A.R.S. tit. 18 ch. 5 — Arizona Revised Statutes Title 18 Chapter 5 — Network Security

18-501. Definitions In this article, unless the context otherwise requires: 1. "Advertisement" means a communication the primary purpose of which is the commercial promotion of a commercial product or service, including communication on an internet website that is operated for a commercial purpose. 2. "Computer software" means a sequence of instructions that is written in any programming language and that is executed on a computer and does not include a web page or data components of web pages that are not executable independently of the web page. 3. "Damage" means any significant impairment to the integrity or availability of data, computer software, a system or information. 4. "Execute" means the performance of the functions or the carrying out of the instructions of the computer software. 5. "Intentionally deceptive" means any of the following: (a) By means of an intentionally and materially false or fraudulent statement. (b) By means of a statement or description that intentionally omits or misrepresents material information in order to deceive an owner or operator of a computer. (c) By means of an intentional and material failure to provide any notice to an owner or operator of a computer regarding the installation or execution of computer software in order to deceive the owner or operator. 6. "Internet" means the global information system that is logically linked together by a globally unique address space based on the internet protocol, or its subsequent extensions, and that is able to support communications using the transmission control protocol or internet protocol suite, or its subsequent extensions, or other internet protocol compatible protocols, and that provides, uses or makes accessible, either publicly or privately, high level services layered on the communications and related infrastructure described in this paragraph. 7. "Owner or operator" means the owner or lessee of a computer or someone using the computer with the owner's or lessee's authorization. Owner or operator does not include any person who owns a computer before the first retail sale of the computer. 8. "Person" means any individual, partnership, corporation, limited liability company or other organization or any combination of these entities. 9. "Personally identifiable information" means any of the following with respect to an individual who is an owner or operator of a computer: (a) First name or first initial in combination with last name. (b) A home or other physical address including street name. (c) An electronic mail address. (d) A credit or debit card number or bank account number or any password or access code associated with a credit or debit card or bank account. (e) A social security number, tax identification number, driver license number, passport number or any other government issued identification number. (f) Any of the following information in a form that personally identifies an owner or operator of a computer: (i) Account balances. (ii) Overdraft history. (iii) Payment history. 10. "Transmit" means to transfer, send or make available computer software, or any component of computer software, via the internet or any other medium, including local area networks of computers, any other nonwire transmission and a disk or other data storage device. Transmit does not include any action by a person providing any of the following: (a) The internet connection, telephone connection or other means of transmission capability such as a compact disk or digital video disk through which the software was made available. (b) The storage or hosting of the software program or an internet web page through which the software was made available. (c) An information location tool, such as a directory, index, reference, pointer or hypertext link, through which the user of the computer located the software, unless the person receives a direct economic benefit from the execution of the software on the computer. 18-502. Prohibited activities; applicability A. It is unlawful for any person who is not an owner or operator of a computer to transmit computer software to a computer, with actual knowledge or with conscious avoidance of actual knowledge, and to use the software to do any of the following: 1. Modify, through intentionally deceptive means, settings that control any of the following: (a) The page that appears when an owner or operator of a computer launches an internet browser or similar computer software used to access and navigate the internet. (b) The default provider or web proxy that an owner or operator of a computer uses to access or search the internet. (c) An owner's or operator's list of bookmarks used to access web pages. 2. Collect, through intentionally deceptive means, personally identifiable information: (a) Through the use of a keystroke logging function that records all keystrokes made by an authorized user who uses the computer and transfers that information from the computer to another person. (b) In a manner that correlates the information with data respecting all or substantially all of the websites visited by an owner or operator of the computer, other than websites operated by the person collecting the information. (c) With respect only to information described in section 18-501, paragraph 9, by extracting such information from the hard drive of an owner's or operator's computer. 3. Prevent, through intentionally deceptive means, an owner's or operator's reasonable efforts to block the installation or execution of, or to disable, computer software by causing software that an owner or operator of the computer has properly removed or disabled automatically to reinstall or reactivate on the computer. 4. Intentionally misrepresent that computer software will be uninstalled or disabled by an owner's or operator's action. 5. Through intentionally deceptive means, remove, disable or render inoperative security, antispyware or antivirus computer software installed on the computer. 6. Take control of the computer by: (a) Accessing or using the modem or internet service for the computer for the purpose of causing damage to the computer or causing an owner or operator to incur financial charges for a service that the owner or operator of the computer has not authorized. (b) Opening multiple, sequential, stand-alone advertisements in an owner's or operator's internet browser without the authorization of the owner or operator that a reasonable computer user cannot close without turning off the computer or closing the internet browser. 7. Modify any of the following settings related to the computer's access to, or use of, the internet: (a) Settings that protect information about an owner or operator of the computer for the purpose of stealing personally identifiable information of the owner or operator. (b) Security settings for the purpose of causing damage to a computer. 8. Prevent an owner's or operator's reasonable efforts to block the installation of, or to disable, computer software, by doing either of the following: (a) Presenting the owner or operator with an option to decline installation of computer software with knowledge that, if the option is selected, the installation nevertheless proceeds. (b) Falsely representing that computer software has been disabled. B. It is unlawful for any person who is not an owner or operator of a computer to do either of the following with regard to the computer: 1. Induce an owner or operator to install a computer software component on the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view or play a particular type of content. 2. Deceptively cause the execution on the computer of a computer software component with the intent of causing an owner or operator to use the component in a manner that violates any other provision of this section. C. This section does not apply to any monitoring of, or interaction with, a subscriber's internet or other network connection or service, or a computer, by a telecommunications carrier, cable operator, video service provider, computer hardware or software provider or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, maintenance, repair, authorized updates of software or system firmware, authorized remote system management or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service or computer software, including scanning for and removing software prescribed under this article. 18-503. Statewide concern; preemption It is the intent of the legislature that this article is a matter of statewide concern. This article supersedes and preempts all rules, regulations, codes, ordinances and other laws adopted by a city, county, municipality or local agency regarding spyware and notices to consumers from computer software providers regarding information collection. 18-504. Civil remedies; damages A. In addition to any other remedies provided by law, the attorney general, or a computer software provider or a website or trademark owner who is adversely affected by a violation of this article, may bring an action against a person who violates this article to: 1. Enjoin further violations of this article. 2. Recover the greater of actual damages or one hundred thousand dollars for each separate violation of this article. B. A single action or conduct that violates more than one paragraph of section 18-502, subsection A or B or at least one paragraph of section 18-502, subsection A and at least one paragraph of section 18-502, subsection B shall be considered multiple violations. The number of violations shall be based on the number of paragraphs violated. C. In an action brought under this section, a court may: 1. Increase the damages up to three times the damages allowed by subsection A of this section if the defendant has engaged in a pattern and practice of violating this article. 2. Award costs and reasonable attorney fees to the prevailing party. 18-521. Definitions In this article, unless the context otherwise requires: 1. "Entity identifying information" has the same meaning prescribed in section 13-2001. 2. "Governmental agency" means: (a) Any board, commission, department or other administrative unit of this state established by the Constitution of Arizona or by enactment of the legislature and includes the legislature, the courts and the governor. (b) Any county and any board, commission, department or other administrative unit of the county. (c) Any city or town and any board, commission, department or other administrative unit of the city or town. (d) Any other political subdivision of this state. 3. "Personal identifying information" has the same meaning prescribed in section 13-2001. 18-522. Anti-identification procedures A governmental agency shall develop and establish commercially reasonable procedures to ensure that entity identifying information or personal identifying information that is collected or obtained by the governmental agency is secure and cannot be accessed, viewed or acquired unless authorized by law. Nothing in this article shall be construed to restrict, diminish or otherwise affect the provisions of title 39. 18-541. Definitions In this article, unless the context otherwise requires: 1. "Electronic mail message" means a message sent to a unique destination that consists of a unique user name or mailbox and a reference to an internet domain, whether or not displayed, and to which an electronic mail message can be sent or delivered. 2. "Identifying information" means an individual's piece of information that can be used to access an individual's financial accounts or to obtain goods or services and that includes an individual's: (a) Social security number. (b) Driver license number. (c) Bank account number. (d) Credit or debit card number. (e) Personal identification number. (f) Automated or electronic signature. (g) Unique biometric data. (h) Account passwords. 3. "Internet" means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, that comprise the interconnected worldwide network of networks that employ the transmission control protocol or internet protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio. 4. "Web page" means a location with respect to the worldwide web that has a single uniform resource locator or other single location with respect to the internet. 18-542. Prohibition A person, with the intent to commit fraud or theft, shall not use a web page or electronic mail message or otherwise use the internet to solicit, request or take any action to induce another person to provide identifying information by representing that the person, either directly or by implication, is an online business without the authority or approval of the online business. 18-543. Civil remedies; damages A. A person who either is engaged in the business of providing internet access service to the public or owns a web page or trademark and who is adversely affected by reason of a violation of this article may bring an action against a person who violates this article to: 1. Enjoin further violations of this article. 2. Recover the greater of actual damages or two thousand five hundred dollars for each separate violation of this article. B. A person, other than a person who is described in subsection A of this section, who is adversely affected by reason of a violation of this article may bring an action only against the person who violates this article to: 1. Enjoin further violations of this article. 2. Recover the greater of actual damages or five thousand dollars for each separate violation of this article. C. The attorney general may bring an action against a person who violates this article to: 1. Enjoin further violations of this article. 2. Recover two thousand five hundred dollars per violation. D. An action under this section must be brought within three years after the violation is discovered or by the exercise of reasonable diligence should have been discovered, whichever is earlier. E. In an action under this section, the court may increase a damage award to an amount equal to not more than three times the amount otherwise available under this section if the court determines that the defendant has engaged in a pattern and practice of violating this article. F. The attorney general may also recover reasonable attorney fees and costs. G. For the purposes of this section, multiple violations of this article resulting from any single action or act shall constitute one violation. 18-544. Violation; classification A person who violates this article is guilty of a class 5 felony. 18-551. Definitions In this article, unless the context otherwise requires: 1. "Breach" or "security system breach": (a) Means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals. (b) Does not include a good faith acquisition of personal information by a person's employee or agent for the purposes of the person if the personal information is not used for a purpose unrelated to the person and is not subject to further unauthorized disclosure. 2. "Court" means the supreme court, the court of appeals, the superior court, a court that is inferior to the superior court and a justice court. 3. "Encrypt" means to use a process to transform data into a form that renders the data unreadable or unusable without using a confidential process or key. 4. "Individual" means a resident of this state who has a principal mailing address in this state as reflected in the records of the person conducting business in this state at the time of the breach. 5. "Nationwide consumer reporting agency": (a) Means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis as defined in 15 United States Code section 1681a(p). (b) Does not include a nationwide specialty consumer reporting agency as defined in 15 United States Code section 1681a(x). 6. "Person": (a) Means a natural person, corporation, business trust, estate, trust, partnership, association, joint venture, government or governmental subdivision or agency or any other legal or commercial entity. (b) Does not include the department of public safety, a county sheriff's department, a municipal police department, a prosecution agency or a court. 7. "Personal information": (a) Means any of the following: (i) An individual's first name or first initial and last name in combination with one or more specified data elements. (ii) An individual's user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account. (b) Does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media. 8. "Prosecution agency" means the attorney general, a county attorney or a municipal prosecutor. 9. "Redact" means to alter or truncate a number so that not more than the last four digits are accessible and at least two digits have been removed. 10. "Security incident" means an event that creates reasonable suspicion that a person's information systems or computerized data may have been compromised or that measures put in place to protect the person's information systems or computerized data may have failed. 11. "Specified data element" means any of the following: (a) An individual's social security number. (b) The number on an individual's driver license issued pursuant to section 28-3166 or nonoperating identification license issued pursuant to section 28-3165. (c) A private key that is unique to an individual and that is used to authenticate or sign an electronic record. (d) An individual's financial account number or credit or debit card number in combination with any required security code, access code or password that would allow access to the individual's financial account. (e) An individual's health insurance identification number. (f) Information about an individual's medical or mental health treatment or diagnosis by a health care professional. (g) An individual's passport number. (h) An individual's taxpayer identification number or an identity protection personal identification number issued by the United States internal revenue service. (i) Unique biometric data generated from a measurement or analysis of human body characteristics to authenticate an individual when the individual accesses an online account. 18-552. Notification of security system breaches; requirements; enforcement; confidentiality; civil penalty; preemption; exceptions A. If a person that conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach. B. If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall: 1. Notify the individuals affected pursuant to subsection E of this section and subject to the needs of law enforcement as provided in subsection D of this section. 2. If the breach requires notification of more than one thousand individuals, notify both: (a) The three largest nationwide consumer reporting agencies. (b) The attorney general and the director of the Arizona department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or the director of the Arizona department of homeland security or by providing the attorney general or the director of the Arizona department of homeland security with a copy of the notification provided pursuant to paragraph 1 of this subsection. In the absence of a common form developed by the attorney general and the Arizona department of homeland security, nothing shall prohibit a person from submitting the same notification to the attorney general and the Arizona department of homeland security to meet the requirements of this subsection. C. A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee. The person that maintains the data under an agreement with the owner or licensee is not required to provide the notifications required by subsection B of this section unless the agreement stipulates otherwise. D. The notifications required by subsection B of this section may be delayed if a law enforcement agency advises the person that the notifications will impede a criminal investigation. On being informed by the law enforcement agency that the notifications no longer compromise the investigation, the person shall make the required notifications, as applicable, within forty-five days. E. The notification required by subsection B, paragraph 1 of this section shall include at least the following: 1. The approximate date of the breach. 2. A brief description of the personal information included in the breach. 3. The toll-free numbers and addresses for the three largest nationwide consumer reporting agencies. 4. The toll-free number, address and website address for the federal trade commission or any federal agency that assists consumers with identity theft matters. F. The notification required by subsection B, paragraph 1 of this section shall be provided by one of the following methods: 1. Written notice. 2. An email notice if the person has email addresses for the individuals who are subject to the notice. 3. Telephonic notice, if telephonic contact is made directly with the affected individuals and is not through a prerecorded message. 4. Substitute notice if the person demonstrates that the cost of providing notice pursuant to paragraph 1, 2 or 3 of this subsection would exceed $50,000, that the affected class of subject individuals to be notified exceeds one hundred thousand individuals or that the person does not have sufficient contact information. Substitute notice consists of all of the following: (a) A written letter to the attorney general that demonstrates the facts necessary for substitute notice. (b) Conspicuous posting of the notice for at least forty-five days on the website of the person if the person maintains one. G. If a breach involves personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) for an online account and does not involve personal information as defined in section 18-551, paragraph 7, subdivision (a), item (i), the person may comply with this section by providing the notification in an electronic or other form that directs the individual whose personal information has been breached to promptly change the individual's password and security question or answer, as applicable, or to take other steps that are appropriate to protect the online account with the person and all other online accounts for which the individual whose personal information has been breached uses the same user name and email address and password or security question or answer. If the breach of personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) is for login credentials of an email account furnished by the person, the person is not required to comply with this section by providing the notification to that email address, but may comply with this section by providing notification by another method described in this subsection or by providing clear and conspicuous notification delivered to the individual online when the individual is connected to the online account from an internet protocol address or online location from which the person knows the individual customarily accesses the account. The person satisfies the notification requirement with regard to the individual's account with the person by requiring the individual to reset the individual's password or security question and answer for that account, if the person also notifies the individual to change the same password or security question and answer for all other online accounts for which the individual uses the same user name or email address and password or security question or answer. H. A person that maintains the person's own notification procedures as part of an information security policy for the treatment of personal information and that is otherwise consistent with the requirements of this article, including the forty-five-day notification period required by subsection B of this section, is deemed to be in compliance with the notification requirements of subsection B, paragraph 1 of this section if the person notifies subject individuals in accordance with the person's policies if a security system breach occurs. I. A person that complies with the notification requirements or security system breach procedures pursuant to the rules, regulations, procedures, guidance or guidelines established by the person's primary or functional federal regulator is deemed to be in compliance with the requirements of subsection B, paragraph 1 of this section. J. A person is not required to make the notification required by subsection B of this section if the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals. K. Except for notifications provided pursuant to subsection F of this section, notifications provided to the attorney general and the director of the Arizona department of homeland security pursuant to this section are confidential pursuant to section 44-1525 and are exempt from disclosure under title 39. L. A knowing and wilful violation of this section is an unlawful practice pursuant to section 44-1522, and only the attorney general may enforce such a violation by investigating and taking appropriate action pursuant to title 44, chapter 10, article 7. The attorney general may impose a civil penalty for a violation of this article not to exceed the lesser of $10,000 per affected individual or the total amount of economic loss sustained by affected individuals, but the maximum civil penalty from a breach or series of related breaches may not exceed $500,000. This section does not prevent the attorney general from recovering restitution for affected individuals. M. The state legislature determines that security system breach notification is a matter of statewide concern. The power to regulate security system breach notification is preempted by this state, and this article supersedes and preempts all municipal and county laws, charters, ordinances and rules relating to issues regulated by this article. N. This article does not apply to either of the following: 1. A person that is subject to title V of the Gramm-Leach-Bliley act (P.L. 106-102; 113 Stat. 1338; 15 United States Code sections 6801 through 6809). 2. A covered entity or business associates as defined under regulations implementing the health insurance portability and accountability act of 1996, 45 Code of Federal Regulations section 160.103 (2013) or a charitable fundraising foundation or nonprofit corporation whose primary purpose is to support a specified covered entity, if the charitable fundraising foundation or nonprofit corporation complies with any applicable provision of the health insurance portability and accountability act of 1996 and its implementing regulations. O. The department of public safety, a county sheriff's department, a municipal police department, a prosecution agency and a court shall create and maintain an information security policy that includes notification procedures for a security system breach of the department of public safety, the county sheriff's department, the municipal police department, the prosecuting agency or the court.