Security Breach Notification Act; requiring notice of security breach of certain information; modifying provisions. Effective date.

Updated definition of 'Breach of the security of a system' to specify unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises security or confidentiality.

Added new definition for 'Encrypted' to clarify data protection standards using algorithmic processes or other methods that render data unreadable or unusable.

Expanded definition of 'Personal information' to include unique biometric data such as fingerprints, retina or iris images, or other unique physical or digital representations used to authenticate individuals.

Updated notice requirements to include multiple delivery methods including written, telephone, electronic, and substitute notice under specific circumstances.

Established substitute notice requirements when notification costs exceed $50,000 or when affected residents exceed 100,000 persons.

Added clarification that unique biometric data used to authenticate a specific individual is included in the definition of personal information requiring breach notification.

Corrected grammatical error in the biometric data definition by adding 'to authenticate a specific individual' after the word 'data'.

Formatting corrections were made to remove page headers and footers that appeared in the engrossed version but were not part of the actual bill text.

Minor text cleanup removed redundant phrases like 'email email' and 'website website' that appeared in the engrossed version.

Removed references to subsections A, B, or C in multiple pages and replaced them with just A or B, simplifying the classification of data breach categories.

Deleted subsection G entirely from the definitions section, eliminating a previously defined category of information that no longer applies.

Added specific language defining 'unique biometric data' to include fingerprints, retina or iris images, and other physical or digital representations used for authentication.

Updated the definition of 'Notice' to include written, telephone, electronic, and substitute notice options with specific thresholds for when substitute notice may be used.

Clarified substitute notice requirements by specifying that it consists of any two of three methods: email notice, conspicuous internet posting, or notice to major statewide media.

Removed references to subsection C from multiple sections, changing the notice method options from 'A, B, or C' to just 'A or B', which likely reduces the number of acceptable notice methods available to entities.

Deleted subsection G entirely from the bill, which contained provisions that are no longer included in the amended version.

The document underwent formatting changes as it moved from introduced to engrossed status, with House and Senate amendments incorporated into the final version.