Senate revisits data-breach notification bill, adopts industry-driven amendments and circles for technical fixes

Senator Walker, sponsor of first substitute SB69, explained floor amendments aimed at narrowing the circumstances that trigger mandatory notification to consumers after a data breach. She told the Senate stakeholders asked for changes to avoid over-notification, including removing street address and telephone number from the list of sensitive elements and excluding some publicly displayed IDs (for example, cab-driver or stylist identifications) from the notification triggers.

Walker said the measure requires notification when a combination of a person's name and a sensitive element—such as a Social Security number, financial-account number, credit-card number or an authentication password—has been compromised and is sufficient to permit unauthorized access to funds, credit or services. She also described requirements for reasonable procedures to protect personal information and provisions to require destruction of records that are not to be retained; the statute would exclude financial institutions that are regulated by federal law.

During floor discussion, senators raised concerns about language consistency among amendment copies (green vs. brown copies) and about the legal standard phrasing ("highly likely"), which had been negotiated with Utah businesses to set a higher notification threshold than in some other states. Because some senators lacked the full, consistent text and to resolve technical discrepancies, the body voted to circle the bill so the sponsor and stakeholders can resolve the drafting issues before resuming consideration.

Senate action in the transcript is procedural: amendments were explained and the bill was circled for technical corrections; no final passage is recorded in the provided segment.