What does Oklahoma's data breach law ask a business to do?

Who does this law apply to?

The law applies to an individual or entity that owns or licenses computerized data with personal information. The duty to tell a resident applies when the breach causes, or is reasonably believed to have caused or to be likely to cause, identity theft or other fraud to an Oklahoma resident.

An individual or entity that owns or licenses computerized data that includes personal information shall provide notice of any breach of the security of the system following determination or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state.

What counts as personal information?

Personal information is a first name or first initial and last name together with another listed item. The list in the text includes a social security number, a driver's licence or other government ID number, a financial account or card number with the code that opens it, and an electronic identifier or routing code with its code.

Unique biometric data used to authenticate a person, such as a fingerprint or an iris image, also counts.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual

unique biometric data such as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual.

How fast must people be told?

The text sets no fixed number of days for telling residents. Notice must be given without unreasonable delay, allowing for law enforcement and for the steps needed to find the scope of the breach and restore the system.

Except as provided in subsection D of this section or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the disclosure shall be made without unreasonable delay.

Who else must be told?

The Attorney General must be told without unreasonable delay and no more than 60 days after residents are notified.

A breach that affects fewer than five hundred Oklahoma residents does not need the Attorney General notice.

An individual or entity required to provide notice in accordance with subsection A or B of this section shall also provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents of this state as required by this section.

A breach of a security system where fewer than five hundred (500) residents of this state are affected within a single breach shall be exempt from the notice requirements of paragraph 1 of this subsection.

Is encrypted information treated differently?

Yes. The duty covers unencrypted and unredacted information. Encrypted or redacted information still counts if it is taken in readable form, or if the breach involves a person with access to the encryption key, and identity theft or other fraud is reasonably believed to follow.

An individual or entity shall provide notice of the breach of the security of the system if encrypted or redacted information is accessed and acquired in an unencrypted or unredacted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state.

What if a vendor holds the data?

An individual or entity that keeps personal information it does not own or license must tell the owner or licensee as soon as practicable after determining there was a breach.

An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall provide notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following determination, if the personal information was or if the entity reasonably believes it was accessed and acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.