Senate committee advances bill to expand Idaho's definition of personal data and require credit monitoring after breaches

Senate Bill 1066, introduced by Senator Ben Toews, would broaden Idaho's statutory definition of personally identifiable information to include items such as passport numbers, other government‑issued identification numbers, username or email address combined with a password or security question, medical history and DNA profiles, unique biometric data used for authentication, and individual taxpayer identification numbers. The Senate Commerce Committee voted to send the bill to the 14th order for possible amendment on a voice vote.

The bill would also require an agency, individual or commercial entity that determines that misuse of a resident's personally identifiable information (PII) has occurred or is reasonably likely to occur to, in addition to the currently required notice, offer credit‑monitoring services to affected Idaho residents. "If any of you have dealt with, having a breach of your information can be extremely disconcerting," Toews told the committee, saying the monitoring requirement "gives some peace of mind."

Committee members pressed Toews on cost and scope. Senator Ward Engelking said the fiscal note's estimate—about $450 per person, described in testimony as an industry average for three years—would be "pretty hefty" if applied to large breaches and asked how many state entities had experienced breaches in the past. Toews told the committee he would research the fiscal exposure if the bill moved to amendment and said the $450 figure came from an industry average for the proposed 36‑month monitoring period.

Toews also said he expects to offer amendments in the 14th order. He described three principal changes he intends to propose: reducing the monitoring period from 36 months to 12 months to lower costs; removing "health insurance policy number or other unique identifier used by a health insurer" from the PII definition; and adding a consumer‑fraud exemption clarifying that a breach does not include data acquired from sources other than systems maintained by the covered entity or its service provider (for example, where a resident is tricked into disclosing information). Toews said he also plans to add a definition of encryption and a statutory exemption for properly encrypted data.

Committee discussion included the phrase "reasonably likely to occur" in the breach standard. Toews said that language captures incidents such as ransomware events where there is clear access to databases even if misuse has not yet been demonstrated; he noted sticking only to "has occurred" could exclude those situations. Several senators said they wanted more information about the likely fiscal impact and how often state agencies have been affected historically before finalizing a position.

At the sponsor's request, Senator Nichols moved to send SB 1066 to the 14th order for possible amendment; Senator Lenny seconded the motion. The committee conducted a voice vote; the chair announced the motion carried and that SB 1066 would be sent to the 14th order for possible amendment.

Discussion vs. decision: the committee's action is procedural—referral to the 14th order for possible amendment—not final enactment. Toews and others described specific amendment directions they intend to pursue and Toews agreed to supply additional fiscal information to the committee before amendments are finalized. The committee did not adopt substantive changes on the floor of the committee at this meeting.