rights under the Oklahoma Privacy Act of
545545 2023.
546546 2. In any action or proceeding to e nforce a provision of the
547547 Oklahoma Privacy Act of 2023 , the court may award a prevailing
548548 complainant's reasonable attorney fees, expert witness fees, and
549549 other litigation expenses .
550550 3. An action to enforce any liability created under this act
551551 may be brought in the district court of the county in which the
552552 complainant resides, or has his or her principal place of business,
553553 or in which the agency records are situated or stored, either
554554 physically or digitally , without regard to the amount in
555555 controversy, within two (2) years from the date on which the cause
556556 of action arises, except that where a supporting agency has
557557 materially and willfully disclosed information required under this
558558 act to remain confidential and under this act is material to
559559 establishment of the l iability of the supporting agency to the
560560 individual under this act, the action may be brought at any time
561561 within two (2) years after discovery of the disclosure by the
562562 individual.
563563 SECTION 10. NEW LAW A new section of law to be codified
564564 in the Oklahoma Statutes as Section 411 of Title 51, unless there is
565565 created a duplication in numbering, reads as follows:
566566 A. Criminal penalties.
567567
568568 Req. No. 6145 Page 12 1
569569 2
570570 3
571571 4
572572 5
573573 6
574574 7
575575 8
576576 9
577577 10
578578 11
579579 12
580580 13
581581 14
582582 15
583583 16
584584 17
585585 18
586586 19
587587 20
588588 21
589589 22
590590 23
591591 24
592592
593593 1. Any officer, employee of a supporting agency, including
594594 employees or contract personnel of the Office of Management and
595595 Enterprise Services, any person appointed pursuant to Section 10.3
596596 of Title 74 of the Oklahoma Stat utes, or any other employee or
597597 appointee of the Office of Governor , who by virtue of his or her
598598 employment or official position, has gained possession of, or access
599599 to agency records or parts thereof whereby such records, at the
600600 choice of the appointing authority or chief administrative officer
601601 of an agency, may be treated as confidential pursuant to Section
602602 24A.7 of Title 51 of the Oklahoma Statutes, and the employee,
603603 contract employee or appointee without prior written consent of the
604604 appointing authority or chief administrative offi cer of the agency
605605 to which the record belongs, was created by or to which the record
606606 pertains, willfully discloses or communicates the record or parts
607607 thereof in any manner to any person or agency not entitled by law to
608608 receive it, shall be guilty of a mis demeanor and fined not more than
609609 Five Thousand Dollars ($5,000.00) for each instance where there are
610610 less than five (5) individual instances of disclosure or
611611 communication.
612612 2. Any officer, employee of a supporting agency, including
613613 employees or contract p ersonnel of the Office of Management and
614614 Enterprise Services, any person appointed pursuant to Sectio n 10.3
615615 of Title 74 of the Oklahoma Statutes, or any other employee or
616616 appointee of the Office of Governor, who by virtue of his or her
617617
618618 Req. No. 6145 Page 13 1
619619 2
620620 3
621621 4
622622 5
623623 6
624624 7
625625 8
626626 9
627627 10
628628 11
629629 12
630630 13
631631 14
632632 15
633633 16
634634 17
635635 18
636636 19
637637 20
638638 21
639639 22
640640 23
641641 24
642642
643643 employment or offici al position, has gained possession of, or access
644644 to agency records or parts thereof whereby such records, at the
645645 choice of the appointing authority or chief administrative officer
646646 of an agency, may be treated as confidential pur suant to Section
647647 24A.7 of Title 51 of the Oklahoma S tatutes, and the employee,
648648 contract employee or appointee without prior written consent of the
649649 appointing authority or chief administrative officer of the agency
650650 to which the record belongs, was created b y or to which the record
651651 pertains, willfully discloses or communicates the record or parts
652652 thereof in any manner to any person or agency not entitled by law to
653653 receive it, shall be gui lty of a felony and fined not more than Ten
654654 Thousand Dollars ($10,000.00) in each instance where there are more
655655 than five (5) individual instances of disclosure or communication .
656656 3. Any officer, employee of a supporting agency, including
657657 employees or contract personnel of the Office of Management and
658658 Enterprise Services, any person appointed pursuant to Section 10.3
659659 of Title 74 of the Oklahoma Statutes, or any other employee or
660660 appointee of the Office of Governor, who knowingly and willfully
661661 receives records which, at the choice of an agency, may be treated
662662 as confidential pursuant to Section 24A.7 of Title 51 of the
663663 Oklahoma Statutes and the employee, contract employee or appointee
664664 without prior written consent of the appointing authority or chief
665665 administrative officer of the agency to which the record belongs ,
666666 was created by or to which the record pertains, willfully receives
667667
668668 Req. No. 6145 Page 14 1
669669 2
670670 3
671671 4
672672 5
673673 6
674674 7
675675 8
676676 9
677677 10
678678 11
679679 12
680680 13
681681 14
682682 15
683683 16
684684 17
685685 18
686686 19
687687 20
688688 21
689689 22
690690 23
691691 24
692692
693693 the record or parts thereof in any manner, shall be guilty of a
694694 misdemeanor and fined not more than Five Thousand Dollars
695695 ($5,000.00) for each instance where he or she receives prohibited
696696 records in five (5) individual instances or less.
697697 4. Any officer, employee of a supporting agency, including
698698 employees or contract personnel of the Office of Management and
699699 Enterprise Services, any pe rson appointed pursuant to Section 10.3
700700 of Title 74 of the Oklahoma Statutes, or any other employe e or
701701 appointee of the Office of Governor, who knowingly and willfully
702702 receives records which, at the choice of another agency, may be
703703 treated as confidential pursuant to Section 24A.7 of Title 51 of the
704704 Oklahoma Statutes and the employee, contract employee or appointee
705705 without prior written consent of the appoin ting authority or chief
706706 administrative officer of the agency to which the record belongs,
707707 was created by or to which the record pertains, willfully receives
708708 the record or parts thereof in any manner, shall be guilty of a
709709 felony and fined not more than Ten Thousand Dollars ($10,000.00) for
710710 each instance where he or she receives prohibited records in more
711711 than five (5) individual instances.
712712 B. Government contractors. Any contracting entity engaged by
713713 an agency, including the Office of Management and Enterprise
714714 Services, which maintains records on behalf of another agency shall
715715 not disclose or communicate to any other person any record belonging
716716 to, created by or pertaining to the another agency when the record
717717
718718 Req. No. 6145 Page 15 1
719719 2
720720 3
721721 4
722722 5
723723 6
724724 7
725725 8
726726 9
727727 10
728728 11
729729 12
730730 13
731731 14
732732 15
733733 16
734734 17
735735 18
736736 19
737737 20
738738 21
739739 22
740740 23
741741 24
742742
743743 is one that may be treated as confidential by the other agen cy
744744 pursuant to Section 24A.7 of Title 51 of the Oklahoma Statutes
745745 unless written consent of the appointing authority or chief
746746 administrative officer of the other agency to which the record
747747 belongs, was created by or to which the record pertains is obtained
748748 prior to the disclosure. Upon violation of the requirements of this
749749 act, contracting entities and their employees shall be subject to
750750 civil liability and the criminal penalties as provided for in this
751751 section of this act in the same manner as state agencies and their
752752 employees.
753753 SECTION 11. AMENDATORY 21 O.S. 2021, Section 1952, is
754754 amended to read as follows:
755755 As used in the Oklahoma Com puter Crimes Act:
756756 1. "Access" means to approach, gain entry to, instruct,
757757 communicate with, store data in, retrieve data from or otherwise use
758758 the logical, arithmetical, memory or other resources of a computer,
759759 computer system or computer network;
760760 2. "Agency" shall be construed in the Oklahoma Computer Crimes
761761 Act in accordance with Section 2 of the Oklahoma Privacy Act of
762762 2023;
763763 3. "Appointing authority" shall be construed in the Oklahoma
764764 Computer Crimes Act in accordance with Section 840-1.3 of Title 74
765765 of the Oklahoma Statutes;
766766
767767 Req. No. 6145 Page 16 1
768768 2
769769 3
770770 4
771771 5
772772 6
773773 7
774774 8
775775 9
776776 10
777777 11
778778 12
779779 13
780780 14
781781 15
782782 16
783783 17
784784 18
785785 19
786786 20
787787 21
788788 22
789789 23
790790 24
791791
792792 4. The term "chief administrative officer " shall be construed
793793 in the Oklahoma Computer Crimes Act in accordance with Section 102
794794 of Title 61 of the Oklahoma Statute s;
795795 2. 5. "Computer" means an electronic device which performs wo rk
796796 using programmed instruct ion having one or more of the capabilities
797797 of storage, logic, arithmetic or communication. The term includes
798798 input, output, processing, stor age, software and comm unication
799799 facilities which are connected or related to a device i n a system or
800800 network;
801801 3. 6. "Computer network" means the wired or wireless physical
802802 or logical interconnection of one or more computers or computer
803803 systems to each other, or to other comput er networks, for the
804804 purpose of transmitting or receiving compute r programs, computer
805805 software or data;
806806 4. 7. "Computer program" means a set or series of instructions
807807 or statements and related data which when executed in actual or
808808 modified form directs or is intended to direct the functioning of a
809809 computer system in a manner designed to perform certain operations;
810810 5. 8. "Computer software" means one or more computer programs,
811811 procedures and associated documentation used in the operat ion of a
812812 computer system;
813813 6. 9. "Computer system" means a set of related, connected or
814814 unconnected, computer equipment, devices including support devices,
815815 one or more of which contain computer programs, electronic
816816
817817 Req. No. 6145 Page 17 1
818818 2
819819 3
820820 4
821821 5
822822 6
823823 7
824824 8
825825 9
826826 10
827827 11
828828 12
829829 13
830830 14
831831 15
832832 16
833833 17
834834 18
835835 19
836836 20
837837 21
838838 22
839839 23
840840 24
841841
842842 instructions, input data, and output data , that performs functi ons
843843 including, but not limited to, logic, arithmetic, data storag e and
844844 retrieval, communication, and control and software. The term does
845845 not include calculators which are not programmable and are not
846846 capable of being connected to or used to access other c omputers,
847847 computer networks, computer systems or support devices;
848848 7. 10. "Data" means a representation of information, knowledge,
849849 facts, concepts, computer software, computer programs or
850850 instructions. Data may be in any form, in sto rage media, or as
851851 stored in the memory of the computer or in transit or presented on a
852852 display device;
853853 8. 11. "Malicious computer program " means any computer program
854854 that is created, executed, modified or distributed with the intent
855855 to disrupt, destroy, d eny access to, redirec t, defraud, deceive,
856856 exceed or gain unauthorized access to any co mputer, computer system ,
857857 computer network or data. Malicious computer program includes, but
858858 is not limited to, viruses, Trojan horses, spyware, worms, rootkits,
859859 backdoors, ransomware and oth er malicious computer instructions,
860860 whether part of or independen t of broader computer s oftware or
861861 computer systems;
862862 9. 12. "Property" means any tangible or intangible item of
863863 value and includes, but is not limited to, financial inst ruments,
864864 geophysical data or the interpretation o f that data, information,
865865 computer software, computer programs, e lectronically produced data
866866
867867 Req. No. 6145 Page 18 1
868868 2
869869 3
870870 4
871871 5
872872 6
873873 7
874874 8
875875 9
876876 10
877877 11
878878 12
879879 13
880880 14
881881 15
882882 16
883883 17
884884 18
885885 19
886886 20
887887 21
888888 22
889889 23
890890 24
891891
892892 and computer-produced or stored data, supporting documentation,
893893 computer software in either machine or human reada ble form,
894894 electronic impulses, confidential, copy righted or proprietary
895895 information, private identification codes or numbers which permit
896896 access to a computer by authorized computer users or generate
897897 billings to consumers for purchase of goods and services including,
898898 but not limited to, credit card trans actions and telecommunications
899899 services or permit electronic fund transfers and any other tangible
900900 or intangible item of value;
901901 10. 13. "Services" includes, but is not limited to, computer
902902 time, data processing and storage funct ions and other uses of a
903903 computer, computer system or computer ne twork to perform useful
904904 work;
905905 11. 14. "Supporting documentation " includes, but is not limited
906906 to, all documentation in any form used in the construction, design,
907907 classification, implementati on, use or modification of computer
908908 software, computer programs o r data; and
909909 12. 15. "Victim expenditure" means any expenditure reasonably
910910 and necessarily incurred by the owner or lessee to verify that a
911911 computer system, computer net work, computer program or data was or
912912 was not altered, delete d, disrupted, damaged or d estroyed by the
913913 access.
914914 SECTION 12. AMENDATORY 21 O.S. 2021, Section 1953, is
915915 amended to read as follows:
916916
917917 Req. No. 6145 Page 19 1
918918 2
919919 3
920920 4
921921 5
922922 6
923923 7
924924 8
925925 9
926926 10
927927 11
928928 12
929929 13
930930 14
931931 15
932932 16
933933 17
934934 18
935935 19
936936 20
937937 21
938938 22
939939 23
940940 24
941941
942942 A. It shall be unlawful to:
943943 1. Willfully, and without auth orization, gain or attempt to
944944 gain access to and damage , modify, alter, delete, destroy, copy ,
945945 make use of, use maliciou s computer programs on, disclose or take
946946 possession of a computer, computer system, computer network, data or
947947 any other property;
948948 2. Use a computer, computer system, computer network or any
949949 other property as hereinbefore defined for the purpose of devisin g
950950 or executing a scheme or artifice with the intent to defraud,
951951 deceive, extort or for the purpose of controlling or obtaining
952952 money, property, data, services or other thing of value by means of
953953 a false or fraudulent pretense or representation;
954954 3. Willfully exceed the limits of authorization and damage,
955955 modify, alter, destroy, copy, delete, disclose or take possessio n of
956956 a computer, computer system, computer network, data or any other
957957 property;
958958 4. Willfully and without authoriza tion, gain or attempt to ga in
959959 access to a computer, computer system, computer network, data or any
960960 other property;
961961 5. Willfully and without authorization use or c ause to be used
962962 computer services;
963963 6. Willfully and without auth orization disrupt or cause t he
964964 disruption of computer s ervices or deny or cause the denial of
965965 access or other computer services to an authorize d user of a
966966
967967 Req. No. 6145 Page 20 1
968968 2
969969 3
970970 4
971971 5
972972 6
973973 7
974974 8
975975 9
976976 10
977977 11
978978 12
979979 13
980980 14
981981 15
982982 16
983983 17
984984 18
985985 19
986986 20
987987 21
988988 22
989989 23
990990 24
991991
992992 computer, computer system or compute r network, other than an
993993 authorized entity acting for a legitimat e business purpose with the
994994 effective consent of the ow ner;
995995 7. Willfully and without authorization provide or assist in
996996 providing a means of a ccessing a computer, compu ter system, data or
997997 computer network in violation of this section;
998998 8. Willfully use a computer, computer system, o r computer
999999 network to annoy, abuse, threaten, or harass another person;
10001000 9. Willfully use a computer, computer syst em, or computer
10011001 network to put another person in fear of physical harm or death; and
10021002 10. Willfully solicit anoth er, regardless of any financ ial
10031003 consideration or exchan ge of property, of any acts described in
10041004 paragraphs 1 through 9 and 11 through 13 of this subsection;
10051005 11. Willfully and without prior written authorization of the
10061006 appointing authority or chief administrative officer of a supported
10071007 agency, for employees or contract personnel of a supporting agency,
10081008 including the Office of Management and Enterprise Systems, to gain
10091009 or attempt to gain access to, transfer access to, allow other
10101010 unauthorized persons to view or gain access to, view, remove,
10111011 transfer, share, or alter electronically stored files or data
10121012 belonging to, created by or pertaining to a supported agency,
10131013 regardless of where virtually or physically the files or data are
10141014 stored, in accordance with subse ction F of this section;
10151015
10161016 Req. No. 6145 Page 21 1
10171017 2
10181018 3
10191019 4
10201020 5
10211021 6
10221022 7
10231023 8
10241024 9
10251025 10
10261026 11
10271027 12
10281028 13
10291029 14
10301030 15
10311031 16
10321032 17
10331033 18
10341034 19
10351035 20
10361036 21
10371037 22
10381038 23
10391039 24
10401040
10411041 12. Willfully use, endeavor t o use or procure any other person
10421042 to use or endeavor to use any state-owned or leased or state-issued
10431043 computer, electronic network, server, networked or cellular phone,
10441044 or other electronic device to intercept or record any oral
10451045 communication by persons, including state employees, who have not
10461046 previously consented in writing to have their oral communications
10471047 recorded; and
10481048 13. Willfully use, endeavor to use or procure any other person
10491049 to use or endeavor to use any state-owned or leased or state-issued
10501050 computer, software, electronic network, cloud storage, server,
10511051 networked or cellular phone, or other electronic device to
10521052 intercept, record or view any documents created, stored,
10531053 communicated or distributed by a person on or through state-owned or
10541054 leased or state-issued computers, telephones, software, electronic
10551055 networks, cloud storage or servers , including electronic mail
10561056 servers where the appointing authority or chief administrative
10571057 officer of an agency has not previously consented i n writing to have
10581058 such communications intercepted, recorded or viewed .
10591059 B. Any person convicted of violating paragraph 1, 2, 3, 6, 7,
10601060 9, or 10, 11, 12 or 13 of subsection A of this section shall be
10611061 guilty of a felony punishable as provided in Section 1955 of this
10621062 title.
10631063 C. Any person convicted of violating paragraph 4, 5 or 8 of
10641064 subsection A of this section shall be guilty of a misdemeanor .
10651065
10661066 Req. No. 6145 Page 22 1
10671067 2
10681068 3
10691069 4
10701070 5
10711071 6
10721072 7
10731073 8
10741074 9
10751075 10
10761076 11
10771077 12
10781078 13
10791079 14
10801080 15
10811081 16
10821082 17
10831083 18
10841084 19
10851085 20
10861086 21
10871087 22
10881088 23
10891089 24
10901090
10911091 D. Nothing in the Oklah oma Computer Crimes Act shall be
10921092 construed to prohibit the monito ring of computer usage of, o r the
10931093 denial of computer or Internet access to, a child by a parent, legal
10941094 guardian, legal custodian, or foster parent. As used in this
10951095 subsection, "child" shall mean any person less than eighteen (18)
10961096 years of age.
10971097 E. Nothing in the Oklahoma Computer Cr imes Act shall be
10981098 construed to prohibit testing by an authorized entity, the purpose
10991099 of which is to provide to the owner or operator of t he computer,
11001100 computer system or computer network an evaluation of the security of
11011101 the computer, computer system or comp uter network against real or
11021102 imagined threats or harms. For purposes of this subsection, an
11031103 authorized entity shall not include the Offic e of Management and
11041104 Enterprise Services without the knowledge of and prior written
11051105 consent of the appointing authority or chief administrative o fficer
11061106 of a supported agency.
11071107 F. No supporting agency such as the Office of Management and
11081108 Enterprise Services nor any contracting entit y employed or engaged
11091109 by a supporting agency such as the Office o f Management and
11101110 Enterprise Services, shall be presumed to have authority to have or
11111111 to gain or attempt to gain access to , transfer access to, allow
11121112 other unauthorized p ersons to view or gain access to, view, remove,
11131113 transfer, share, or alter electronically stored files or data
11141114 belonging to, created by or pertaining to a supported agency,
11151115
11161116 Req. No. 6145 Page 23 1
11171117 2
11181118 3
11191119 4
11201120 5
11211121 6
11221122 7
11231123 8
11241124 9
11251125 10
11261126 11
11271127 12
11281128 13
11291129 14
11301130 15
11311131 16
11321132 17
11331133 18
11341134 19
11351135 20
11361136 21
11371137 22
11381138 23
11391139 24
11401140
11411141 regardless of where the files or dat a are stored, without the
11421142 knowledge of and prior written consent of th e appointing authority
11431143 or chief administrative officer of the supported agency. The
11441144 appointing authority or chief administrative officer of a supported
11451145 agency may agree to allow employees or contract personnel of a
11461146 supporting agency, including the Office of Management and Enterprise
11471147 Services, to request and obtain spec ific types of access to the
11481148 supported agency's computers, network and cellular phones, and
11491149 network files in the course of the supporting agency providing
11501150 direct support to the supported agenc y. No supporting agency,
11511151 including the Office of Management and Enterprise Services, shall
11521152 require a supported agency to forego the protections afforded to a
11531153 supported agency by the Oklahoma Computer Crimes Act as a condition
11541154 for entering into a support a greement with the supporting agency.
11551155 SECTION 13. This act shall become effect ive July 1, 2023.
11561156 SECTION 14. It being immediately necessary for the preservation
11571157 of the public peace, health or safety, an emergency is hereby
11581158 declared to exist, by reason whereof thi s act shall take effect an d
11591159 be in full force from and after its passage and approval.
11601160
11611161 59-1-6145 MJ 01/18/23