Personal Information Security and Breach Investigation Law for Public Agencies and Nonaffiliated Third Parties

Requires public agencies and the private contractors that receive personal information from them to maintain reasonable security and breach investigation procedures. Contractors must report breaches to the agency within 72 hours, and agencies must notify state officials within 72 hours, investigate, and notify affected individuals within 35 days of concluding misuse is likely. Personal information includes name, personal mark, or a biometric or genetic print combined with identifiers such as SSN, account numbers, ID numbers, or health information.