MISSOURI H.B. 100 - SECURITY BREACH

Sponsor: Representative Edward Wildberger (D)

Summary: States that financial institutions, their officers, employees, agents, and directors shall not disclose to any person any financial information relating to a customer.

States that no consent or waiver shall be required as a condition of doing business with any financial institution, and any consent or waiver obtained from a customer as a condition of doing business with a financial institution shall not be deemed a consent of the customer.

Valid consent shall be in writing and signed by the customer. In consenting to disclosure of customer information, a customer may specify any of the following:
1) The time during which such consent will operate
2) The customer information to be disclosed
3) The persons, government agencies, or law enforcement agencies to which disclosure can be made

Requires any person or business that owns or licenses computerized data, including personal information, shall disclose any breach of security of the system following discovery or notification of the breach. Notification shall be made to any resident of the state whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible, but no more than 30 days after such breach has been discovered.

Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.

Defines "breach of security of the system" as an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the business or person. Good faith acquisition of personal information by an employee or agent of the business for the purposes of the business shall not be considered a breach of security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.

Defines "personal information" as an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
1) Social Security number
2) Driver's license number
3) Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account

Notice may be provided by one of the following methods:
1) Written notice
2) Electronic notice
3) Substitute notice may be provided if the agency demonstrates that the cost of providing notice would exceed $250,000, that the number of persons to be notified exceeds 500,000, or the agency does not have sufficient contact information.





An agency that maintains and follows its own notification procedures shall be deemed to be in compliance with the notification requirements.

A consumer may elect to place a security alert in his or her credit report by making a request in writing or by telephone to a consumer credit reporting agency.

Defines "security alert" as a notice placed in a consumer's credit report, at the request of the consumer, that notifies a recipient of the credit report that the consumer's identity may have been used without the consumer's consent to fraudulently obtain goods or services in the consumer's name.

A consumer credit reporting agency shall notify each person requesting consumer credit information with respect to a consumer of the existence of a security alert in the credit report of that consumer, regardless of whether a full credit report, credit score, or summary report is requested.

Each consumer credit reporting agency shall maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, seven days a week.

The toll-free telephone number shall be included in any written disclosure by a consumer credit reporting agency to any consumer and shall be printed in a clear and conspicuous manner.

A consumer credit reporting agency shall place a security alert on a consumer's credit report no later than five business days after receiving a request from the consumer.

The security alert shall remain in place for at least 90 days, and a consumer shall have the right to request a renewal of the security alert.

Effective 90 days after adjournment.

http://www.house.mo.gov/billtracking/bills091/biltxt/intro/HB0100I.htm


Status: Prefiled December 11, 2008.

Outlook: This measure has been prefiled for the 2009 legislative session. According to a source in the Clerk’s office, bills that are prefiled will not be referred to a committee until the Legislature convenes and will not receive any action until they are formally introduced on the first day of session, January 7. The sponsor is a member of the minority party.

TO THE MISSOURI MEMBERS:

On behalf of the MAP Committee, I am pleased to announce that Cotton Walker, Cotton Walker, L.L.C., Jefferson City, MO, has recently been appointed as the Missouri MAP State Compliance Chair for the remainder of the 2007-2009 term.  Please see attached for a list of current MAP State Chairs.

The State Chairs serve as a volunteer liaison between MAP at the national level and ACA at the State level. Each State Chair is an attorney licensed to practice law in the state for which they have volunteered. In a few states where we did not have a resident attorney volunteer, an attorney licensed in that state but residing in another state has volunteered to serve. We hope that you will seriously consider inviting your Unit’s MAP State Compliance Chair to speak at each of your Unit Meetings, to write articles for publication in your Unit newsletters and to work with you on your legislative initiatives, as his or her schedule permits. Please contact your State Chair and discuss the opportunities for working together. If at any time your State Chair is unavailable, please feel free to contact us so that we can coordinate with another MAP attorney to assist you.

We encourage you to share this information with your membership via your newsletter, at your meetings or however you feel appropriate. 

Upon your request, we will also e-mail a packet of information regarding MAP membership for your information and distribution to your members. If you have any questions about MAP or the State Chair program, e-mail map@acainternational.org or call us at (952) 926-6547.

Valerie Hayes

Corporate Counsel