Sec. 107. Right to data security
298 words·~1 min read·
/bill/116/s/2968/is/section-107·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity shall establish, implement, and maintain reasonable data security practices to protect the confidentiality, integrity, and accessibility of covered data. Such data security practices shall be appropriate to the volume and nature of the covered data at issue. Data security practices required under subsection
(a)shall include, at a minimum, the following: Identifying and assessing any reasonably foreseeable risks to, and vulnerabilities in, each system maintained by the covered entity that processes or transfers covered data, including unauthorized access to or risks to covered data, human vulnerabilities, access rights, and use of service providers. Such activities shall include a plan to receive and respond to unsolicited reports of vulnerabilities by entities and individuals. Taking preventive and corrective action to mitigate any risks or vulnerabilities to covered data identified by the covered entity, which may include implementing administrative, technical, or physical safeguards or changes to data security practices or the architecture, installation, or implementation of network or operating software. Disposing covered data that is required to be deleted or is no longer necessary for the purpose for which the data was collected unless an individual has provided affirmative express consent to such retention. Such process shall include destroying, permanently erasing, or otherwise modifying the covered data to make such data permanently unreadable or indecipherable and unrecoverable and data hygiene practices to ensure ongoing compliance with this subsection. Training all employees with access to covered data on how to safeguard covered data and protect individual privacy and updating that training as necessary. Not later than 1 year after the date of enactment of this Act, the Commission, in conjunction with the National Institute of Standards and Technology, shall publish guidance for covered entities on how to provide effective data security and privacy training as described in subsection (b)(4).