Bill > S1066

This bill amends Idaho law to strengthen protections and requirements related to personally identifiable information (PII) breaches. The bill expands the definition of PII to include additional sensitive data like passport numbers, email addresses, medical histories, biometric data, and taxpayer identification numbers. It requires agencies, individuals, and commercial entities that experience a PII breach to conduct a prompt investigation and notify affected Idaho residents without unreasonable delay. Notably, the bill introduces a new requirement that when a breach occurs, the responsible entity must offer free credit monitoring services to affected residents for at least 12 months and provide guidance on how to enroll in these services and place a credit freeze. The bill also clarifies what constitutes a security breach, defines encryption, and establishes penalties for intentional failure to notify residents, with potential fines up to $25,000 per breach. The law will go into effect on July 1, 2025, and aims to provide stronger protections for Idaho residents' personal information in an increasingly digital world.

Business and Industry, Justice

Commerce and Human Resources Committee (S)

https://legislature.idaho.gov/sessioninfo/2025/legislation/S1066/