SB 1716: Security Breach Notification Act; prohibiting class action liability for private entity for cybersecurity event; providing exceptions. Effective date. - Oklahoma

Proposed Policy Committee Substitute 1 → Floor (Senate) · 3 edits

MINOR

The bill was completely rewritten to replace a committee substitute version with the final Senate Floor version. The new text updates the legal citations to reflect the bill's progression through the legislative process and reorganizes the structure to align with the final enacted format.

Scope change

The bill's substantive scope regarding security breach notification requirements, liability exemptions, and definitions remains unchanged from the committee version; only the formatting and legal citations were modified.

TECHNICAL

The entire text of the bill was replaced to update the header information, including the bill title, sponsor names, and session details, to match the final Senate Floor version.

Legal citations and section references were updated to reflect the bill's status as an amendment to 24 O.S. 2021, Section 165, rather than referencing a previous Senate Bill number.

The document structure was reorganized to remove committee-specific labels (like 'Proposed Policy Committee Substitute') and replace them with standard Senate Floor formatting.

Engrossed → Proposed Policy Committee Substitute 1 · 3 edits

MINOR

The bill was completely rewritten by the House Policy Committee, replacing the original text with a new version that adopts modern data privacy terminology (like 'Controller' and 'Dark patterns') and significantly expands the list of defined terms to align with current privacy standards.

Scope change

The bill's scope remains focused on security breach notification, but the underlying legal framework and definitions have been modernized to reflect contemporary data privacy concepts.

DEFINITION

The entire bill text was replaced with a new version containing updated definitions for terms like 'Affiliate', 'Consent', 'Dark pattern', and 'Consumer', shifting from older legal phrasing to modern privacy language.

New definitions were added for 'Controller', 'Decision that produces a legal or similarly significant effect', and 'Dark pattern' to clarify how user autonomy and decision-making are protected.

TEXT

The original substantive text of the bill, including specific enforcement mechanisms and penalty structures, was deleted and replaced entirely by the new committee substitute.

Introduced → Engrossed · 4 edits · Mar 17, 2026

MODERATE

The bill was updated from its original introduction to its final engrossed version, adding official signatures from the Senate and House and including a new effective date of November 1, 2026. A key substantive change occurred in the liability rules for private entities: the text was modified to clarify that class action lawsuits are only allowed if the security breach was caused by the entity's willful and wanton conduct or gross negligence. Additionally, the enforcement authority for state-chartered financial institutions was explicitly defined as belonging exclusively to their primary state regulator.

Scope change

The scope of enforcement for state-chartered or state-licensed financial institutions was clarified to be exclusively handled by their primary state regulator, separating them from general enforcement by the Attorney General.

ELIGIBILITY

The conditions for private entities to face class action liability were refined to require proof of willful and wanton conduct or gross negligence by the entity.

ENFORCEMENT

Explicitly assigned exclusive enforcement authority for violations by state-chartered or licensed financial institutions to their primary state regulator.

TIMELINE

Added a specific effective date of November 1, 2026, for the new provisions.

TECHNICAL

Added official legislative history lines indicating the bill passed both the Senate and House of Representatives.

Security Breach Notification Act; prohibiting class action liability for private entity for cybersecurity event; providing exceptions. Effective date.

What changed between versions

How they voted

Actions timeline

Sponsors