SB 1551

Abstract

Requires person that owns, licenses , has control over or has access to] or otherwise possesses personal information and] that was subject to breach of security or that received notice of breach of security from another person that maintains or otherwise possesses personal information on person's behalf, to notify consumer to whom personal information pertains and, if number of consumers to whom person must send notice exceeds 250, to Attorney General. Requires person that maintains or otherwise possesses personal information on behalf of another person to notify other person of breach of security. Requires person to give notice in most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notice of breach of security. Requires person, in providing notice, to undertake reasonable measures necessary to determine sufficient contact information for notice recipients, to determine scope of breach of security and to restore reasonable integrity, security and confidentiality of personal information. Provides that if person must notify consumer of breach of security and with notice person offers credit monitoring services or identity theft prevention and mitigation services without charge to consumer, person may not condition provision of services on consumer's providing person with credit card or debit card number or consumer's acceptance of any other service person offers for fee. Requires person to separately, distinctly, clearly and conspicuously disclose to consumer in any offer for additional credit monitoring services or identity theft prevention and mitigation services that person offers for fee that person will charge consumer fee. Prohibits consumer reporting agency from charging consumer fee or collecting from consumer money or item of value for placing, temporarily lifting or removing security freeze on consumer's consumer report, creating or deleting protective record, placing or removing security freeze on protective record or replacing lost personal identification number or password. Modifies standards for safeguarding personal information. Takes effect on 91st day following adjournment sine die.