HB 750 Summary

• Information brokers and data collectors must notify Alabama residents of security breaches involving unencrypted personal information in the most expedient time possible without unreasonable delay.

• Third-party businesses maintaining computerized data on behalf of information brokers or data collectors must notify them within 24 hours of discovering a breach.

• Notification methods include written notice, telephone, electronic notice, or substitute notice (email, website posting, or major statewide media) if costs exceed $50,000, affect more than 100,000 individuals, or insufficient contact information exists.

• Personal information is defined as an individual's name combined with Social Security number, driver's license number, account/card numbers, passwords, or other sensitive data elements that are unencrypted or unredacted.

• Violations constitute deceptive trade practices under Alabama law; notification to national consumer reporting agencies required when more than 10,000 residents are affected; law enforcement may delay notification if it would compromise a criminal investigation.