SB106 Alabama 2015 Session

Existing law does not require a person that owns, licenses, or maintains data containing personal information of an Alabama resident to notify the resident if the personal information is breached by an unauthorized person

This bill would create the Alabama Information Protection Act of 2015 to provide for the protection of personal information and notice to individuals whose personal information has been breached

This bill would require specified entities, including governmental entities and third-party agents, to notify the Attorney General and the individual owners of personal information upon a data security breach

This bill would require these entities to provide notice to credit reporting agencies of security breaches of personal information involving more than 1,000 individuals

This bill would require the Attorney General to annually report certain information relating to security breaches to the Governor and the Legislature

This bill would provide for the disposal of records containing personal information, would authorize enforcement actions by the Attorney General, and would provide for the assessment of civil penalties for failure to provide the required notification

This bill would also prohibit a person from retaining certain data from a credit, debit, or other financial card for a specified period of time and would require persons in violation to reimburse financial institutions for certain costs upon a breach of security

Relating to consumer protection; to require specified entities to take reasonable measures to protect and secure data containing personal information in paper or electronic form; to require the entities to notify the Attorney General of data security breaches; to require notice to individuals and credit reporting agencies of data security breaches in certain circumstances; to provide for the disposal of customer records; to provide for enforcement actions by the Attorney General; to provide civil penalties; to provide that this act does not create a private cause of action; to prohibit a person from retaining certain data from a charge, debit, or other financial card for a specified period of time; to provide certain exemptions; to require persons in violation to reimburse financial institutions of certain costs upon a breach of security; and to provide exceptions.