SB106 - Alabama Information Protection Act of 2015

• Creates the Alabama Information Protection Act of 2015 requiring covered entities and governmental entities to take reasonable measures to protect and secure personal information in electronic or paper form.

• Requires entities to notify the Attorney General of any data security breach affecting 500 or more individuals within 30 days (extendable by 15 days for good cause).

• Mandates notice to affected individuals within 30 days of discovering a breach, with exceptions for law enforcement interference or if breach poses no identity theft or financial harm risk.

• Requires notification to consumer reporting agencies for breaches affecting more than 1,000 individuals and annual reporting by the Attorney General to the Governor and Legislature.

• Imposes civil penalties up to $500,000 for violations, with escalating daily penalties ($1,000 per day for up to 30 days, then $50,000 per 30-day period); prohibits retention of card security codes and magnetic stripe data beyond transaction authorization; provides exemptions for entities complying with federal regulations.