Bill > SB00117

This bill, effective October 1, 2026, updates regulations concerning breaches of security involving electronic personal information, which is defined as an individual's name or initial combined with sensitive data like Social Security numbers, financial account details, or medical information, but excludes publicly available information. Key provisions include requiring that any materials submitted to the Attorney General following a security breach be in a format the Attorney General specifies, and it introduces a new definition for a "massive breach of security," which occurs when the personal information of at least 100,000 state residents is compromised due to unauthorized access or use of a computer or network. In the event of a massive breach, the bill mandates that a third-party forensic examination and analysis be conducted and a detailed report prepared, outlining the cause and nature of the breach, and this report must be submitted to the Attorney General. Furthermore, the bill imposes an additional penalty of up to $250,000 for any person who fails to submit this required third-party forensic report to the Attorney General, with considerations for small businesses, micro businesses, and certain nonprofit employers when determining the penalty amount.