AL HB366

Amends Alabama Data Breach Notification Act to define three new terms: precise location data (GPS coordinates or location-based radio frequency signals), proprietary network information (telecommunications service details), and third-party agent (entities contracted to maintain personal information).

Creates new unlawful trade practice under Alabama Deceptive Trade Practices Act when a covered entity suffers a data breach containing sensitive personally identifying information, precise location data, and proprietary network information while lacking reasonable security measures.

Establishes that covered entities must have reasonable security measures in place at the time of a breach to avoid liability under the new provisions.

Bill is excluded from Alabama Constitution Section 111.05 requirements for local expenditures because it defines a new crime.

Effective date: October 1, 2024.