S 733 Summary

• Amends the definition of "security breach" to require documentation and maintenance for at least three years when determining that illegal use has not occurred or is not reasonably likely to occur.

• Requires businesses to implement and maintain reasonable security procedures, notify affected persons within 45 days of breach discovery, and notify the Consumer Protection Division within 45 days.

• Mandates consumer reporting agencies to offer free identity theft prevention and credit monitoring services for at least 24 months to consumers affected by security breaches, and prohibits selling paid credit protection products without first notifying consumers of free security freeze options.

• Requires businesses to provide credit monitoring services at no cost for at least 24 months when a consumer's social security number is disclosed in a security breach.

• Creates new requirement that persons cannot obtain, use, or seek a consumer's credit report or score without written, verbal, or electronic consent from the consumer.