MO HB1333

Repeals and replaces section 407.1500 RSMo regarding consumer notification requirements for security breaches of personal information.

Redefines "personal information" to require an individual's first name or initial and last name in combination with specific data elements (Social Security number, government ID number, financial account number with security codes, medical information, or health insurance information) that are not encrypted, redacted, or otherwise made unreadable.

Requires persons owning or licensing personal information of Missouri residents to notify affected consumers without unreasonable delay following discovery of a security breach, using written notice, electronic notice, telephone, or substitute notice (website posting, email, media notification) depending on circumstances.

Allows notification to be delayed if a law enforcement agency requests in writing that notification would impede criminal investigation or jeopardize national security; requires notice be provided without unreasonable delay once law enforcement determines notification will no longer impede the investigation.

Grants the Missouri Attorney General exclusive authority to enforce violations, allowing civil penalties up to $150,000 per breach or series of similar breaches discovered in a single investigation.