1
2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill creates affirmative defenses to certain causes of action arising out of a data
10 breach.
11 Highlighted Provisions:
12 This bill:
13 ▸ defines terms;
14 ▸ creates affirmative defenses to causes of action arising out a data breach involving
15 personal information, restricted information, or both personal information and
16 restricted information;
17 ▸ provides that an entity may not claim an affirmative defense if the entity had notice
18 of a threat or hazard;
19 ▸ establishes the requirements for asserting an affirmative defense;
20 ▸ provides that the creation of an affirmative defense does not create a cause of action
21 for failure to comply with the requirements for asserting the affirmative defense;
22 ▸ requires the Office of the Attorney General to make rules regarding cybersecurity
23 standards; and
24 ▸ provides a severability clause.
25 Money Appropriated in this Bill:
26 None
27 Other Special Clauses:
28 None
29 Utah Code Sections Affected:
30 ENACTS:
31 78B-4-701, Utah Code Annotated 1953
32 78B-4-702, Utah Code Annotated 1953
33 78B-4-703, Utah Code Annotated 1953
34 78B-4-704, Utah Code Annotated 1953
35 78B-4-705, Utah Code Annotated 1953
36 78B-4-706, Utah Code Annotated 1953
37
38 Be it enacted by the Legislature of the state of Utah:
39 Section 1. Section 78B-4-701 is enacted to read:
40
41 78B-4-701. Definitions.
42 As used in this part:
43 (1) (a) "Business" means:
44 (i) an association;
45 (ii) a corporation;
46 (iii) a limited liability company;
47 (iv) a limited liability partnership;
48 (v) a sole proprietorship;
49 (vi) another group, however organized and whether operating for profit or not for
50 profit; or
51 (vii) a parent or subsidiary of any of the entities described in Subsections (1)(a)(i)
52 through (vi).
53 (b) "Business" includes a financial institution organized, chartered, or holding a license
54 authorizing operation under the laws of this state, another state, or another country.
55 (2) "Covered entity" means a business that accesses, maintains, communicates, or
56 processes personal information or restricted information in or through one or more systems,
57 networks, or services located in or outside of this state.
58 (3) "Cybersecurity standard" means a cybersecurity framework or publication
59 established by a well-known entity that:
60 (a) (i) develops guidelines and best practices that are generally applicable to any type of
61 business to protect personal information and restricted information from a data breach; or
62 (ii) develops guidelines or best practices that are applicable to a specific type of
63 business to protect personal information and restricted information from a data breach; and
64 (b) the Office of the Attorney General determines is current and generally accepted by
65 experts in the cybersecurity industry in accordance with the rulemaking authority in Section
66 78B-7-705.
67 (4) (a) "Data breach" means the unauthorized access to or acquisition of electronic data
68 that:
69 (i) compromises the security or confidentiality of personal information or restricted
70 information owned by or licensed to a covered entity; and
71 (ii) causes, is reasonably believed to have caused, or is reasonably believed will cause a
72 material risk of identity theft or other fraud to an individual or an individual's property.
73 (b) "Data breach" does not include:
74 (i) good faith acquisition of personal information or restricted information by the
75 covered entity's employee or agent for a purpose of the covered entity if the personal
76 information or restricted information is not used for an unlawful purpose or subjected to further
77 unauthorized disclosure; or
78 (ii) acquisition of personal information or restricted information pursuant to:
79 (A) a search warrant, subpoena, or other court order; or
80 (B) a subpoena, order, or duty of a federal or state agency.
81 (5) (a) "Data item" means:
82 (i) a social security number;
83 (ii) a driver license number or state identification number; or
84 (iii) a financial account number or credit or debit card number when combined with
85 any required security code, access code, or password that is necessary to permit access to an
86 individual's financial account.
87 (b) "Data item" does not include an item described in Subsection (5)(a) if the item is
88 encrypted, redacted, or altered by any method or technology that makes the item unreadable.
89 (6) "Encrypted" means transformed, using an algorithmic process, into a form that has
90 a low probability of assigning meaning without the use of a confidential process, access key, or
91 password.
92 (7) "Individual's name" means:
93 (a) the individual's first name and last name; or
94 (b) the individual's last name and the initial of the individual's first name.
95 (8) "PCI data security standard" means the Payment Card Industry Data Security
96 Standard.
97 (9) (a) "Personal information" means an individual's name when combined with one or
98 more data items.
99 (b) "Personal information" does not include publicly available information that is
100 lawfully made available to the general public from federal, state, or local records or any of the
101 following media that are widely distributed:
102 (i) a news, editorial, or advertising statement published in a bona fide newspaper,
103 journal, magazine, or broadcast over radio or television;
104 (ii) a gathering or furnishing of information or news by a bona fide reporter,
105 correspondent, or news bureau to news media described in Subsection (9)(b)(i);
106 (iii) a publication designed for and distributed to members of a bona fide association or
107 charitable or fraternal nonprofit corporation; or
108 (iv) any type of media that is substantially similar in nature to any item, entity, or
109 activity described in Subsection (9)(b)(i) through (iii).
110 (10) "Redact" means to alter or truncate a data item so that no more than the last four
111 digits of a social security number, driver license number, state identification number, financial
112 account number, or credit or debit card number is accessible.
113 (11) "Restricted information" means any information, other than personal information,
114 about an individual that:
115 (a) (i) alone, or in combination with other information, including personal information,
116 can be used to distinguish or trace the individual's identity; or
117 (ii) is linked or linkable to an individual;
118 (b) is not encrypted, redacted, or altered by a method or a technology that makes the
119 information unreadable; and
120 (c) if accessed or acquired without authority, is likely to result in a material risk of
121 identity theft or fraud to the individual or the individual's property.
122 Section 2. Section 78B-4-702 is enacted to read:
123 78B-4-702. Affirmative defense for a data breach of cyber data.
124 (1) A covered entity that creates, maintains, and complies with a written cybersecurity
125 program that meets the requirements of Subsection (5) and is in place at the time of a data
126 breach of the covered entity has an affirmative defense to a claim that:
127 (a) is brought under the laws of this state or in the courts of this state;
128 (b) alleges that the covered entity failed to implement reasonable information security
129 controls;
130 (c) alleges that the failure described in Subsection (1)(b) resulted in a data breach of
131 personal information; and
132 (d) does not allege a data breach of restricted information.
133 (2) A covered entity that creates, maintains, and complies with a written cybersecurity
134 program that meets the requirements of Subsection (6) and is in place at the time of a data
135 breach of the covered entity has an affirmative defense to a claim that:
136 (a) is brought under the laws of this state or in the courts of this state; and
137 (b) alleges that the covered entity failed to implement reasonable information security
138 controls that resulted in a data breach of personal information and restricted information.
139 (3) A covered entity has an affirmative defense to a claim that the covered entity failed
140 to appropriately respond to a data breach if:
141 (a) (i) for a data breach of personal information, the covered entity creates, maintains,
142 and complies with a written cybersecurity program that meets the requirements of Subsection
143 (5) and is in place at the time of the data breach; or
144 (ii) for a data breach of personal information and restricted information, the covered
145 entity creates, maintains, and complies with a written cybersecurity program that meets the
146 requirements of Subsection (6) and is in place at the time of the data breach; and
147 (b) the written cybersecurity program had protocols at the time of the data breach for
148 responding to a data breach that complied with the written cybersecurity program under
149 Subsection (3)(a) and the covered entity followed the protocols.
150 (4) A covered entity has an affirmative defense to a claim that the covered entity failed
151 to appropriately notify an individual whose personal information or restricted information was
152 compromised in a data breach if:
153 (a) (i) for a data breach of personal information, the covered entity creates, maintains,
154 and complies with a written cybersecurity program that meets the requirements of Subsection
155 (5) and is in place at the time of the data breach; or
156 (ii) for a data breach of personal information and restricted information, the covered
157 entity creates, maintains, and complies with a written cybersecurity program that meets the
158 requirements of Subsection (6) and is in place at the time of the data breach; and
159 (b) the written cybersecurity program had protocols at the time of the data breach for
160 notifying an individual about a data breach that complied with the requirements for a written
161 cybersecurity program under Subsection (4)(a) and the covered entity followed the protocols.
162 (5) A written cybersecurity program described in Subsections (1) and (2) shall contain
163 administrative, technical, and physical safeguards to protect personal information, including:
164 (a) being designed to:
165 (i) protect the security and confidentiality of personal information;
166 (ii) protect against any anticipated threat or hazard to the security or integrity of
167 personal information; and
168 (iii) protect against a data breach of personal information;
169 (b) reasonably conform to an industry recognized cybersecurity framework as
170 described in Section 78B-4-703; and
171 (c) being of an appropriate scale and scope in light of the following factors:
172 (i) the size and complexity of the covered entity;
173 (ii) the nature and scope of the activities of the covered entity;
174 (iii) the sensitivity of the information to be protected;
175 (iv) the cost and availability of tools to improve information security and reduce
176 vulnerability; and
177 (v) the resources available to the covered entity.
178 (6) A written cybersecurity program described in Subsection (2) shall meet the
179 requirements described in Subsection (5), except that the requirements of Subsection (5) shall
180 apply to both personal information and restricted information.
181 (7) A covered entity may not claim an affirmative defense under Subsections (1), (2),
182 (3), or (4) if:
183 (a) the covered entity had actual or constructive notice of a threat or hazard to the
184 security or integrity of personal information or restricted information;
185 (b) the covered entity did not act in a reasonable amount of time to take remedial
186 efforts to protect the information against the threat or hazard; and
187 (c) the threat or hazard resulted in the data breach.
188 Section 3. Section 78B-4-703 is enacted to read:
189 78B-4-703. Components of a cybersecurity program eligible for an affirmative
190 defense.
191 (1) Subject to Subsection (2), a covered entity's written cybersecurity program
192 reasonably conforms to an industry recognized cybersecurity framework if the written
193 cybersecurity program:
194 (a) is designed to protect the type of personal information and restricted information
195 obtained in the data breach;
196 (b) reasonably conforms to the current version of a cybersecurity standard;
197 (c) for personal information or restricted information obtained in the data breach that is
198 regulated by the federal government or state government, reasonably complies with the
199 requirements of the regulation, including:
200 (i) the security requirements of the Health Insurance Portability and Accountability Act
201 of 1996, as described in 45 C.F.R. Part 164, Subpart C;
202 (ii) Title V of the Gramm-Leach-Bliley Act of 1999, Pub. L. No. 106-102, as amended;
203 (iii) the Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283;
204 (iv) the Health Information Technology for Economic and Clinical Health Act, as set
205 forth in 45 C.F.R. Part 164; or
206 (v) any other applicable federal or state regulation; and
207 (d) for personal information or restricted information obtained in the data breach that is
208 the type of information intended to be protected by the PCI data security standard, reasonably
209 complies with the current version of the PCI data security standard.
210 (2) If an industry recognized cybersecurity framework described in Subsection (1) is
211 revised, a covered entity with a written cybersecurity program that relies upon that industry
212 recognized cybersecurity framework shall reasonably conform to the revised version of the
213 framework in a reasonable amount of time, taking into consideration the urgency of the
214 revision in terms of:
215 (a) risks to the security of personal information or restricted information;
216 (b) the cost and effort of complying with the revised version; and
217 (c) any other relevant factor.
218 Section 4. Section 78B-4-704 is enacted to read:
219 78B-4-704. No cause of action.
220 This part does not create a private cause of action, including a class action, if a covered
221 entity fails to comply with a provision of this part.
222 Section 5. Section 78B-4-705 is enacted to read:
223 78B-4-705. Rulemaking.
224 In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
225 Office of the Attorney General:
226 (1) shall make rules:
227 (a) that establish cybersecurity standards; and
228 (b) that establish to which business the cybersecurity standards apply; and
229 (2) may make rules to clarify:
230 (a) any cybersecurity standards in need of clarification; and
231 (b) the application of any cybersecurity standards in need of clarification.
232 Section 6. Section 78B-4-706 is enacted to read:
233 78B-4-706. Severability clause.
234 If any provision of this part, or the application of any provision of this part to any
235 person or circumstance, is held invalid, the remainder of this part shall be given effect without
236 the invalid provision or application.