Technology (Cybersecurity)

SB 1716 amends Oklahoma's Security Breach Notification Act to limit class action lawsuits against private entities following cybersecurity breaches. It prohibits class action liability unless a breach results from the entity's "willful and wanton conduct or gross negligence." The bill also clarifies that private entities using reasonable safeguards and providing required breach notices cannot be held liable for civil penalties, while those failing to use reasonable safeguards face reduced penalties ($75,000) but not class actions. This directly affects businesses and organizations handling personal data in Oklahoma, shifting enforcement exclusively to the Attorney General or district attorneys for most cases.