HB750 Alabama 2012 Session

Summary

Primary Sponsor

Duwayne Bridges

Republican

Session

Regular Session 2012

Title

Consumer and Consumer Protection, data collectors notify upon breach of security regarding personal information required, deceptive trade practices

Summary

HB750 would require data collectors to notify Alabama residents and consumer reporting agencies when personal information is breached, with defined notice methods and penalties.

What This Bill Does

If enacted, the bill would require data collectors to notify residents when unencrypted personal information is breached. It defines who counts as a data collector or information broker and what counts as personal information, and it sets allowed forms of notice (written, telephone, or electronic) plus substitute notice when costs are high or contact data is missing. It also requires notification to nationwide consumer reporting agencies if more than 10,000 residents are affected at once. Violations would be treated as deceptive trade practices under Alabama law, and the law would take effect on the first day of the third month after passage and governor's approval.

Who It Affects

• Alabama residents whose unencrypted personal information is breached would be notified by data collectors and information brokers.
• Data collectors and information brokers that maintain computerized personal data (including certain government entities and private data handlers) would be required to provide breach notices and follow specified timing and methods.

Key Provisions

• Defines breach of the security system as unauthorized acquisition of an individual's electronic data that compromises the personal information; good faith internal use by an employee or agent is not a breach if not used for further unauthorized disclosure.
• Defines data collector as state or local government agencies or subdivisions, with exclusions for agencies whose records are kept primarily for traffic safety, law enforcement, licensing, or public access to court/real property records.
• Defines information broker as a person or entity that collects and furnishes personal information to nonaffiliated third parties for a fee.
• Personal information includes a person’s name plus data such as SSN, driver’s license/state ID number, account or card numbers, passwords, or other data that could be used for identity theft; publicly available government records are excluded.
• Requires notice to Alabama residents following discovery or notification of a breach, in the most expedient time possible and without unreasonable delay, balancing law enforcement and data restoration needs.
• If a person or business that maintains data on behalf of a data collector experiences a breach, they must notify the data collector within 24 hours after discovery.
• Substitute notice is allowed if the cost of providing notice would exceed $50,000, the affected class exceeds 100,000, or contact information is insufficient; substitute notice includes email (if available), conspicuous website posting, and notification to major statewide media.
• If more than 10,000 residents are affected at once, the information broker or data collector must also notify nationwide consumer reporting agencies.
• Violations are considered deceptive trade practices under Alabama law.
• The act becomes effective on the first day of the third month following passage and governor's approval.

AI-generated summary using openai/gpt-5-nano on Feb 24, 2026. May contain errors — refer to the official bill text for accuracy.

Subjects

Consumers and Consumer Protection