Security Breach Notification Act; prohibiting class action liability for private entity for cybersecurity event; providing exceptions. Effective date.

ENGR. S. B. NO. 1716 Page 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

ENGROSSED SENATE
BILL NO. 1716 By: Howard of the Senate

and

Gise of the House

[ Security Breach Notification Act - class action
liability - exceptions - effective date ]

BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
SECTION 1. AMENDATORY 24 O.S. 2021, Section 165, as
amended by Section 4, Chapter 406, O.S.L. 2025 (24 O.S. Supp. 2025,
Section 165), is amended to read as follows:
Section 165. A. A violation of the Security Breach
Notification Act that results in injury or loss to residents of this
state may be enforced by the Attorney General or a district attorney
in the same manner as an unlawful practice under the Oklahoma
Consumer Protection Act.
B. Except as provided in subsection D of this section, the
Attorney General or a district attorney shall have exclusive
authority to bring an action and may obtain actual damages for a
violation of the Security Breach Notification Act and a civil
penalty not to exceed One Hundred Fifty Thousand Dollars
($150,000.00) per breach of the security of the system or series of
breaches of a similar nature that are determined in a single

ENGR. S. B. NO. 1716 Page 2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

investigation. Civil penalties shall be based upon the magnitude of
the breach, the extent to which the behavior of the individual or
entity contributed to the breach, and any failure to provide the
notice required by Section 163 of this title.
C. 1. An individual or entity that uses reasonable safeguards
and provides notice as required by Section 163 or 164 of this title
shall not be subject to civil penalties and may use such compliance
as an affirmative defense in a civil action filed under the Security
Breach Notification Act.
2. An individual or entity that fails to use reasonable
safeguards but provides notice as required by Section 163 or 164 of
this title shall not be subject to the civil penalty set forth in
subsection B of this section but shall be subject to actual damages
and a civil penalty of Seventy-five Thousand Dollars ($75,000.00).
3. A private entity shall not be liable in a class action
resulting from a breach of the security of a system unless such
breach was caused by the willful and wanton conduct or gross
negligence of the private entity.
D. A violation of the Security Breach Notification Act by a
state-chartered or state-licensed financial institution shall be
enforceable exclusively by the primary state regulator of the
financial institution.
SECTION 2. This act shall become effective November 1, 2026.

ENGR. S. B. NO. 1716 Page 3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

Passed the Senate the 16th day of March, 2026.

Presiding Officer of the Senate

Passed the House of Representatives the ____ day of __________,
2026.

Presiding Officer of the House
of Representatives