Data Privacy Interactive Map - Oklahoma

Highlights

Covered Entities: Individuals or entities that own or license computerized data that includes personal information.

Consumer Notification: Notification must be provided to any Oklahoma resident whose “unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person,” when the unauthorized access and acquisition causes or is reasonably believed has caused or will cause identity theft or other fraud to an Oklahoma resident.

Regulatory Notification: Notification must be provided to the Oklahoma Attorney General where the number of Oklahoma residents to be notified exceeds 500.

Notification Timeline: Notification must be provided without unreasonable delay.

Data Format: Electronic.

Citations: 24 Okla. Stat. §§ 161–166

More Details

Definitions:

• Breach: Unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of PI, and that causes or is reasonably believed has caused or will cause, identity theft or other fraud to an Oklahoma resident.
• Personal information (PI): An individual’s first name / first initial and last name in combination with one or more of the following data elements:
  • Social Security number;
  • Driver’s license or other unique identification number created or collected by a government entity;
  • Financial account or payment card number plus required expiration date, a security code, access code, or password that would permit access to a financial account.
  • Unique electronic identifier or routing code in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or
  • Unique biometric data such as fingerprint, retina or iris image, or other unique physical or digital representation of biometric data to authenticate a specific individual.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI was encrypted, so long as the encryption key is not also available thereby rendering the PI readable / usable.
• Good Faith: Notification is not required where the potentially impacted PI was acquired in good faith by an employee or agent, provided that the PI is not used for a purpose other than the lawful purpose of the individual or entity or subject to further unauthorized disclosure.
• Risk of Harm: Notification is not required unless the breach causes or is reasonably believed has caused or will cause identity theft or other fraud to an Oklahoma resident.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification “will impede a criminal or civil investigation or homeland or national security.”
• Public Record: Personal Information does not include information that is lawfully obtained from publicly available sources, or from federal, state or local government records lawfully made available to the general public.

Direct Notice:

• Timing: Notice must be provided without unreasonable delay unless requested by law enforcement, or consistent with measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system.
• Format: N/A
• Content: N/A
• Method: “Notice” means (1) written notice to the postal address in the records of the individual or entity; (2) telephone notice; (3) electronic notice; or (4) substitute notice.

Substitute Notice:

An individual or entity may provide substitute notice if (1) the cost of providing notice would exceed $50,000, (2) the notification population exceeds 100,000, or (3) the individual or entity does not have sufficient contact information or consent to provide direct notice. It must consist of any two of the following: (1) e-mail notice, if an e-mail address is available; (2) conspicuous posting on the individual or entity’s public web site, or (3) notice to statewide media.

Remediation Services:

N/A

Regulatory Notice:

An individual or entity required to provide notice to 500 or more Oklahoma residents must also provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents. The notice shall include the date of the breach, the date of its determination, the nature of the breach, the type of personal information exposed, the number of residents of this state affected, the estimated monetary impact of the breach to the extent such impact can be determined, and any reasonable safeguards the entity employs.

Credit Reporting Agencies Notice:

N/A

Third-Party Notice:

An individual or entity that maintains computerized data that includes PI that the individual or entity does not own or license must notify the owner or licensee of the information of a “breach” as soon as practicable following discovery, if the personal information was or if the entity reasonably believes it was accessed and acquired by an unauthorized person.

HIPAA:

An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures, or guidelines established by the primary or functional federal regulator of the entity shall be deemed to be in compliance with the provisions of this act.

Private Action:

N/A

Associated Regulations:

Insurance Data Security Act (26 O.S. §§ 670-679)