SSB 1071

The bill provides that such notice to affected consumers must occur no later than 45 days after the discovery or notification of the breach of security, unless delayed for law enforcement reasons.2 by providing notification to the consumer whose personal information was subject to the security breach, in electronic or other form, that directs the consumer to take certain steps to protect the consumer’s online account with that person or business and all other online accounts for which the same account information is used. However, in providing notification of a security breach in electronic form to an online account that is affected or compromised by the security breach, a person or business may only do so when the consumer is connected to the online account from an internet protocol address or online location from which the person or business knows the customer customarily accesses the account, and the notification is provided in a clear and conspicuous manner. Current law provides that a person who owns or licenses personal information that is subject to breach of security does not need to provide notification of the security breach to affected consumers if the person makes a written determination that there is no reasonable likelihood of financial harm to affected consumers. The bill requires a person who makes such a determination to provide this written determination to the director of the consumer protection division of the office of the attorney general within five business days after documenting the determination.2, to give written notice of the breach of security to the director of the consumer protection division of the office of the attorney general.2, or certain federal law. The bill also specifies that written notification to the attorney general must include a sample copy of any notification sent to consumers, the approximate number of affected or potentially affected consumers, a description of any services offered to affected consumers, and contact information for an individual who may be contacted for additional information regarding the breach of security. The bill provides that any employer or payroll service provider that owns or licenses computerized data relating to income tax withholdings shall notify the consumer protection division without unreasonable delay after discovery or notification of the breach of security of a taxpayer identification number in combination with the income tax withholdings for that taxpayer, the security breach of which gives the employer or payroll service provider reason to believe that identify theft or other fraud has or will occur. With respect to an employer, such notification requirements only apply to information regarding the employer’s employees. In providing notification to the consumer protection division, the employer or payroll service provider shall provide the name and federal employer identification number of the person affected. Upon receiving the notice, the consumer protection division shall notify the department of revenue of the security breach. _____ requirements apply to a security breach of this nature.