HB470 Summary

• Establishes the Government Information Privacy Protection Act to protect personally identifiable information (names, Social Security numbers, driver license numbers, biometric records) collected by state agencies from unauthorized sharing and misuse.

• Requires federal agencies receiving state data to provide written notice to the originating state agency and affected individuals before disclosing data to third parties, and mandates state agencies obtain written statements from federal agencies detailing intended use, security measures, and data retention duration.

• Mandates annual privacy training for state employees handling personally identifiable information, covering state and federal privacy law, data security best practices, reporting obligations, and noncompliance consequences.

• Prohibits state agencies from contracting with vendors that fail to disclose security ratings, have violated data protection laws in the past five years, or do not comply with data safeguarding requirements.

• Establishes penalties for violations ranging from $50,000 civil fines for individuals, up to $100,000 fines and Class A misdemeanor charges for state employees, and up to $500,000 fines and Class D felony charges for employees engaged in a pattern of violations; creates independent Privacy Oversight Board to monitor compliance and report annually to the Legislature; effective October 1, 2025.