system to the Governor's Office of Administration within
three business days following the discovery of the breach.
Notification shall occur notwithstanding the existence of
procedures and policies under section 7.
(3) A STATE AGENCY THAT, ON THE EFFECTIVE DATE OF THIS
SECTION, HAS AN EXISTING CONTRACT WITH A STATE AGENCY
CONTRACTOR SHALL USE REASONABLE EFFORTS TO AMEND THE CONTRACT
TO INCLUDE PROVISIONS RELATING TO THE STATE AGENCY
CONTRACTOR'S COMPLIANCE WITH THIS ACT.
(4) A STATE AGENCY THAT, AFTER THE EFFECTIVE DATE OF
THIS SECTION, ENTERS INTO A CONTRACT WITH A STATE AGENCY
CONTRACTOR SHALL ENSURE THAT THE CONTRACT INCLUDES PROVISIONS
RELATING TO THE STATE AGENCY CONTRACTOR'S COMPLIANCE WITH
THIS ACT.
(a.2) Notification by county, school district or
municipality.--If a county, school district or municipality is
the subject of a breach of security of the system, the county,
school district or municipality shall provide notice of the
breach of security of the system required under subsection (a)
within seven days following discovery of the breach.
Notification shall be provided to the district attorney in the
county in which the breach occurred within three business days
following discovery of the breach. Notification shall occur
notwithstanding the existence of procedures and policies under
section 7.
(a.3) Electronic notification.--In the case of a breach of
the security of the system involving personal information
defined in section 2 for a user name or e-mail address in
combination with a password or security question and answer that
would permit access to an online account, the person or business
20210SB0696PN0793 - 4 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30