Okla. Stat. tit. 24, § 24-162

As used in the Security Breach Notification Act:

1. “Breach of the security of a system” means the unauthorized

access and acquisition of unencrypted and unredacted computerized

data that compromises the security or confidentiality of personal

information maintained by an individual or entity as part of a

database of personal information regarding multiple individuals and

that causes, or the individual or entity reasonably believes has

caused or will cause, identity theft or other fraud to any resident

of this state. Good faith acquisition of personal information by an

employee or agent of an individual or entity for the purposes of the

individual or the entity is not a breach of the security of the

system, provided that the personal information is not used for a

purpose other than a lawful purpose of the individual or entity or

subject to unauthorized disclosure;

2. “Entity” includes corporations, business trusts, estates,

partnerships, limited partnerships, limited liability partnerships,

limited liability companies, associations, organizations, joint

ventures, governments, governmental subdivisions, agencies, or

Oklahoma Statutes - Title 24. Debtor and Creditor Page 40

instrumentalities, or any other legal entity, whether for profit or

not-for-profit;

3. “Encrypted” means transformation of data through the use of

an algorithmic process into a form in which there is a low

probability of assigning meaning without use of a confidential

process or key, or securing the information by another method that

renders the data elements unreadable or unusable;

4. “Financial institution” means any institution the business

of which is engaging in financial activities as defined by 15

U.S.C., Section 6809;

5. “Individual” means a natural person;

6. “Personal information” means an individual’s first name or

first initial and last name in combination with any one or more of

the following data elements that relate to the individual if any of

the data elements are not encrypted, redacted, or otherwise altered

by any method or technology in such a manner that the name or data

elements are unreadable or are encrypted, redacted, or otherwise

altered by any method or technology but the keys to unencrypt,

unredact, or otherwise read the data elements have been obtained

through the breach of security:

a. social security number,

b. driver license number or other unique identification

number created or collected by a government entity,

c. financial account number, or credit card or debit card

number, in combination with any required expiration

date, security code, access code, or password that

would permit access to an individual’s financial

account,

d. unique electronic identifier or routing code in

combination with any required security code, access

code, or password that would permit access to an

individual’s financial account, or

e. unique biometric data such as a fingerprint, retina or

iris image, or other unique physical or digital

representation of biometric data to authenticate a

specific individual.

The term does not include information that is lawfully obtained from

publicly available sources, or from federal, state or local

government records lawfully made available to the general public;

7. “Notice” means:

a. written notice to the postal address in the records of

the individual or entity,

b. telephone notice,

c. electronic notice, or

d. substitute notice, if the individual or the entity

required to provide notice demonstrates that the cost

of providing notice will exceed Fifty Thousand Dollars

Oklahoma Statutes - Title 24. Debtor and Creditor Page 41

($50,000.00), or that the affected class of residents

to be notified exceeds one hundred thousand (100,000)

persons, or that the individual or the entity does not

have sufficient contact information or consent to

provide notice as described in subparagraph a, b, or c

of this paragraph. Substitute notice consists of any
ousand Dollars

Oklahoma Statutes - Title 24. Debtor and Creditor Page 41

($50,000.00), or that the affected class of residents

to be notified exceeds one hundred thousand (100,000)

persons, or that the individual or the entity does not

have sufficient contact information or consent to

provide notice as described in subparagraph a, b, or c

of this paragraph. Substitute notice consists of any

two of the following:

(1) email notice if the individual or the entity has

email addresses for the members of the affected

class of residents,

(2) conspicuous posting of the notice on the Internet

website of the individual or the entity if the

individual or the entity maintains a public

Internet website, or

(3) notice to major statewide media;

8. “Reasonable safeguards” means policies and practices that

ensure personal information is secure, taking into consideration an

entity’s size and the type and amount of personal information. The

term includes, but is not limited to, conducting risk assessments,

implementing technical and physical layered defenses, employee

training on handling personal information, and establishing an

incident response plan; and

9. “Redact” means alteration or truncation of data such that no

more than the following are accessible as part of the personal

information:

a. five digits of a social security number, or

b. the last four digits of a driver license number,

unique identification number created or collected by a

government entity, or account number.