2018 House Bill 6405

Expand data breach response requirements

Introduced in the House

Sept. 27, 2018

Introduced by Rep. Diana Farrington (R-30)

To establish detailed rules for personal information data breaches, guidelines, notice requirements, reporting requirements and more for businesses, associations and state agencies. Among other things the bill would distinguish between breaches that only permit an outsider to gain access to an online account, versus breaches that expose sensitive personally identifying information. The bill authorizes $5,000-per-day civil penalties for noncompliance, up to a maximum of $250,000.

Referred to the Committee on Financial Services

Nov. 28, 2018

Reported without amendment

With the recommendation that the substitute (H-1) be adopted and that the bill then pass.

Dec. 4, 2018

Amendment offered by Rep. Diana Farrington (R-30)

To replace the previous version of the bill with one that revises details but does not change the substance as previously described.

The amendment passed by voice vote

Dec. 6, 2018

Passed in the House 103 to 6 (details)

To establish detailed rules for personal information data breaches, including guidelines, notice- and reporting-requirements and more, for businesses, associations and state agencies. Among other things the bill would distinguish between breaches that only permit an outsider to gain access to an online account, versus breaches that expose sensitive personally identifying information. The bill authorizes $5,000-per-day civil penalties for noncompliance, up to a maximum of $250,000.

Received in the Senate

Dec. 11, 2018

Referred to the Committee on Finance

Dec. 18, 2018

Reported without amendment

With the recommendation that the substitute (S-1) be adopted and that the bill then pass.