S 1066 — IDENTITY THEFT – Amends existing law to revise provisions regarding disclosure of breach of personally identifiable information and to require that agencies, individuals, and commercial entities offer free credit monitoring services in certain situations.

10661066, As Amended BY COMMERCE AND HUMAN RESOURCES COMMITTEE AN ACT RELATING TO IDENTITY THEFT;

AMENDING SECTION 28-51-104, IDAHO CODE, TO RE- VISE DEFINITIONS, TO DEFINE A DEFINITIONTERM, AND TO MAKE A TECHNICAL CORRECTION;

AMENDING SECTION 28-51-105, IDAHO CODE, TO REVISE PROVISIONS REGARDINGREGARD- ING DISCLOSURE OF BREACH OF SECURITY OF COMPUTERIZED PERSONALLY IDENTIFIABLEIDEN- INFORMA-TIFIABLE TIONINFORMATION BY AN AGENCY, INDIVIDUAL, OR A COMMERCIAL ENTITY;

ANDAMENDING DECLARINGSECTION AN28-51-107, EMERGENCYIDAHO ANDCODE, PROVIDINGTO ANPROVIDE EF-A FECTIVECORRECT DATE.CODE REFERENCE;

AND DECLARING AN EMERGENCY AND PROVIDING AN EFFECTIVE DATE.

Good faith acquisition of personal information by an employee or agent of an agency, individual or a commercial entity for the purposes of the agency, in- dividual or the commercial entity is not a breach of the security of the sys- tem, provided that the personal information is not used or subject to furtherfur- ther unauthorized disclosure.

A breach of the security of the system of an agency, individual, or commercial entity does not include the acquisition of data from any source other than systems maintained by the agency, indi - vidual, or commercial entity, or a service provider acting on behalf of such agency, individual, or commercial entity.

(4) "Notice""Encryption" means:includes standard encryption, which scrambles data and requires a digital key to unscramble such data, and any other technique that translates or substitutes unusable data for personal information and requires a token, key, or other protective process to convert the translated or substituted data to personal information.

(4) (5) "Notice" means:

(5) (6) "Personal information" "Personally identifiable information" or "(PII)" means an Idaho resident's first name or first initial and last name in combination with any one (1) or more of the following data elements that relate to the resident, when either the name or and the data elements are not en-encrypted: crypted:

(f) HealthUnique insurancebiometric policydata numbergenerated orfor otherauthentication uniquepurposes; identifier used by a health insurer;

or (g) UniqueIndividual biometrictaxpayer dataidentification generatednumber. for authentication purposes;

or (h) Individual taxpayer identification number.

(6) (7) "Primary regulator" of a commercial entity or individual licensedli- censed or chartered by the United States is that commercial entity's or individ-in- ual'sdividual's primary federal regulator, the primary regulator of a commercial en-entity tity or individual licensed by the department of finance is the department of finance, the primary regulator of a commercial entity or individual licensedli- censed by the department of insurance is the department of insurance and, for all agencies and all other commercial entities or individuals, the primary regu-regulator lator is the attorney general.

(a) Offer to provide credit monitoring services at no cost to the af- fected resident for a period of not less than thirty-sixtwelve (36)(12) months;

That Section 28-51-107, Idaho Code, be, and the same is hereby amended to read as follows:

28-51-107.

VIOLATIONS.

In any case in which an agency's, commercial entity's or individual's primary regulator has reason to believe that an agency, individual or commercial entity subject to that primary regula- tor's jurisdiction under section 28-51-104(6) (7), Idaho Code, has violated section 28-51-105, Idaho Code, by failing to give notice in accordance with that section, the primary regulator may bring a civil action to en- force compliance with that section and enjoin that agency, individual or commercial entity from further violations.

Any agency, individual or com- mercial entity that intentionally fails to give notice in accordance with section 28-51-105, Idaho Code, shall be subject to a fine of not more than twenty-five thousand dollars ($25,000) per breach of the security of the system.

SECTION 5.