Relating to affirmative defenses for entities using cybersecurity programs and electronic transactions recorded by blockchain technology

This bill relates to cybersecurity programs and blockchain technology. The bill changes the definitions of “electronic record” and “electronic signature” in the uniform electronic transactions Act to include blockchain technology. The bill creates affirmative defenses for entities using cybersecurity programs and provides definitions. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information or both personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must protect the security and confidentiality of the information, protect against any anticipated threats to the information, and protect against unauthorized access to and acquisition of the information that is likely to result in a material risk of identity theft. A cybersecurity program scale and scope should be based upon the size and complexity of the covered entity, the nature and scope of the covered entity’s activities, sensitivity of the information, and the cost and availability of tools and resources to improve information security. A covered entity that satisfies the above requirements is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill provides industry-recognized cybersecurity frameworks that the covered entity should follow and reasonably comply to in order to qualify for the affirmative defense. The bill does not provide a private right to action, including a class action.