Prohibits state agencies from storing payment credentials on state data systems.

Requires state agencies that currently store payment credentials to work with the office of the chief information officer to eliminate the data from state data systems.

Requires the office of the chief information officer to develop a policy for minimizing the retention of social security numbers and other sensitive, personally identifiable information by state agencies when not required for the day-to-day operations of an agency or by law.