Okla. Senate Privacy, Data Breach Notification Bills Advance

Sen. Carri Hicks (D) asked many questions about the bill and flagged a potentially lengthy timeline for consumers to get businesses to honor their requests. However, she ultimately voted to advance the privacy bill.

The committee voted by voice to clear an amendment delaying the privacy bill’s effective date by six months until July 1, 2026 (see 2502120025). SB-546 is moving ahead a week after a House privacy bill by Rep. Josh West (R) stalled (see 2502050040).

At the same hearing, the Technology Committee voted 5-2 for a data breach notification bill by Howard. SB-626 requires businesses to notify the attorney general no more than 60 days after notifying affected customers about a breach, if the breach affected at least 500 residents. Existing law requires notice to customers after 30 days. The bill would include penalties for businesses that fail to notify the AG.

Sen. David Bullard (R) voted no because he said he would rather punish the criminals that committed the breach than the businesses who suffered their attacks. He said an identical previous version of the bill failed last year because of such concerns. "I've still got the same struggles."

Sen. Christi Gillespie (R), also voting no, raised concerns about penalizing small businesses, which she said may well have 500 or more customers and therefore may be included in the measure.

Howard noted that under the bill, businesses would get an affirmative defense in a civil action if they have reasonable safeguards in place to secure personal information. Also, Howard said he’s open to adjusting the threshold in a future amendment, but there must be a penalty.