Oklahoma

The law covers a “breach of the security of a system” which means the unauthorized access and acquisition of unencrypted and un-redacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of Oklahoma.

An individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and un-redacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of Oklahoma.

The law covers ‘Personal Information’ which means the first name or first initial and last name of an individual in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

1. Social Security number,
2. Driver license number, or
3. Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to the financial account of an individual.