Attorney General Mark Brnovich says Gov. Doug Ducey's signing of HB2154 will strengthen Arizona's data breach consumer protection statute. 

"HB2154 bolsters protections for private data in several ways," Brnovich told Arizona Business Daily. "The bill updates the definition of a breach to reflect the type of information sought by hackers in the modern age."

Brnovich explained that data hackers often look for private health information, biometric data, passport numbers, taxpayer ID numbers and e-signatures, all of which the new law will protect, in addition to speeding up the time frame in which a company must notify victims of a breach.

"Previously, there was no definitive timeline and businesses could wait months, possibly even years, before notifying consumers that their personal information had been compromised," Brnovich said. "A company must now notify consumers within 45 days after the discovery a breach has occurred."

If there are more than 1,000 Arizona residents affected by a breach, the company must notify the three biggest consumer reporting agencies and the attorney general's office. 

"Our intent is not to be overly punitive to businesses that have been breached -- they are often victims themselves -- but we believe the new law incentivizes companies to take data privacy seriously," Brnovich said. "Most importantly, it incentivizes companies to be proactive and act responsibly by notifying consumers when their data has been stolen."

The punishment for businesses that are involved in data breaches and fail to notify consumers will be up to $10,000 per violation with a cap of $500,000 for a series of incidents, whereas the previous law only penalized a maximum amount of $10,000. 

"HB 2154 deals with companies that violate the law – not the hackers. Existing laws regarding prosecution against those who engage in hacking, remain in place. Oftentimes, hackers are overseas and difficult to prosecute," Brnovich said.

 HB2154 was sponsored by state Rep. T.J. Shope and authored by the Arizona attorney general’s office.