Senate Bill 2786

AN ACT TO PROVIDE FOR THE PROTECTION OF PERSONAL INFORMATION AND BUSINESS INFORMATION COLLECTED AND MAINTAINED BY A STATE AGENCY, OR BY A THIRD PARTY ON BEHALF OF A STATE AGENCY; TO PROVIDE THAT A THIRD PARTY THAT IS PROVIDED ACCESS TO SUCH DATA SHALL ACCEPT LIABILITY FOR A DATA BREACH, SHALL LIMIT THE USE OF THE DATA, AND SHALL NOT OTHERWISE MINE, SELL OR RELEASE THE DATA; AND FOR RELATED PURPOSES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:

SECTION 1. A third party that is provided access to personal information and business information, including, but not limited to, financial and operational data and intellectual property, hereinafter "data," by a state agency, or that collects and maintains such data on behalf of a state agency, does not own the data maintained by the third party unless affirmatively and voluntarily agreed upon by the state agency and the data provider. A third party that is provided access to data by a state agency, or that collects and maintains data on behalf of a state agency, shall accept liability for a data breach, shall limit use of the data maintained strictly to the use of which the state agency contracted with the third party, and shall not otherwise mine, sell or release the data.

SECTION 2. This act shall take effect and be in force from and after its passage.