Oklahoma 2025 Regular Session

Oklahoma Senate Bill SB626 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1
2	2
3		-	SB626 HFLR Page 1
4		-	BOLD FACE denotes Committee Amendments. 1
	3	+	ENGR. S. B. NO. 626 Page 1 1
5	4		2
6	5		3
7	6		4
8	7		5
9	8		6
10	9		7
11	10		8
12	11		9
13	12		10
14	13		11
15	14		12
16	15		13
17	16		14
18	17		15
19	18		16
20	19		17
21	20		18
22	21		19
23	22		20
24	23		21
25	24		22
26	25		23
27	26		24
28		-
29		-	HOUSE OF REPRESENTATIVES - FLOOR VERSION
30		-
31		-	STATE OF OKLAHOMA
32		-
33		-	1st Session of the 60th Legislature (2025)
34	27
35	28		ENGROSSED SENATE
36	29		BILL NO. 626 By: Howard of the Senate
37	30
38	31		and
39	32
40	33		Pfeiffer of the House
41	34
42	35
43	36
44	37
45	38		An Act relating to the Security Breach Notification
46	39		Act; amending 24 O.S. 2021, Sections 162, 163, 164,
47	40		165, and 166, which relate to definitions, duty to
48	41		disclose breach, notice, enforcement, and
49	42		application; modifying definitions; requiring notice
50	43		of security breach of certain information; requiring
51	44		notice to Attorney General under certain
52	45		circumstances; specifying contents of required
53	46		notice; providing exemptions from certain notice
54	47		requirements; requiring confidentiality of certain
55	48		information submitted to Attorney General;
56	49		authorizing Attorney General to promulgate rules;
57	50		clarifying compliance with certain notice
58	51		requirements; modifying authorized civil penalties
59	52		for certain violations; providing exemptions from
60	53		certain liability; limiting liability for violations
61	54		under certain circumstances; modifying applicability
62	55		of act; updating statutory language; updating
63	56		statutory references; and providing an effective
64	57		date.
65	58
66	59
67	60
68	61
69	62		BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
70	63		SECTION 1. AMENDATORY 24 O.S. 2021, Section 162, is
71	64		amended to read as follows:
72	65		Section 162. As used in the Security Breach Notification Act:
	66	+	1. “Breach of the security of a system” means the unauthorized
	67	+	access and acquisition of unencrypted and unredacted computerized
	68	+	data that compromises the security or confidentiality of personal
73	69
74		-	SB626 HFLR Page 2
75		-	BOLD FACE denotes Committee Amendments. 1
	70	+	ENGR. S. B. NO. 626 Page 2 1
76	71		2
77	72		3
78	73		4
79	74		5
80	75		6
81	76		7
82	77		8
83	78		9
84	79		10
85	80		11
86	81		12
87	82		13
88	83		14
89	84		15
90	85		16
91	86		17
92	87		18
93	88		19
94	89		20
95	90		21
96	91		22
97	92		23
98	93		24
99	94
100		-	1. “Breach of the security of a system ” means the unauthorized
101		-	access and acquisition of unencrypted and unredacted computerized
102		-	data that compromises the security or confidenti ality of personal
103	95		information maintained by an individual or entity as part of a
104	96		database of personal inf ormation regarding multiple individuals and
105	97		that causes, or the individual or entity reasonably believes has
106	98		caused or will cause, identity theft or other fraud to any resident
107	99		of this state. Good faith acquisition of personal information by an
108	100		employee or agent of an individual or entity for the purposes of the
109	101		individual or the entity is not a breach of the security of the
110	102		system, provided that the personal information is not used for a
111	103		purpose other than a lawful purpose of the individual or entity or
112	104		subject to further unauthorized disclosure;
113	105		2. “Entity” includes corporations, business trusts, estates,
114	106		partnerships, limited partnerships, limited liability partnerships,
115	107		limited liability companies, associations, organizations, joint
116	108		ventures, governments, governmental subdivisions, agencies, or
117	109		instrumentalities, or any other legal entity, whether for profit or
118	110		not-for-profit;
119	111		3. “Encrypted” means transformation of data through the use of
120	112		an algorithmic process into a form in which there is a low
121	113		probability of assigning meaning without use of a confidential
122	114		process or key, or securing the information by another method that
123	115		renders the data elements unreadable or unusable;
	116	+	4. “Financial institution ” means any institution the business
	117	+	of which is engaging in financial activities as defined by 15
	118	+	U.S.C., Section 6809;
124	119
125		-	SB626 HFLR Page 3
126		-	BOLD FACE denotes Committee Amendments. 1
	120	+	ENGR. S. B. NO. 626 Page 3 1
127	121		2
128	122		3
129	123		4
130	124		5
131	125		6
132	126		7
133	127		8
134	128		9
135	129		10
136	130		11
137	131		12
138	132		13
139	133		14
140	134		15
141	135		16
142	136		17
143	137		18
144	138		19
145	139		20
146	140		21
147	141		22
148	142		23
149	143		24
150	144
151		-	4. “Financial institution ” means any institution the business
152		-	of which is engaging in financial activities as defined by 15
153		-	U.S.C., Section 6809;
154	145		5. “Individual” means a natural person;
155	146		6. “Personal information ” means the an individual’s first name
156	147		or first initial and last name in combination with and linked to any
157	148		one or more of the following data elements that relate to a resident
158	149		of this state, when the individual if any of the data elements are
159	150		neither not encrypted, nor redacted, or otherwise altered by any
160	151		method or technology in such a manner that the name or data elements
161	152		are unreadable or are encrypted, redacted, or otherwise altered by
162	153		any method or technology but the keys to unencrypt, unredact, or
163	154		otherwise read the data elements have been obtained through the
164	155		breach of security:
165	156		a. social security number,
166	157		b. driver license number or state other unique
167	158		identification card number issued in lieu of a driver
168	159		license, or created or collected by a government
169	160		entity,
170	161		c. financial account number, or credit card or debit card
171	162		number, in combination with any required expiration
172	163		date, security code, access code, or password that
173	164		would permit access to the an individual’s financial
174	165		accounts of a resident account,
	166	+	d. unique electronic identifier or routing code in
	167	+	combination with any required security code, access
175	168
176		-	SB626 HFLR Page 4
177		-	BOLD FACE denotes Committee Amendments. 1
	169	+	ENGR. S. B. NO. 626 Page 4 1
178	170		2
179	171		3
180	172		4
181	173		5
182	174		6
183	175		7
184	176		8
185	177		9
186	178		10
187	179		11
188	180		12
189	181		13
190	182		14
191	183		15
192	184		16
193	185		17
194	186		18
195	187		19
196	188		20
197	189		21
198	190		22
199	191		23
200	192		24
201	193
202		-	d. unique electronic identifier or routing code in
203		-	combination with any required security code, access
204	194		code, or password th at would permit access to an
205	195		individual’s financial account, or
206	196		e. unique biometric data such as a fingerprint, retina or
207	197		iris image, or other unique physical or digital
208	198		representation of biometric data to authenticate a
209	199		specific individual.
210	200		The term does not include information that is lawfully obtained from
211	201		publicly available information sources, or from federal, state or
212	202		local government records lawfully made available to the general
213	203		public;
214	204		7. “Notice” means:
215	205		a. written notice to the postal address in the records
216	206		of the individual or entity,
217	207		b. telephone notice,
218	208		c. electronic notice, or
219	209		d. substitute notice, if the individual or the entity
220	210		required to provide notice demonstrates that the cost
221	211		of providing notice will exceed Fifty Thousand Dollars
222	212		($50,000.00), or that the affected class of residents
223	213		to be notified exceeds one hundred thousand (100,000)
224	214		persons, or that the individual or the entity does not
225	215		have sufficient contact information or consent to
	216	+	provide notice as described in subparagraph a, b , or c
226	217
227		-	SB626 HFLR Page 5
228		-	BOLD FACE denotes Committee Amendments. 1
	218	+	ENGR. S. B. NO. 626 Page 5 1
229	219		2
230	220		3
231	221		4
232	222		5
233	223		6
234	224		7
235	225		8
236	226		9
237	227		10
238	228		11
239	229		12
240	230		13
241	231		14
242	232		15
243	233		16
244	234		17
245	235		18
246	236		19
247	237		20
248	238		21
249	239		22
250	240		23
251	241		24
252	242
253		-	provide notice as described in subparagraph a, b , or c
254	243		of this paragraph. Substitute notice consists of any
255	244		two of the following:
256	245		(1) e-mail email notice if the individual or the
257	246		entity has e-mail email addresses for the members
258	247		of the affected class of residents,
259	248		(2) conspicuous posting of the notice o n the Internet
260	249		web site website of the individual or the entity
261	250		if the individual or the entity maintains a
262	251		public Internet web site website, or
263	252		(3) notice to major statewide media; and
264	253		8. “Reasonable safeguards ” means policies and practices that
265	254		ensure personal information is secure, taking into consideration an
266	255		entity’s size and the type and amount of personal information. The
267	256		term includes, but is not limited to, conducting risk assessments,
268	257		implementing technical and physical layered defenses, employe e
269	258		training on handling personal information, and establishing an
270	259		incident response plan; and
271	260		9. “Redact” means alteration or truncation of data such that no
272	261		more than the following are accessible as part of the personal
273	262		information:
274	263		a. five digits of a social security number, or
	264	+	b. the last four digits of a driver license number, state
	265	+	unique identification card number created or collected
	266	+	by a government entity, or account number.
275	267
276		-	SB626 HFLR Page 6
277		-	BOLD FACE denotes Committee Amendments. 1
	268	+	ENGR. S. B. NO. 626 Page 6 1
278	269		2
279	270		3
280	271		4
281	272		5
282	273		6
283	274		7
284	275		8
285	276		9
286	277		10
287	278		11
288	279		12
289	280		13
290	281		14
291	282		15
292	283		16
293	284		17
294	285		18
295	286		19
296	287		20
297	288		21
298	289		22
299	290		23
300	291		24
301	292
302		-	b. the last four digits of a driver license number, state
303		-	unique identification card number created or collected
304		-	by a government entity, or account number.
305	293		SECTION 2. AMENDATORY 24 O.S. 2021, Section 163, is
306	294		amended to read as follows:
307	295		Section 163. A. An individual or entity that owns or licenses
308	296		computerized data that includes personal information shall disclose
309	297		provide notice of any breach of the security of the system following
310	298		discovery determination or notification of the breach of the
311	299		security of the system to any resident of this state whose
312	300		unencrypted and unredacted personal information was or is reasonably
313	301		believed to have been accessed and acquired by an unauthorized
314	302		person and that causes, or t he individual or entity reasonably
315	303		believes has caused or will cause, identity theft or other fraud to
316	304		any resident of this state. Except as provided in subsection D of
317	305		this section or in order to take any measures necessary to determine
318	306		the scope of the breach and to restore the reasonable integrity of
319	307		the system, the disclosure shall be made without unreasonable delay.
320	308		B. An individual or entity must disclose shall provide notice
321	309		of the breach of the security of the system if encrypted or redacted
322	310		information is accessed and acquired in an unencrypted or unredacted
323	311		form or if the security breach involves a person with access to the
324	312		encryption key and the individual or entity reasonably believes that
	313	+	such breach has caused or will cause identity theft or other fraud
	314	+	to any resident of this state.
	315	+	C. An individual or entity that maintains computerized data
	316	+	that includes personal information that the individual or entity
325	317
326		-	SB626 HFLR Page 7
327		-	BOLD FACE denotes Committee Amendments. 1
	318	+	ENGR. S. B. NO. 626 Page 7 1
328	319		2
329	320		3
330	321		4
331	322		5
332	323		6
333	324		7
334	325		8
335	326		9
336	327		10
337	328		11
338	329		12
339	330		13
340	331		14
341	332		15
342	333		16
343	334		17
344	335		18
345	336		19
346	337		20
347	338		21
348	339		22
349	340		23
350	341		24
351	342
352		-	such breach has caused or will cause identity theft or other fraud
353		-	to any resident of this state.
354		-	C. An individual or entity that maintains computerized data
355		-	that includes personal information that the ind ividual or entity
356	343		does not own or license shall notify provide notice to the owner or
357	344		licensee of the information of any breach of the security of the
358	345		system as soon as practicable following discovery determination, if
359	346		the personal information was or if the entity reasonably believes it
360	347		was accessed and acquired by an unauthorized person.
361	348		D. Notice required by this section may be delayed if a law
362	349		enforcement agency determines and advises the individual or entity
363	350		that the notice will impede a criminal or civil investigation or
364	351		homeland or national security. Notice required by this section must
365	352		be made without unreasonable delay after the law enforcement agency
366	353		determines that notification will no longer impede the investigation
367	354		or jeopardize national or homeland security.
368	355		E. 1. An individual or entity required to provide notice in
369	356		accordance with subsection A, B, or C of this section shall also
370	357		provide notice to the Attorney General of such breach without
371	358		unreasonable delay but in no event more than sixty (60) days after
372	359		providing notice to impacted residents of this state as required by
373	360		this section. The no tice shall include the date of the breach, the
374	361		date of its determination, the nature of the breach, the type of
375	362		personal information exposed, the number of residents of this state
	363	+	affected, the estimated monetary impact of the breach to the extent
	364	+	such impact can be determined, and any reasonable safeguards the
	365	+	entity employs.
376	366
377		-	SB626 HFLR Page 8
378		-	BOLD FACE denotes Committee Amendments. 1
	367	+	ENGR. S. B. NO. 626 Page 8 1
379	368		2
380	369		3
381	370		4
382	371		5
383	372		6
384	373		7
385	374		8
386	375		9
387	376		10
388	377		11
389	378		12
390	379		13
391	380		14
392	381		15
393	382		16
394	383		17
395	384		18
396	385		19
397	386		20
398	387		21
399	388		22
400	389		23
401	390		24
402	391
403		-	affected, the estimated monetary impact of the breach to the extent
404		-	such impact can be determined, and any reasonable safeguards the
405		-	entity employs.
406	392		2. A breach of a security system where fewer than five hundred
407	393		(500) residents of this state are affected within a single breach
408	394		shall be exempt from the notice requirements of parag raph 1 of this
409	395		subsection.
410	396		3. A breach of a security system maintained by a credit bureau
411	397		where fewer than one thousand (1,000) residents of this state are
412	398		affected within a single breach shall be exempt from the notice
413	399		requirements of paragraph 1 of this subsection.
414	400		F. Any personal information submitted to the Attorney General
415	401		shall be kept confidential pursuant to Section 24A.12 of Title 51 of
416	402		the Oklahoma Statutes.
417	403		G. The Attorney General may promulgate rules as necessary to
418	404		effectuate the provisions of this section.
419	405		SECTION 3. AMENDATORY 24 O.S. 2021, Section 164, is
420	406		amended to read as follows:
421	407		Section 164. A. An individual or entity that maintains its own
422	408		notification procedures as part of an information privacy or
423	409		security policy for the treatment of personal information and that
424	410		are consistent with the timing requirements of this act the Security
425	411		Breach Notification Act shall be deemed to be in compliance with the
426	412		notification requirements of this act subsection A, B, or C of
	413	+	Section 163 of this title if it the individual or entity notifies
	414	+	residents of this state in accordance with its procedures in the
	415	+	event of a breach of security of the system.
427	416
428		-	SB626 HFLR Page 9
429		-	BOLD FACE denotes Committee Amendments. 1
	417	+	ENGR. S. B. NO. 626 Page 9 1
430	418		2
431	419		3
432	420		4
433	421		5
434	422		6
435	423		7
436	424		8
437	425		9
438	426		10
439	427		11
440	428		12
441	429		13
442	430		14
443	431		15
444	432		16
445	433		17
446	434		18
447	435		19
448	436		20
449	437		21
450	438		22
451	439		23
452	440		24
453	441
454		-	Section 163 of this title if it the individual or entity notifies
455		-	residents of this state in accordance with its procedures in the
456		-	event of a breach of security of the system.
457	442		B. The following entities shall be deemed to be in compliance
458	443		with the notification requirements of subsection A, B, or C of
459	444		Section 163 of this title if such entities provide notice to the
460	445		Attorney General as required by subsection E of Section 163 of this
461	446		title:
462	447		1. A financial institution that complies with the notification
463	448		requirements prescribed by the Federal Gramm-Leach-Bliley Act and
464	449		the federal Interagency Guidance on Response Programs for
465	450		Unauthorized Access to Customer Information and Customer Notice is
466	451		deemed to be in compliance with the provisions of this act. ;
467	452		2. An entity that complies with the notification requirements
468	453		prescribed by the Oklahoma Hospital Cybersecurity Protection Act of
469	454		2023 or the Health Insurance Portability and Accountability Act of
470	455		1996 (HIPAA); and
471	456		3. An entity that complies with the notifica tion requirements
472	457		or procedures pursuant to the rules, regulation regulations,
473	458		procedures, or guidelines established by the primary or functional
474	459		federal regulator of the entity shall be deemed to be in compliance
475	460		with the provisions of this act .
476	461		SECTION 4. AMENDATORY 24 O.S. 2021, Section 165, is
477	462		amended to read as follows:
	463	+	Section 165. A. A violation of this act the Security Breach
	464	+	Notification Act that results in injury or loss to residents of this
	465	+	state may be enforced by the Attorney General or a district attorney
478	466
479		-	SB626 HFLR Page 10
480		-	BOLD FACE denotes Committee Amendments. 1
	467	+	ENGR. S. B. NO. 626 Page 10 1
481	468		2
482	469		3
483	470		4
484	471		5
485	472		6
486	473		7
487	474		8
488	475		9
489	476		10
490	477		11
491	478		12
492	479		13
493	480		14
494	481		15
495	482		16
496	483		17
497	484		18
498	485		19
499	486		20
500	487		21
501	488		22
502	489		23
503	490		24
504	491
505		-	Section 165. A. A violation of this act the Security Breach
506		-	Notification Act that results in injury or loss to residents of this
507		-	state may be enforced by the Attorney General or a district attorney
508	492		in the same manner as an unlawful practice under the Oklahoma
509	493		Consumer Protection Act.
510	494		B. Except as provided in subsection C D of this section, the
511	495		Attorney General or a district attorney shall have exclusive
512	496		authority to bring an action and may obtain either actual damages
513	497		for a violation of this act or the Security Breach Notification Act
514	498		and a civil penalty not to exceed One Hundred Fifty Thousand Dollars
515	499		($150,000.00) per breach of the security of the system or series of
516	500		breaches of a similar nature that are discovered determined in a
517	501		single investigation . Civil penalties shall be based upon the
518	502		magnitude of the breach, the extent to which the behavior of the
519	503		individual or entity contributed to the breach, and a ny failure to
520	504		provide the notice required by Section 163 of this title .
521	505		C. 1. An individual or entity that uses reasonable safeguards
522	506		and provides notice as required by Section 163 or 164 of this title
523	507		shall not be subject to civil penalties and may use such compliance
524	508		as an affirmative defense in a civil action filed under the Security
525	509		Breach Notification Act.
526	510		2. An individual or entity that fails to use reasonable
527	511		safeguards but provides notice as required by Section 163 or 164 of
528	512		this title shall not be subject to the civil penalty set forth in
	513	+	subsection B of this section but shall be subject to actual damages
	514	+	and a civil penalty of Seventy-five Thousand Dollars ($75,000.00) .
529	515
530		-	SB626 HFLR Page 11
531		-	BOLD FACE denotes Committee Amendments. 1
	516	+	ENGR. S. B. NO. 626 Page 11 1
532	517		2
533	518		3
534	519		4
535	520		5
536	521		6
537	522		7
538	523		8
539	524		9
540	525		10
541	526		11
542	527		12
543	528		13
544	529		14
545	530		15
546	531		16
547	532		17
548	533		18
549	534		19
550	535		20
551	536		21
552	537		22
553	538		23
554	539		24
555	540
556		-	subsection B of this section but shall be subject to actual damages
557		-	and a civil penalty of Seventy-five Thousand Dollars ($75,000.00) .
558	541		C. D. A violation of this act the Security Breach Notification
559	542		Act by a state-chartered or state-licensed financial institution
560	543		shall be enforceable exclusively by the primary state regulator of
561	544		the financial institution.
562	545		SECTION 5. AMENDATORY 24 O.S. 2021, Section 166, is
563	546		amended to read as follows:
564	547		Section 166. This act The Security Breach Notification Act
565	548		shall apply to the discovery determination or notification of a
566	549		breach of the security of the system that occurs on or after
567	550		November 1, 2008 January 1, 2026.
568	551		SECTION 6. This act shall become effective January 1, 2026.
	552	+	Passed the Senate the 27th day of March, 2025.
569	553
570		-	COMMITTEE REPORT BY: COMMITTEE ON APPROPRIATIONS AND BUDGET , dated
571		-	04/17/2025 – DO PASS.
	554	+
	555	+
	556	+	Presiding Officer of the Senate
	557	+
	558	+
	559	+	Passed the House of Representatives the ____ day of __________,
	560	+	2025.
	561	+
	562	+
	563	+
	564	+	Presiding Officer of the House
	565	+	of Representatives
	566	+