SB 180: "An Act relating to breaches of security involving personal information, consumer report security freezes, protection of social security numbers, disposal of records, and the accuracy of reports on credit history, score, and ranking."
00 SENATE BILL NO. 180 01 "An Act relating to breaches of security involving personal information, consumer 02 report security freezes, protection of social security numbers, disposal of records, and 03 the accuracy of reports on credit history, score, and ranking." 04 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 05 * Section 1. AS 45 is amended by adding a new chapter to read: 06 Chapter 48. Personal Information Protection Act. 07 Article 1. Breach of Security Involving Personal Information. 08 Sec. 45.48.010. Disclosure of breach of security. (a) If a person owns or 09 uses personal information that includes personal information on a state resident, and a 10 breach of the security of the information system containing the personal information 11 occurs, the person shall, after discovering or being notified of the breach, disclose the 12 breach to the state resident, whether or not the personal information has or has not 13 been accessed by an unauthorized third party for legal or illegal purposes. 14 (b) An information collector shall make the disclosure required by (a) of this
01 section in the most expedient time possible and without unreasonable delay, except as 02 provided in AS 45.48.020 and as necessary to determine the scope of the breach and 03 restore the reasonable integrity of the information system. 04 Sec. 45.48.020. Notification of law enforcement. An information collector 05 may delay making the disclosures required by AS 45.48.010 if the Department of Law 06 determines that the disclosures may compromise an investigation by the Department 07 of Law. If the disclosures are delayed under this section, the information collector 08 shall make the disclosures after the Department of Law determines that making the 09 disclosures would not compromise an investigation. 10 Sec. 45.48.030. Methods of notice. An information collector shall make the 11 disclosure required by AS 45.48.010 12 (1) by a written document; 13 (2) by electronic means if making the disclosure by the electronic 14 means is consistent with the provisions regarding electronic records and signatures 15 required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. 16 (Electronic Signatures in Global and National Commerce Act); or 17 (3) if the information collector demonstrates that the cost of providing 18 notice would exceed $250,000, that the affected class of state residents to be notified 19 exceeds 500,000, or that the information collector does not have sufficient contact 20 information to provide notice, by 21 (A) electronic mail if the information collector has an 22 electronic mail address for the state resident; 23 (B) conspicuously posting the disclosure on the Internet 24 website of the information collector if the information collector maintains an 25 Internet site; and 26 (C) providing a notice to major statewide media. 27 Sec. 45.48.040. Exception for employees and agents. In AS 45.48.010 - 28 45.48.090, the good faith acquisition of personal information by an employee or agent 29 of an information collector for a legitimate purpose of the information collector is not 30 a breach of the security of the information system if the employee or agent does not 31 use the personal information for a purpose unrelated to a legitimate purpose of the
01 information collector and does not make further unauthorized disclosure of the 02 personal information. 03 Sec. 45.48.050. Waivers. A waiver of AS 45.48.010 - 45.48.090 is void and 04 unenforceable. 05 Sec. 45.48.060. Violations. (a) If an information collector violates 06 AS 45.48.010 - 45.48.090 with regard to the personal information of an individual, the 07 individual may bring a civil action in court to 08 (1) recover the damages suffered by the state resident; 09 (2) enjoin from further violations of AS 45.48.010 - 45.48.090 an 10 information collector who engages in business and the security breach occurred to the 11 personal information used or owned by the information collector in the business. 12 (b) The rights and remedies available under this section are in addition to any 13 other rights and remedies available under another law. 14 Sec. 45.48.070. Minimum contacts. An information collector is subject to 15 AS 45.48.010 - 45.48.090 if the information collector engages in activities that 16 provide at least the minimum contacts required by substantive due process for the state 17 to exercise jurisdiction over the information collector. 18 Sec. 45.48.090. Definitions. In AS 45.48.010 - 45.48.090, 19 (1) "breach of the security" means unauthorized acquisition of personal 20 information that compromises the security, confidentiality, or integrity of the personal 21 information maintained by the information collector; in this paragraph, "acquisition" 22 includes acquisition by photocopying, facsimile, or other paper-based method; 23 (2) "information collector" means a person who owns or uses personal 24 information in any form if the personal information includes personal information on a 25 state resident; 26 (3) "personal information" means information in any form on an 27 individual, other than, if applicable, the information collector, that is not lawfully 28 available to the general public from federal, state, or local government records and that 29 consists of 30 (A) a combination of an individual's first name or first initial, 31 the individual's last name, and one or more of the following information
01 elements, when the name or the information elements are not encrypted or 02 redacted: 03 (i) the individual's social security number; 04 (ii) the number of the individual's driver's license or 05 state identification card; 06 (iii) the individual's account number, credit card 07 account number or debit card account number if the number does not 08 require additional identifying information, access codes, or passwords 09 for use; 10 (iv) account passwords or personal identification 11 numbers or other access codes; 12 (B) an item listed in (A)(i) - (iv) of this paragraph if the item 13 would be sufficient to engage in or attempt to engage in the theft of an 14 individual's identity. 15 Article 2. Consumer Report Security Freezes. 16 Sec. 45.48.100. Security freeze authorized. A consumer may prohibit a 17 consumer reporting agency from releasing all or a part of a consumer's consumer 18 report or information derived from the consumer report without the express 19 authorization of the consumer by placing a security freeze on the consumer report. 20 Sec. 45.48.110. Placement of security freeze. (a) To place a security freeze, 21 a consumer shall 22 (1) make the request to the consumer reporting agency by certified 23 mail; and 24 (2) provide the consumer reporting agency with proper identification. 25 (b) A consumer reporting agency shall place a security freeze within five 26 business days after receiving a request under (a) of this section. 27 Sec. 45.48.120. Confirmation of security freeze. (a) Within 10 business 28 days after a consumer makes the request under AS 45.48.110, a consumer reporting 29 agency shall send a written confirmation of the placement of the security freeze to the 30 consumer. 31 (b) At the same time that the consumer reporting agency sends a confirmation
01 under (a) of this section, the consumer reporting agency shall provide the consumer 02 with a unique personal identification number or password to be used by the consumer 03 when the consumer authorizes the release under AS 45.48.130 of the consumer report 04 or information derived from the report. 05 Sec. 45.48.130. Access and actions during security freeze. (a) While a 06 security freeze is in place, a consumer reporting agency shall allow a third party access 07 to a consumer's consumer report or information derived from the consumer report if 08 the consumer requests that the consumer reporting agency allow the access. 09 (b) To make a request under (a) of this section, the consumer shall contact the 10 consumer reporting agency, authorize the consumer reporting agency to allow the 11 access, and provide the consumer reporting agency with 12 (1) proper identification; 13 (2) the unique personal identification number or password provided 14 under AS 45.48.120(b); and 15 (3) the proper information necessary to identify the third party to 16 whom the consumer reporting agency may allow the access or the time period during 17 which the consumer reporting agency may allow the access to third parties who 18 request the access. 19 (c) A consumer reporting agency that receives a request from a consumer 20 under (b) of this section shall comply with the request within three business days after 21 receiving the request. 22 (d) A consumer reporting agency may develop procedures involving the use of 23 telephone, facsimile, or, if the consumer consents under 15 U.S.C. 7001 (Electronic 24 Signatures in Global and National Commerce Act), the Internet or other electronic 25 media to receive and process a request from a consumer under (a) of this section in an 26 expedited manner. 27 (e) If a security freeze is in place, a consumer reporting agency may not 28 release the consumer report or information derived from the consumer report to a third 29 party without the prior express authorization of the consumer. 30 (f) If a security freeze is in place, if a third party applies to a consumer 31 reporting agency to provide the third party with access to the consumer's consumer
01 report or information derived from the consumer report, and if the consumer does not 02 allow access for that specific party or during that specific period of time, the consumer 03 reporting agency may treat the third party's application as incomplete. 04 (g) A consumer reporting agency shall notify a consumer that a third party has 05 attempted to access the consumer's consumer report or information derived from the 06 report if a third party requests a consumer reporting agency to provide the third party 07 with access to the consumer report or information, a security freeze has been placed, 08 and the purpose of the access is not for the sole purpose of account review. 09 (h) This section is not intended to prevent a consumer reporting agency from 10 advising a third party who requests access to a consumer's consumer report or 11 information derived from the consumer report that a security freeze is in effect. 12 Sec. 45.48.140. Removal of security freeze. (a) Except as provided by 13 AS 45.48.130, a consumer reporting agency may not remove a security freeze unless 14 (1) the consumer requests that the consumer reporting agency remove 15 the security freeze under (b) of this section; or 16 (2) the consumer made a material misrepresentation of fact to the 17 consumer reporting agency when the consumer requested the security freeze under 18 AS 45.48.110; if a consumer reporting agency intends to remove a security freeze on a 19 consumer's consumer report under this paragraph, the consumer reporting agency shall 20 notify the consumer in writing before removing the security freeze. 21 (b) A consumer reporting agency shall remove a security freeze placed under 22 (a)(1) of this section within three business days after receiving a request for removal 23 from the consumer who requested the security freeze if the consumer provides proper 24 identification to identify the consumer and the unique personal identification number 25 or password provided by the consumer reporting agency under AS 45.48.120. 26 Sec. 45.48.150. Disclosure of process. If a consumer requests a security 27 freeze under AS 45.48.100, the consumer reporting agency shall disclose to the 28 consumer the process under AS 45.48.100 - 45.48.290 of placing a security freeze, 29 allowing access to a third party during a security freeze, and allowing access during a 30 specific period of time during a security freeze. 31 Sec. 45.48.160. Charges. A consumer reporting agency may not charge a
01 consumer more than 02 (1) $2 for each time that the consumer places a security freeze under 03 AS 45.48.100 or allows access for a specific person during a security freeze under 04 AS 45.48.130; or 05 (2) $4 for each time that the consumer allows access for a specific 06 period of time under AS 45.48.130. 07 Sec. 45.48.170. Additional identification information. A consumer 08 reporting agency may require additional information about the consumer's 09 employment, personal history, and family history in order to verify the consumer's 10 identity only if the consumer is unable to reasonably identify the consumer with 11 proper identification. 12 Sec. 45.48.180. Violationsand remedies. (a) A consumer who suffers 13 damages as a result of a person's violation of AS 45.48.100 - 45.48.290 may bring an 14 action in court against the person and recover, in the case of a violation where the 15 person acted 16 (1) negligently, actual damages, including loss of wages, and, when 17 applicable, damages for pain and suffering; 18 (2) knowingly, 19 (A) damages as described in (1) of this subsection; 20 (B) punitive damages that are not less than $100 nor more than 21 $5,000 for each violation as the court determines to be appropriate; and 22 (C) other relief that the court determines to be appropriate. 23 (b) A consumer may bring an action in court against a person for a violation or 24 threatened violation of AS 45.48.100 - 45.48.290 for injunctive relief, whether or 25 not the consumer seeks another remedy under this section. 26 (c) Notwithstanding (a)(2) of this section, a person who knowingly violates 27 AS 45.48.100 - 45.48.290 is liable in a class action for an amount that the court 28 allows. When determining the amount of an award in a class action under this 29 subsection, the court shall consider, among the relevant factors, the amount of any 30 actual damages awarded, the frequency of the violations, the resources of the violator, 31 and the number of consumers adversely affected.
01 (d) In this section, "knowingly" has the meaning given in AS 11.81.900. 02 Sec. 45.48.190. Minimum contacts. A consumer reporting agency is subject 03 to AS 45.48.100 - 45.48.290 if the consumer reporting agency engages in activities 04 that provide at least the minimum contacts required by substantive due process for the 05 state to exercise jurisdiction over the consumer reporting agency. 06 Sec. 45.48.200. Reports not covered. The provisions of AS 45.48.100 - 07 45.48.290 do not apply to a consumer report if the consumer report is 08 (1) a report that only contains information relating to transactions or 09 experiences between the consumer and the person making the report; 10 (2) a communication of the information that is described in (1) of this 11 section or that is taken from a credit application by a consumer, if 12 (A) the communication is limited to internal communication 13 within the organization of the person making the report or made to another 14 person who is owned by, or affiliated with, the person making the report; and 15 (B) the consumer is informed by a clear and conspicuous 16 written disclosure that the information contained in the credit application may 17 be communicated as allowed under (A) of this paragraph, except that, if a 18 credit application is taken by telephone, the consumer shall initially be 19 informed orally when the application is taken, and a clear and conspicuous 20 written disclosure shall be made to the consumer in the first written 21 communication to the consumer after the application is taken; 22 (3) an authorization or approval of a specific extension of credit 23 directly or indirectly by the issuer of a credit card or similar device; 24 (4) a report that conveys a person's decision whether to make a specific 25 extension of credit directly or indirectly to a consumer in response to a request by a 26 third party if the third party advises the consumer of the name and address of the 27 person to whom the request was made; 28 (5) a report containing information solely about a consumer's 29 character, general reputation, personal characteristics, or mode of living and the 30 information is obtained through personal interviews with neighbors, friends, or 31 associates of the consumer reported on, or others with whom the consumer is
01 acquainted or who may have knowledge concerning those items of information; or 02 (6) a consumer report furnished for use in connection with a 03 transaction that consists of an extension of credit to be used solely for a commercial 04 purpose. 05 Sec. 45.48.210. Exemptions. (a) The provisions of AS 45.48.100 - 45.48.290 06 do not apply to the use of a consumer report by 07 (1) a person, if the purpose of the person's use is account review or 08 collection of a financial obligation owing for an account, contract, or negotiable 09 instrument, and the consumer 10 (A) has, or had before an assignment of the account or contract 11 by the person, an account or contract with the person, including a demand 12 deposit account; or 13 (B) issued a negotiable instrument to the person; 14 (2) a subsidiary, an affiliate, an agent, an assignee, or a prospective 15 assignee of a person to whom access has been granted under AS 45.48.130 if the 16 purpose of the use is to facilitate the extension of credit or another permissible use; 17 (3) when acting under a court order, warrant, or subpoena, a state 18 agency, an agency of a political subdivision of the state, a law enforcement agency, a 19 court, or a private debt collection agency; 20 (4) an agency of a state or municipality that administers a program for 21 establishing and enforcing child support obligations; 22 (5) the Department of Health and Social Services, its agents, or its 23 assigns when investigating fraud; 24 (6) the Department of Revenue, its agents, or its assigns when 25 investigating or collecting delinquent taxes or unpaid court orders or when 26 implementing its other statutory responsibilities; 27 (7) a person if the purpose of the use is prescreening allowed under 15 28 U.S.C. 1681 - 1681w (Fair Credit Reporting Act); 29 (8) a person administering a credit file monitoring subscription service 30 to which the consumer has subscribed; 31 (9) a person providing a consumer with a copy of the consumer's
01 consumer report at the consumer's request. 02 (b) Notwithstanding another provision of AS 45.48.100 - 45.48.290 to the 03 contrary, AS 45.48.100 - 45.48.290 may not be interpreted to apply to the exchange of 04 information among persons who are affiliated by common ownership or common 05 corporate control. 06 (c) In (a)(1) of this section, "person" has the meaning given in AS 45.48.990, 07 but also includes the person's subsidiary, affiliate, or agent, an assignee of a financial 08 obligation owed by the consumer to the person, or a prospective assignee of a financial 09 obligation owed by the consumer to the person when in conjunction with the proposed 10 purchase of the financial obligation. 11 Sec. 45.48.290. Definitions. In AS 45.48.100 - 45.48.290, 12 (1) "account review" includes activities related to account 13 maintenance, account monitoring, account credit line increases, and account upgrades 14 and enhancements; 15 (2) "affiliate" meansa corporation that directly, orindirectly through 16 one or more intermediaries, controls, is controlled by, or is under common control 17 with another corporation; in this paragraph, control" means the possession, direct or 18 indirect, of the power to direct or cause the direction of the management and policies 19 of a corporation; 20 (3) "file" means, when used in connection with information on a 21 consumer, all of the information on that consumer recorded and retained by a 22 consumer reporting agency, regardless of how the information is stored; 23 (4) "permissible use" means a permissible use under 15 U.S.C. 1681b; 24 (5) "proper identification" means the information generally considered 25 sufficient to identify a person; 26 (6) "security freeze" means a prohibition against a consumer reporting 27 agency from releasing all or a part of a consumer's consumer report or information 28 derived from the consumer report without the express authorization of the consumer. 29 Article 3. Credit Accuracy. 30 Sec. 45.48.300. Credit accuracy. (a) A person who does business in the 31 state by distributing information about an individual's credit history, score, or ranking
01 shall, when notified that the information that the person is distributing is inaccurate, 02 immediately stop distributing the information until the accuracy of the information can 03 be verified or the inaccuracies in the information corrected. 04 (b) If a person who does business in the state by distributing information about 05 an individual's credit history, score, or ranking releases information about an 06 individual that is inaccurate, the person shall, as quickly as possible after discovering 07 that inaccurate information is being distributed, 08 (1) repair, to the extent possible, the damage to the individual caused 09 by the release of the inaccurate information; and 10 (2) pay fair and reasonable compensation to the individual for the 11 damage caused to the individual by the release of the inaccurate information. 12 (c) If a person fails to comply with (b) of this section, an individual may bring 13 an action in court to compel the person to comply with (b) of this section. 14 (d) In this section, "does business in the state" means engages in activities that 15 provide at least the minimum contacts required by substantive due process for the state 16 to exercise jurisdiction over the person who is engaging in the activities. 17 Article 4. Protection of Social Security Number. 18 Sec. 45.48.400. Use of social security number. (a) A person may not, 19 without the consent of the individual, 20 (1) intentionally communicate or otherwise make available to the 21 general public an individual's social security number; 22 (2) print an individual's social security number on a card required for 23 the individual to access products or services provided by the person; 24 (3) require an individual to transmit the individual's social security 25 number over the Internet unless the Internet connection is secure or the social security 26 number is encrypted; 27 (4) require an individual to use the individual's social security number 28 to access an Internet site unless a password, a unique personal identification number, 29 or another authentication device is also required in order to access the site; 30 (5) print an individual's social security number on materials that are 31 mailed to the individual, unless state or federal law requires the social security number
01 to be on the material; 02 (6) refuse to do business with an individual because the individual 03 does not consent to the receipt by the person of the social security number of the 04 individual, unless the person is expressly required under federal law, in connection 05 with doing business with an individual, to submit the individual's social security 06 number to the federal government. 07 (b) A person may not sell, lease, loan, trade, rent, or otherwise disclose an 08 individual's social security number to a third party for any purpose without the 09 individual's written consent. 10 Sec. 45.48.410. Penalties. (a) A person who knowingly violates 11 AS 45.48.400 is liable to the state for a civil penalty not to exceed $3,000. 12 (b) An individual may bring a civil action in court against a person who 13 knowingly violates AS 45.48.400 and may recover actual damages or $5,000, 14 whichever amount is greater, and court costs and attorney fees allowed by the rules of 15 court. 16 (c) A person who knowingly violates AS 45.48.400 is guilty of a class A 17 misdemeanor. 18 (d) In this section, "knowingly" has the meaning given in AS 11.81.900. 19 Article 5. Disposal of Records. 20 Sec. 45.48.500. Disposal of records. A business shall take, in connection 21 with and after the disposal of the records, all reasonable measures necessary to protect 22 against unauthorized access to or use of the records of the business that contain 23 personal information. 24 Sec. 45.48.510. Measures to protect access. The measures required to be 25 taken under AS 45.48.500 include 26 (1) implementing and monitoring compliance with policies and 27 procedures that require the burning, pulverizing, or shredding of paper documents 28 containing personal information so that the personal information cannot practicably be 29 read or reconstructed; 30 (2) implementing and monitoring compliance with policies and 31 procedures that require the destruction or erasure of electronic media and other
01 nonpaper media containing personal information so that the personal information 02 cannot practicably be read or reconstructed; 03 (3) after due diligence, entering into a written contract with a third 04 party engaged in the business of record destruction to dispose of records containing 05 personal information in a manner consistent with this statute, and monitoring with due 06 diligence the third party's compliance with the contract; 07 (4) implementing and monitoring, with regard to a third party hired 08 under (3) of this section to dispose of records containing personal information, the 09 third party's compliance with policies and procedures that protect against unauthorized 10 access to or use of personal information during or after the collection, transportation, 11 and disposal of the records under (1) and (2) of this section. 12 Sec. 45.48.520. Due diligence. In AS 45.48.510(3), due diligence ordinarily 13 includes performing one or more of the following: 14 (1) reviewing an independent audit of the third party's operations and 15 its compliance with AS 45.48.500 - 45.48.590; 16 (2) obtaining information about the third party from several references 17 or other reliable sources and requiring that the third party be certified by a recognized 18 trade association or similar organization with a reputation for high standards of quality 19 review; 20 (3) reviewing and evaluating the third party's information security 21 policies and procedures, or taking other appropriate measures to determine the 22 competency and integrity of the third party. 23 Sec. 45.48.530. Business policy and procedures. A business shall 24 comprehensively describe and classify as the business's official policy in the writings 25 of the business the policies and procedures that relate to the adequate destruction and 26 proper disposal of personal records. In this section, "writings" includes corporate 27 handbooks, employee handbooks, and similar corporate documents. 28 Sec. 45.48.540. Civil penalty. An individual or a business that knowingly 29 violates AS 45.48.500 - 45.48.590 is liable to the state for a civil penalty not to exceed 30 $3,000. In this section, "knowingly" has the meaning given in AS 11.81.900. 31 Sec. 45.48.550. Civil action. An individual who is damaged by a violation of
01 AS 45.48.500 - 45.48.590 may bring a civil action in court to enjoin further violations 02 and to recover damages for the violation and court costs and attorney fees allowed by 03 the rules of court. 04 Sec. 45.48.590. Definitions. In AS 45.48.500 - 45.48.590, 05 (1) "business" means a person who conducts business in the state or a 06 person who conducts business and maintains or otherwise possesses personal 07 information on state residents; in this paragraph, 08 (A) "conducts business" includes engaging in activities as a 09 financial institution organized, chartered, or holding a license or authorization 10 certificate under the laws of this state, another state, the United States, or 11 another country; 12 (B) "possesses" includes possession for the purpose of 13 destruction; 14 (2) "dispose" means 15 (A) the discarding or abandonment of records containing 16 personal information; 17 (B) the sale, donation, discarding, or transfer of 18 (i) any medium, including computer equipment or 19 computer media, that contains records of personal information; 20 (ii) nonpaper media, other than that identified under (i) 21 of this subparagraph, on which records of personal information are 22 stored; and 23 (iii) equipment for nonpaper storage of information; 24 (3) "personal information" means information that identifies, relates to, 25 describes, or is capable of being associated with a particular individual, and includes a 26 name, signature, social security number, fingerprint, photograph, computerized image, 27 physical characteristic, physical description, address, telephone number, passport 28 number, driver's license, state identification number, date of birth, medical 29 information, bank account number, credit card number, debit card number, and 30 financial information; 31 (4) "records" means material on which information that is written,
01 drawn, spoken, visual, or electromagnetic is recorded or preserved, regardless of 02 physical form or characteristics, but does not include publicly available directories 03 containing names, addresses, telephone numbers, or other information an individual 04 has voluntarily consented to have publicly disseminated or listed. 05 Article 6. General Provisions. 06 Sec. 45.48.900. Relationship to federal law. If a provision of this chapter is 07 preempted by or conflicts with federal law in a particular situation, the provision does 08 not apply to the extent of the preemption or conflict. 09 Sec. 45.48.990. Definitions. In this chapter, unless the context indicates 10 otherwise, 11 (1) "consumer" means an individual; 12 (2) "consumer report" means a written, oral, or other communication 13 of information by a consumer reporting agency bearing on a consumer's credit 14 worthiness, credit standing, credit capacity, character, general reputation, personal 15 characteristics, or mode of living if the communication is used or expected to be used 16 or collected in whole or in part to serve as a factor in establishing the consumer's 17 eligibility for 18 (A) credit or insurance to be used primarily for personal, 19 family, or household purposes; 20 (B) employment purposes; or 21 (C) any other permissible purpose authorized under section 15 22 U.S.C. 1681b; 23 (3) "consumer reporting agency" means a person who, for monetary 24 fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in 25 the practice of assembling or evaluating consumer credit information or other 26 information on consumers for the purpose of furnishing consumer reports to third 27 parties; 28 (4) "person" has the meaning given in AS 01.10.060 and includes a 29 state or local governmental agency, except for an agency of the judicial branch; 30 (5) "state resident" means an individual who satisfies the residency 31 requirements under AS 01.10.055.
01 Sec. 45.48.995. Short title. This chapter may be cited as the Alaska Personal 02 Information Protection Act. 03 * Sec. 2. The uncodified law of the State of Alaska is amended by adding a new section to 04 read: 05 TRANSITION: IMPLEMENTATION. A person to whom AS 45.48.400 and 06 45.48.410, enacted by sec. 1 of this Act, apply shall make reasonable efforts to cooperate, 07 through systems testing and other means, to ensure that the requirements of AS 45.48.400 and 08 45.48.410 are implemented on or before the effective date of AS 45.48.400 and 45.48.410.