SB 626: Security Breach Notification Act; requiring notice of security breach of certain information; modifying provisions. Effective date. - Oklahoma

Floor (House) → Floor (Senate) · 3 edits

MINOR

The bill was transitioned from the House version to the Senate floor version, introducing specific formatting changes and committee amendments. The most significant substantive change is the addition of 'unique biometric data' (such as fingerprints or iris images) to the legal definition of 'personal information,' which expands the scope of data requiring security breach notifications. Additionally, the text includes a new clause requiring 'reasonable safeguards' to be considered based on an entity's size and the volume of data held.

Scope change

The scope of the bill was expanded to include biometric data as protected personal information, meaning security breaches involving fingerprints or facial recognition data now trigger notification requirements.

DEFINITION

Added 'unique biometric data' (fingerprints, retina, iris images) to the definition of personal information, expanding the types of data covered by the Security Breach Notification Act.

REQUIREMENT

Introduced a requirement for entities to implement 'reasonable safeguards' tailored to their size and the amount of personal information they hold.

TECHNICAL

Changed the document header from 'HOUSE OF REPRESENTATIVES' to 'SENATE FLOOR VERSION' and updated page numbering and formatting to reflect the Senate's version of the bill.

SB626 (3-24-25) (HOWARD) FA1.PDF → Floor (House) · 5 edits

MODERATE

The bill was amended to update the Security Breach Notification Act by modernizing definitions of 'personal information' and 'breach' to include biometric data and ensure clarity on encryption standards. It also refined the notice requirements to allow for substitute notices when contact information is insufficient or costs are prohibitive, and clarified exemptions for good-faith internal use of data.

Scope change

The scope of protected data was expanded to explicitly include unique biometric data (e.g., fingerprints, iris images) used for authentication, ensuring these sensitive identifiers are covered under breach notification laws.

DEFINITION

Updated the definition of 'personal information' to explicitly list unique biometric data such as fingerprints and iris images as protected data elements.

Refined the definition of 'breach' to clarify that good-faith acquisition of data by employees for lawful purposes does not constitute a breach, provided the data is not misused.

Clarified the definition of 'encrypted' to include both algorithmic transformation and other methods that render data unreadable or unusable.

REQUIREMENT

Expanded the definition of 'notice' to include substitute notice (e.g., email or internet posting) when direct contact is impossible or costs exceed $50,000 or affect over 100,000 people.

Updated the description of substitute notice to explicitly require two forms of notification, such as email notice and conspicuous internet posting.

Enrolled (final version) → SB626 (3-24-25) (HOWARD) FA1.PDF · 1 edit

MINOR

The document provided is a floor amendment record rather than a final legislative text, so no substantive policy changes to the Security Breach Notification Act were enacted. The only change is a procedural instruction to add a specific phrase to the definition of 'biometric data' to clarify that it must authenticate a specific individual, though this appears to be a formatting artifact in the amendment log.

TECHNICAL

A procedural note instructs adding the phrase 'to authenticate a specific individual' to the definition of biometric data, likely to clarify the definition's intent.

Engrossed → Enrolled (final version) · 2 edits · May 28, 2025

MINOR

The bill was finalized as an Enrolled version, confirming it is ready for the Governor's signature. The substantive text of the Security Breach Notification Act remains largely consistent, with the primary change being the removal of page break artifacts and the addition of a 'Subject' line to the title page for clarity.

TECHNICAL

Removed page numbering artifacts and formatting inconsistencies from the 'Engrossed' version to create a clean 'Enrolled' final text.

Added a 'Subject' line to the title page to explicitly state the bill's topic.

Amended And Engrossed → Engrossed · 3 edits · May 20, 2025

MINOR

The bill was amended to simplify the list of data categories requiring notification by removing a third option (C) and retaining only options A and B. Additionally, a specific definition for 'unique biometric data' was added to clarify what constitutes sensitive information. These changes narrow the scope of required disclosures and provide clearer guidance on what specific data types must be reported during a security breach.

Scope change

The scope of required notification was narrowed by removing a previously included category of data, and the definition of sensitive biometric data was expanded to include specific examples like fingerprints and iris images.

DEFINITION

Amendments 1, 2, 3, and 4 removed the third option ('C') from a list of subsections, changing the requirement from 'A, B, or C' to just 'A or B', likely simplifying compliance criteria.

A new definition for 'unique biometric data' was added, explicitly listing fingerprints, retina, and iris images as examples of data that must be protected and reported if breached.

A previously inserted subsection labeled 'G' was entirely deleted, removing a specific provision or definition that was part of the earlier draft.

Introduced → Amended And Engrossed · 3 edits · May 20, 2025

MINOR

The bill was amended to simplify the list of data categories that trigger a mandatory security breach notice. Specifically, the House removed the requirement to notify the Attorney General if the breach involves three specific types of sensitive data (subsections A, B, and C), narrowing the scope to only the first two types (A or B). This change reduces the administrative burden on entities by limiting the circumstances under which the Attorney General must be alerted.

Scope change

The scope of mandatory notification to the Attorney General was narrowed. Previously, a breach involving three categories of sensitive data required AG notification; now, it only applies if the first two categories are involved.

REQUIREMENT

Removed the requirement to notify the Attorney General when a breach involves the third category of sensitive data (unique electronic identifiers or biometric data), limiting the trigger to only the first two categories.

DEFINITION

Revised the definition of 'Personal Information' to remove the third category of data elements that would trigger a breach notification to the Attorney General.

TECHNICAL

Added House amendments to the text, including updated headers and amendment references to reflect the legislative process.

Security Breach Notification Act; requiring notice of security breach of certain information; modifying provisions. Effective date.

What changed between versions

How they voted

Actions timeline

Sponsors