Law / United States / 
Montana
State agencies and their data recipients, procedures to protect personal information and an information security policy
Mont. Code Ann. §§ 2-6-1502, 2-6-1503(4)
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
As of .
What it requires
- This duty binds a state agency (an agency, authority, board, bureau, college, commission, committee, council, department, hospital, institution, office, university, or other instrumentality of the legislative or executive branch of state government, but not the judicial branch) and, for the information security policy, a third party to whom a state agency discloses personal information, meaning a person with a contractual obligation to perform a function for a state agency. A private business with no state contract is not bound.
- Develop procedures to protect the personal information the agency maintains while enabling its use as necessary for the agency to perform its duties under federal or state law.
- Include in those procedures measures to eliminate unnecessary use of personal information, identify the persons or state agencies authorized to have access, restrict access by unauthorized persons or state agencies, identify when redaction is appropriate, dispose of documents consistently with record retention requirements, eliminate unnecessary storage on portable devices, and protect data containing personal information on a portable device.
- Develop and maintain an information security policy designed to safeguard personal information, and breach notification procedures that provide reasonable notice to individuals.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each state agency that maintains the personal information of an individual must develop procedures to protect the personal information while enabling the state agency to use the personal information as necessary for the performance of its duties under federal or state law.
The procedures must include measures to eliminate the unnecessary use of personal information, identify who may have access to it, restrict access by unauthorized persons or state agencies, identify when redaction is appropriate, dispose of documents consistently with record retention requirements, eliminate unnecessary storage on portable devices, and protect data containing personal information on a portable device.
All state agencies and third parties to whom personal information is disclosed by a state agency must develop and maintain an information security policy designed to safeguard personal information. A third party is a person with a contractual obligation to perform a function for a state agency, or a state agency with a contractual or other obligation to perform a function for another state agency.