SB 960 - Under current law, a person that owns or licenses personal information of Missouri residents is required to provide notice to the affected consumer of a breach of security and such notification shall be made without unreasonable delay. This act changes the notification time to within 14 business days of the discovery or notification of the breach.

Additionally, the act authorizes any person to bring an action for damages for willful and knowing violation of the notification requirement in instances of a breach of security relating to personal information. Damages shall not exceed $150,000 per breach and a civil penalty for a violation may be awarded, but shall not exceed $150,000 per breach.

This act is identical to SB 222 (2021) and HB 1499 (2020).

JULIA SHEVELEVA