AB 2828: Personal information: privacy: breach.
- Session Year: 2015-2016
- House: Assembly
- Latest Version Date: 2016-09-13
Existing law requires a person or business conducting business in California and any agency, as defined, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person in the most expedient time possible and without unreasonable delay, as specified.
This bill would also require a person or business conducting business in California, and any agency, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the data to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person, business, or agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
Existing law requires a person or business conducting business in California and any agency, as defined, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person in the most expedient time possible and without unreasonable delay, as specified.
This bill would also require a person or business conducting business in California, and any agency, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the data to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person, business, or agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
Existing law requires a person or business conducting business in California and any agency, as defined, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person in the most expedient time possible and without unreasonable delay, as specified.
This bill would also require a person or business conducting business in California, and any agency, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the data to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person if the encryption key or security credential, as defined, has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data. and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person, business, or agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
Existing law requires a person or business conducting business in California and any agency, as defined, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person in the most expedient time possible and without unreasonable delay, as specified.
This bill would also require a person or business conducting business in California, and any agency, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the data to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person if the encryption key or security credential, as defined, has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render the data useable, readable, and decipherable.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render data useable, readable, and decipherable.
(l)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render the data useable, readable, and decipherable.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render data useable, readable, and decipherable.
(l)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, if the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data, to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system. the confidential key or process designed to render the data useable, readable, and decipherable.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, if the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data, to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)For purposes of this section, encryption key and security credential mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system. the confidential key or process designed to render data useable, readable, and decipherable.
(l)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. person, or, if the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data, to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. person, or, if the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person at any time before or after the breach of security of the data, to a resident of California whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)For purposes of this section, encryption key and security credential mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system.
(k)
(l)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
|
Date
|
Status
|
|---|---|
| Jun 2, 2016 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Sep 13, 2016 | Chaptered by Secretary of State - Chapter 337, Statutes of 2016. |
| Sep 13, 2016 | Approved by the Governor. |
| Sep 2, 2016 | Enrolled and presented to the Governor at 12 p.m. |
| Aug 24, 2016 | In Assembly. Ordered to Engrossing and Enrolling. |
| Aug 23, 2016 | Read third time. Passed. Ordered to the Assembly. (Ayes 39. Noes 0. Page 5302.). |
| Aug 23, 2016 | Read third time. Passed. Ordered to the Assembly. |
| Aug 15, 2016 | Read second time. Ordered to third reading. |
| Aug 11, 2016 | From committee: Do pass. (Ayes 7. Noes 0.) (August 11). |
| Aug 1, 2016 | In committee: Referred to APPR. suspense file. |
| Jun 22, 2016 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 7. Noes 0.) (June 21). Re-referred to Com. on APPR. |
| Jun 9, 2016 | Referred to Com. on JUD. |
| Feb 19, 2016 | Introduced. To print. |
| Jun 1, 2016 | Read third time. Passed. Ordered to the Senate. (Ayes 79. Noes 1.) |
| Jun 1, 2016 | Read third time. Passed. Ordered to the Senate. (Ayes 79. Noes 1. Page 5110.) |
| Jun 1, 2016 | Read third time. Passed. Ordered to the Senate. |
| May 31, 2016 | Read second time. Ordered to third reading. |
| May 27, 2016 | Read second time and amended. Ordered returned to second reading. |
| May 27, 2016 | From committee: Amend, and do pass as amended. (Ayes 20. Noes 0.) (May 27). |
| Apr 20, 2016 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| Apr 6, 2016 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 10. Noes 0.) (April 5). Re-referred to Com. on APPR. |
| Mar 14, 2016 | Referred to Com. on P. & C.P. |
| Feb 22, 2016 | Read first time. |
| Feb 21, 2016 | From printer. May be heard in committee March 22. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 23, 2016 | Assembly 3rd Reading AB2828 Chau By Leno | Senate Floor |
Passed |
|
| Aug 11, 2016 | Do pass | Senate Standing Committee on Appropriations |
Passed |
|
| Aug 1, 2016 | Placed on suspense file | Senate Standing Committee on Appropriations |
Passed |
|
| Jun 21, 2016 | Do pass, but first be re-referred to the Committee on [Appropriations] | Senate Standing Committee on Judiciary |
Passed |
|
| Jun 1, 2016 | AB 2828 CHAU Assembly Third Reading | Assembly Floor |
Passed |
|
| May 27, 2016 | Do pass as amended. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 5, 2016 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| ACLU | ** Support | Apr 5, 2016 |
| California District Attorneys Association | ** Support | Aug 23, 2016 |
| Consumer Federation Of California | ** Support | Aug 23, 2016 |
| Electronic Frontier Foundation | ** Support | Aug 23, 2016 |
| Privacy Rights Clearinghouse | ** Support | Aug 23, 2016 |
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 2828
:
SENATE JUDICIARY COMMITTEE: 7-0, 6/21/16
AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski
SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/11/16
AYES: Lara, Bates, Beall, Hill, McGuire, Mendoza, Nielsen
ASSEMBLY FLOOR: 79-1, 6/1/16 - See last page for vote
DIGEST: This bill requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, if the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the entity that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
Existing law:
- Requires, pursuant to the data breach notification law, any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
- Requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
- Defines “personal information” to include either a user name or email address, in combination with a password or security question and answer that would permit access to an online account, or the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California identification card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; health insurance information; or information or data collected through the use or operation of an automated license plate recognition system. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)
This bill:
- Requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency, person, or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
- Defines “encryption key” and “security credential” to mean the confidential key or process designed to render the data useable, readable, and decipherable.
Background
In 2003, California’s first-in-the-nation security breach notification law went into effect. (See Civ. Code Secs. 1798.29(a), 1798.82(a).) Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s breach notification statute requires state agencies, local agencies, and businesses to notify residents when the security of their computerized personal information is breached. Existing law requires breach notifications to be made in the most expedient time possible without unreasonable delay, and specifies certain information that must be included in these notices. This breach notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.
California’s requirement to notify affected individuals of a data breach has had the effect of highlighting data insecurity as a matter for public concern, and has motivated businesses and agencies to invest additional resources toward securing data stored within their computer networks. However, despite the data breach notification law’s positive impact, data breaches have increased in frequency and magnitude since the law took effect. The Attorney General’s most recent report on California data breaches offers the following summary:
In the past four years, the Attorney General has received reports on 657 data breaches, affecting a total of over 49 million records of Californians. In 2012, there were 131 breaches, involving 2.6 million records of Californians; in 2015, 178 breaches put over 24 million records at risk. This means that nearly three in five Californians were victims of a data breach in 2015 alone. (California Department of Justice, California Data Breach Report 2012-2015 (Feb. 2016) <https://oag.ca.gov/ breachreport2016 [as of Apr. 1, 2016].)
Unfortunately, victims of data breach are much more likely to become victims of fraud and identity theft. The Attorney General’s data breach report notes that “[i]n 2014, 67 percent of breach victims in the U.S. were also victims of fraud, compared to just 25 percent of all consumers.” (Id. [citations omitted].)
When the Legislature enacted SB 1386 (Peace, Chapter 915, Statutes of 2002) and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the protections offered by encryption are significantly compromised when encrypted data is acquired along with an encryption key that can be used to decrypt the data.
This bill requires agencies, persons, and businesses to disclose the breach of the security of a system containing encrypted personal information when the encryption key or security credential that could render that personal information readable or useable is also compromised in the breach.
Comments
The author writes:
In February 2015, criminals accessed personal information, including names, addresses, birthdates, and Social Security numbers, of more than 80 million United States patients covered by one of the country’s largest health insurance and health plan providers. The incident was the biggest theft of health care data in history. The data was not encrypted, which is what triggered a breach notice to the 80 million victims under current state and federal laws. Current law requires notice, so that victims can take steps to protect themselves from fraud and identity theft before the data is used or sold by the hackers.
However, even if encryption had been used, the data could have still been compromised, because the hackers gained access to at least five sets of employee credentials, which could have unlocked any encryption. Encryption is an important tool to secure sensitive data in transit and at rest, but if the credentials and keys to unlock the data are stolen before, during or after a hacking incident, then the stolen data is as good as decrypted.
AB 2828 updates California’s breach notice law to require businesses and government agencies to provide notice of a breach if both encrypted data and the keys to the encryption are believed to have been breached. AB 2828’s expansion of the breach notice requirement reflects what has become an industry best practice since the original passage of the breach notice law more than a decade ago. Specifically, AB 2828 requires businesses and government agencies to provide a notice to affected consumers in the event of a data breach where encrypted Personally Identifiable Information (PII) is disclosed, if there is a reasonable belief that encryption keys or security credentials were also compromised and could render the PII readable or useable.
Related/Prior Legislation
SB 1444 (Hertzberg, 2016) requires state agencies that own or license computerized data that includes personal information to prepare a security plan that details the agency’s strategy to respond to a security breach of that information and its associated consequences. The bill lists certain minimum requirements to be included in an agency’s security plan, including a requirement to inventory personal information stored or transmitted by the agency and procedures for facilitating communication between an incident response team, agency officials, and individuals affected by a breach. The bill is in engrossing and enrolling.
AB 259 (Dababneh, 2015) requires an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. The bill was held in the Senate Appropriations Committee.
SB 570 (Jackson, Chapter 543, Statutes of 2015) modified existing data breach notification requirements for agencies and persons or businesses conducting business in California that own or license computerized data that includes personal information. Specifically, the bill requires these entities, in the event of a data breach, to provide affected individuals with a notice entitled “Notice of Data Breach,” in which required content is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” The bill states that additional information may be provided to supplement the required notice, and provides a model security breach notification form that entities may use to comply with formatting requirements. The bill also clarified the requirements for providing substitute notice of a data breach, and made other technical and clarifying changes to the data breach notification law.
AB 964 (Chau, Chapter 522, Statutes of 2015) defined “encrypted” as used in California’s data breach notification law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
AB 1710 (Dickinson, Chapter 855, Statutes of 2014) amended California’s data breach notification law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. AB 1710 also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett, Chapter 396, Statutes of 2013) revised the data elements included within the definition of personal information under California’s data breach notification law by adding certain information that would permit access to an online account, and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1950 (Wiggins, Chapter 877, Statutes of 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect that personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace, Chapter 915, Statutes of 2002) enacted California’s data breach notification law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
According to the Senate Appropriations Committee, this bill would result in potential minor to moderate future increases in administrative costs (General Fund) statewide across all state agencies for additional data breach notifications, as well as potential future increases in non-reimbursable local costs (Local Funds) for the issuance of additional data breach notices to consumers.
American Civil Liberties Union
California District Attorneys Association
Consumer Federation of California
Electronic Frontier Foundation
Privacy Rights Clearinghouse
OPPOSITION: (Verified 8/12/16)
None received
AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Rendon
NOES: Harper
Prepared by: Tobias Halvarson / JUD. / (916) 651-4113
8/15/16 20:30:06
**** END ****
SENATE COMMITTEE ON
Senator Ricardo Lara, Chair
2015 - 2016 Regular Session
AB 2828 (Chau) – Personal information: privacy: breach
Version: | Policy Vote: |
Urgency: | Mandate: |
Hearing Date: | Consultant: |
This bill meets the criteria for referral to the Suspense File.
Bill Summary:
AB 2828 would expand the data breach notification law to include the breach of encrypted information if the encryption key or security credential, as defined, has also been compromised, as specified.
Fiscal Impact:
- State agencies: Potential minor to moderate future increase in administrative costs (General Fund) statewide across all agencies for additional data breach notifications. Various departments have indicated minor impacts to comply with the expanded data breach standards, however, to the extent a large agency does not currently have a process to respond to this type of data breach, there could be potential costs to comply with the bill’s requirements. Staff notes to the extent many agencies would issue data breach notifications in the absence of this measure, this bill largely serves to codify existing practices.
- Local agencies: Potential future increase in non-reimbursable local costs (Local Funds) for the issuance of additional data breach notices to consumers.
Background:
Existing law, the data breach notification law, requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civil Code §§ 1798.29(a),(c) and 1798.82(a), (c).)
When the Legislature enacted SB 1386 (Peace) Chapter 915/2002 and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the protections offered by encryption are significantly compromised when encrypted data is acquired along with an encryption key that can be used to decrypt the data.
This bill would require agencies, persons, and businesses to disclose the breach of the security of a system containing encrypted personal information when the encryption key or security credential that could render that personal information readable or useable is also compromised in the breach.
Proposed Law:
This bill would require any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency, person, or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
This bill would define “encryption key” and “security credential” to mean the confidential key or process designed to render the data useable, readable, and decipherable.
Related Legislation:
SB 1444 (Hertzberg) 2016 would require state agencies that own or license computerized data that includes personal information to prepare a security plan that details the agency’s strategy to respond to a security breach of that information and its associated consequences. This bill is pending hearing in the Assembly Committee on Privacy and Consumer Protection.
AB 259 (Dababneh) 2015 would require an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. The bill was held on the Suspense File of this Committee.
Prior Legislation: SB 570 (Jackson) Chapter 543/2015 modified existing data breach notification requirements for agencies and persons or businesses conducting business in California that own or license computerized data that includes personal information. This bill also clarified the requirements for providing substitute notice of a data breach, and made other technical and clarifying changes to the data breach notification law.
AB 964 (Chau) Chapter 522/2015 defined “encrypted” as used in California’s data breach notification law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
AB 1710 (Dickinson) Chapter 855/2014 amended California’s data breach notification law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. This bill also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett) Chapter 396/2013 revised the data elements included within the definition of personal information under California’s data breach notification law by adding certain information that would permit access to an online account and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1950 (Wiggins) Chapter 877/2004 required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect that personal information from unauthorized access, destruction, use, modification, or disclosure.
SB 1386 (Peace) Chapter 915/2002 enacted California’s data breach notification law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Staff Comments:
Various departments, including the Department of Motor Vehicles, have indicated minor costs resulting from the expanded application of the data breach notification law required by this measure. Staff notes to the extent many agencies would issue data breach notifications in the absence of this measure, this bill largely serves to codify existing practices.
The DOJ has indicated the fiscal impact of this bill on the agency would be unknown, but potentially substantial. The DOJ would need to determine the source of the breach and those impacted, and subsequently take the necessary steps to notify. In addition, there would likely be a large volume of inquiries from the public and law enforcement agencies to process. Thus, the fiscal impact of this measure on the DOJ is potentially significant but unquantifiable.
-- END --
Senator Hannah-Beth Jackson, Chair
2015-2016 Regular Session
Bill No: AB 2828 (Author:Chau)
Version: May 27, 2016
Hearing Date: June 21, 2016
Fiscal: Yes
Urgency: No
Consultant: TH
SUBJECT
Personal Information: Privacy: Breach
DESCRIPTION
This bill would require any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, if the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the entity that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
BACKGROUND
In 2003, California’s first-in-the-nation security breach notification law went into effect. (See Civ. Code Secs. 1798.29(a), 1798.82(a).) Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s breach notification statute requires state agencies, local agencies, and businesses to notify residents when the security of their computerized personal information is breached. Existing law requires breach notifications to be made in the most expedient time possible without unreasonable delay, and specifies certain information that must be included in these notices. This breach notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.
California’s requirement to notify affected individuals of a data breach has had the effect of highlighting data insecurity as a matter for public concern, and has motivated businesses and agencies to invest additional resources toward securing data stored within their computer networks. However, despite the data breach notification law’s positive impact, data breaches have increased in frequency and magnitude since the law took effect. The Attorney General’s most recent report on California data breaches offers the following summary:
In the past four years, the Attorney General has received reports on 657 data breaches, affecting a total of over 49 million records of Californians. In 2012, there were 131 breaches, involving 2.6 million records of Californians; in 2015, 178 breaches put over 24 million records at risk. This means that nearly three in five Californians were victims of a data breach in 2015 alone. (California Department of Justice, California Data Breach Report 2012-2015 (Feb. 2016) <https://oag.ca.gov/ breachreport2016> [as of Apr. 1, 2016].)
Unfortunately, victims of data breach are much more likely to become victims of fraud and identity theft. The Attorney General’s data breach report notes that “[i]n 2014, 67 percent of breach victims in the U.S. were also victims of fraud, compared to just 25 percent of all consumers.” (Id. [citations omitted].)
When the Legislature enacted SB 1386 (Peace, Ch. 915, Stats. 2002) and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the protections offered by encryption are significantly compromised when encrypted data is acquired along with an encryption key that can be used to decrypt the data.
This bill would require agencies, persons, and businesses to disclose the breach of the security of a system containing encrypted personal information when the encryption key or security credential that could render that personal information readable or useable is also compromised in the breach.
CHANGES TO EXISTING LAW
Existing law, the data breach notification law, requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
Existing law requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
Existing law defines “personal information” to include either a user name or email address, in combination with a password or security question and answer that would permit access to an online account, or the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California identification card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; health insurance information; or information or data collected through the use or operation of an automated license plate recognition system. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)
This bill would require any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency, person, or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
This bill would define “encryption key” and “security credential” to mean the confidential key or process designed to render the data useable, readable, and decipherable.
COMMENT
- Stated need for the bill
The author writes:
In February 2015, criminals accessed personal information, including names, addresses, birthdates, and Social Security numbers, of more than 80 million United States patients covered by one of the country’s largest health insurance and health plan providers. The incident was the biggest theft of health care data in history. The data was not encrypted, which is what triggered a breach notice to the 80 million victims under current state and federal laws. Current law requires notice, so that victims can take steps to protect themselves from fraud and identity theft before the data is used or sold by the hackers.
However, even if encryption had been used, the data could have still been compromised, because the hackers gained access to at least five sets of employee credentials, which could have unlocked any encryption. Encryption is an important tool to secure sensitive data in transit and at rest, but if the credentials and keys to unlock the data are stolen before, during or after a hacking incident, then the stolen data is as good as decrypted.
AB 2828 updates California’s breach notice law to require businesses and government agencies to provide notice of a breach if both encrypted data and the keys to the encryption are believed to have been breached. AB 2828’s expansion of the breach notice requirement reflects what has become an industry best practice since the original passage of the breach notice law more than a decade ago. Specifically, AB 2828 requires businesses and government agencies to provide a notice to affected consumers in the event of a data breach where encrypted Personally Identifiable Information (PII) is disclosed, if there is a reasonable belief that encryption keys or security credentials were also compromised and could render the PII readable or useable.
- Right to Privacy
California recognizes that the right to privacy is a fundamental right, and has enshrined that right along with other fundamental rights in article I, section 1 of the California Constitution. The harm that can result from the theft of personal information via a data breach threatens to undermine that fundamental right. Unfortunately, because of the size of its economy and the number of consumers, the data held by California businesses and government agencies is frequently targeted by cyber criminals. The frequency of data breaches in California and the threat that such breaches pose to California residents makes timely and effective notification of a breach a matter of critical importance.
However, notification of data breaches involving encrypted personal information has not traditionally raised the same policy concerns. This is because properly encrypted data is much less valuable to whomever acquires it, since the encryption functionally obscures the underlying data. Indeed, “[m]any security experts insist that there ought to be a carve-out that would allow companies to avoid disclosure requirements in a breach that exposes properly encrypted sensitive data.” (Brian Krebs, Toward Better Privacy, Data Breach Laws <http://krebsonsecurity.com/2015/01/toward-better-privacy-data-breach-laws/> [as of Jun. 7, 2016].) California’s data breach notification law has such an exception, stating that notice of a breach must be made when “unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
- Security of Encryption Keys
Modern encryption technology works by encoding information in such a way that only the person (or computer) with the encryption key can decode it. In general, each computer exchanging encrypted information has a secret key (code) that it can use to encrypt a packet of information before it is sent over a network to another computer, where it is then decrypted using the same or a mathematically related key. Maintaining the secrecy of an encryption key is what ensures compromised encrypted messages cannot be read by an unauthorized person.
California’s data breach notification law contains a safe harbor for businesses and agencies that lose encrypted information in a data breach. However, recent data breaches have revealed instances where encrypted information was breached along with the encryption key. For example, the ride-hailing company Uber reported in late 2014 that “[t]housands of Uber driver names and driver’s license numbers may be in the hands of an unauthorized third party due to a data breach,” and that “one of its many databases could have potentially been accessed because one of the encryption keys required to unlock it had been compromised.” (Tracey Lien, Uber Security Breach May Have Affected up to 50,000 Drivers, Los Angeles Times (Feb. 27, 2015) <http://www.latimes.com/business/technology/la-fi-tn-uber-data-breach-20150227-story.html> [as of Jun. 7, 2016].) In breaches such as this where an encryption key is taken along with encrypted information, the compromised information has lost the effectiveness of its encryption protection.
This bill addresses the problem of data breaches that result in the compromise of encryption keys. It would require agencies, persons, and businesses to disclose the breach of the security of a system containing encrypted personal information when the encryption key or security credential that could render the encrypted information readable or useable is also compromised in the breach. By doing so, this bill closes an unintentional gap in California’s data breach notification law that allows the safe harbor for encrypted data to remain in effect even though the protection offered by that encryption has been severely compromised. This change to the law ensures that victims of data breaches are timely notified when encrypted personal information is taken in those cases where that encrypted information can easily be rendered useable or readable, thereby making it likely that personal information could be exposed.
Support: American Civil Liberties Union; California District Attorneys Association; Consumer Federation of California; Electronic Frontier Foundation; Privacy Rights Clearinghouse
Opposition: None Known
HISTORY
Source: Author
Related Pending Legislation:
SB 1444 (Hertzberg, 2016) requires state agencies that own or license computerized data that includes personal information to prepare a security plan that details the agency’s strategy to respond to a security breach of that information and its associated consequences. This bill lists certain minimum requirements to be included in an agency’s security plan, including a requirement to inventory personal information stored or transmitted by the agency and procedures for facilitating communication between an incident response team, agency officials, and individuals affected by a breach. This bill is pending in the Assembly Committee on Privacy and Consumer Protection.
AB 259 (Dababneh, 2015) requires an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. The bill was held in the Senate Appropriations Committee.
Prior Legislation:
SB 570 (Jackson, Ch. 543, Stats. 2015) modified existing data breach notification requirements for agencies and persons or businesses conducting business in California that own or license computerized data that includes personal information. Specifically, this bill requires these entities, in the event of a data breach, to provide affected individuals with a notice entitled “Notice of Data Breach,” in which required content is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” This bill states that additional information may be provided to supplement the required notice, and provides a model security breach notification form that entities may use to comply with formatting requirements. This bill also clarified the requirements for providing substitute notice of a data breach, and made other technical and clarifying changes to the data breach notification law.
AB 964 (Chau, Ch. 522, Stats. 2015) defined “encrypted” as used in California’s data breach notification law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
AB 1710 (Dickinson, Ch. 855, Stats. 2014) amended California’s data breach notification law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. AB 1710 also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett, Ch. 396, Stats. 2013) revised the data elements included within the definition of personal information under California’s data breach notification law by adding certain information that would permit access to an online account, and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1950 (Wiggins, Ch. 877, Stats. 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect that personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace, Ch. 915, Stats. 2002) enacted California’s data breach notification law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
Prior Vote:
Assembly Floor (Ayes 79, Noes 1)
Assembly Appropriations Committee (Ayes 20, Noes 0)
Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 0)
**************
ASSEMBLY THIRD READING
ATR Bill Id:AB 2828
Author:()
As Amended Ver:
Majority vote
Committee | Votes | Ayes | Noes |
Privacy | 10-0 | Chau, Wilk, Baker, Calderon, Cooper, Dababneh, Gatto, Gordon, Low, Olsen | |
Appropriations | 20-0 | Gonzalez, Bigelow, Bloom, Bonilla, Bonta, Calderon, Chang, Daly, Eggman, Gallagher, Eduardo Garcia, Roger Hernández, Holden, Jones, Obernolte, Quirk, Santiago, Wagner, Weber, Wood |
|
SUMMARY: Expands data breach notification law, which currently requires consumer notice for compromised unencrypted personal information, to include encrypted information if the encryption keys have also been compromised. Specifically, this bill:
- Requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the person, business, or agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.
- Defines "encryption key" and "security credential" to mean the confidential key or process designed to render the data useable, readable, and decipherable.
FISCAL EFFECT:
According to the Assembly Appropriations Committee, "Requiring notification of encrypted personal information, when an encryption key or security credential is obtained by an unauthorized person, will likely increase to some extent the number of notifications required of state agencies. While the cost of these notifications is unknown, it is possible these costs could exceed $150,000 for one or more agencies in a fiscal year. The most recent amendments reduce the likelihood that a state agency would experience such high costs, however."
COMMENTS:
- Purpose of this bill. This bill is intended to better inform likely data breach victims by requiring businesses and government agencies to provide a notice of breach in cases where both encrypted Personally Identifiable Information (PII) and the encryption keys or security credentials that can unlock the encrypted PII are believed to have been compromised. Current law only requires notice if unencrypted data is breached. This measure is author-sponsored.
- Recent data breaches in California. According to a February 2016 report by Attorney General Kamala Harris, the number of data breaches between 2012 and 2015 grew from 131 breach incidents in 2012 to 178 incidents in 2015. Even more dramatic is the number of records breached during the same time period, which rose from 2.6 million in 2012 to 24 million records containing sensitive personal information in 2015 ("California Data Breach Report 2012-2015," California Department of Justice, February 2016). In February 2015, criminals accessed personal information, including names, addresses, birthdates, and Social Security numbers of more than 80 million United States patients covered by Anthem, one of the country's largest health insurance and health plan providers. The incident was the single biggest theft of health care data in U.S. history. Anthem's data was not encrypted, which is what triggered a breach notice to the 80 million victims under current state and federal laws.
During 2012-2014, the following California public agencies reported breaches: California State University, Department of Corrections and Rehabilitation, Department of Public Health, Department of State Hospitals, Correctional Health Care Services, Department of Social Services, Department of Justice, Department of Child Support Services, Employment Development Department, and the Department of Motor Vehicles.
- Requiring notice of encrypted data. State law currently requires notice of a security breach only if the data is unencrypted under the premise that: 1) the law provides an incentive to government and business to encrypt sensitive data; and 2) the law triggers notice only when there is a reasonable possibility of fraud or identity theft, so that victims can take steps to protect themselves before criminals use the data. This bill requires notice of breach in cases where the data is in fact encrypted, but notice is only required if the key or security credential that can unlock the data is also reasonably believed to have been compromised.
Interestingly, the hacked data in the 2015 Anthem breach was unencrypted, but even if Anthem had encrypted the data, it still would have been easily accessible. The Anthem hackers also gained access to at least five sets of employee security credentials, which could have unlocked the encryption – meaning that the data would likely have been lost anyway.
- California's Data Breach Notification Law. California law requires businesses as well as state and local agencies that experience a breach of unencrypted personal information to send a notice of the breach to the people affected by the breach. The breach notice must include basic information about what happened, what information was breached, what the business or agency is doing in response to the breach, and what the person affected by the breach can do to protect themselves from fraud and identity theft.
Under current law, a business or agency that experiences a breach can avoid mailing the breach notice to each and every affected customer if doing so would cost more than $250,000.
The Data Breach Notification Law has two distinct parts: one part that applies to state and local agencies, which is located in the Information Practices Act of 1977 (Civil Code 1798.29), and one part that applies to businesses (Civil Code 1798.82).
This bill would change both laws, so that both the public sector and the private sector would have a duty to provide notice of breach to affected customers if both the encrypted data and the encryption key that unlocks it are compromised.
Analysis Prepared by: Jennie Bretschneider / P. & C.P. / (916) 319-2200 FN: 0003327
Date of Hearing: April 20, 2016
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Lorena Gonzalez, Chair
ABPCA Bill Id:AB 2828
Author:(Chau) – As Introduced Ver:February 19, 2016
Policy Committee: | Privacy and Consumer Protection | Vote: | 10 - 0 |
|
|
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill expands data breach notification law, which currently requires consumer notice for compromised unencrypted personal information, to include encrypted information if the encryption keys have also been compromised. Specifically, this bill:
- Requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, if at any time before or after the breach the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person.
- Defines “encryption key” and “security credential” to mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system.
FISCAL EFFECT:
Requiring notification of encrypted personal information, when an encryption key or security credential is obtained by an unauthorized person, will likely increase to some extent the number of notifications required of state agencies. While the cost of these notifications is unknown, it is possible these costs could exceed $150,000 for one or more agencies in a fiscal year.
COMMENTS:
- Purpose. According to the author's office, “AB 2828 updates California’s breach notice law to require businesses and government agencies to provide notice of a breach if both encrypted data and the keys to the encryption are believed to have been breached. This expansion of the breach notice requirement reflects what has become an industry best practice since the original passage of the breach notice law more than a decade ago.”
- Background. California law requires businesses as well as state and local agencies that experience a breach of unencrypted personal information to send a notice of the breach to those affected by the breach. The breach notice must include basic information about what happened, what information was breached, what the business or agency is doing in response to the breach, and what the person affected by the breach can do to protect themselves from fraud and identity theft.
A business or agency that experiences a breach can avoid mailing the breach notice to each and every affected customer if doing so would cost more than $250,000. In this case, the law permits “substitute notice” which must include: emailing the notice to affected customers (if an email address is available); posting the notice on the business’s website, and notifying major statewide media and the Office of Information Security within the Department of Technology.
The current data breach notice law does not require notice when encrypted information is lost. This creates an incentive for businesses and government agencies to encrypt personal data and thereby avoid the notice requirement.
Analysis Prepared by: Chuck Nicol / APPR. / (916) 319-2081
Date of Hearing: April 5, 2016
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
ABPCA Bill Id:AB 2828 (
Author:Chau) – As Introduced Ver:February 19, 2016
SUBJECT: Personal information: privacy: breach
SUMMARY: Expands data breach notification law, which currently requires consumer notice for compromised unencrypted personal information, to include encrypted information if the encryption keys have also been compromised. Specifically, this bill:
- Requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, if at any time before or after the breach the encryption key or security credential has, or is reasonably believed to have been, acquired by an unauthorized person.
- Defines “encryption key” and “security credential” to mean any information that could be used by an unauthorized person to access or decrypt encrypted personal information contained in a data system.
EXISTING LAW:
- Requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. This requirement does not apply to the Judiciary, the Legislature, or the University of California. (Civil Code (CC) Sections 1798.29(a), (c); 1798.82(a), (c))
- Requires a public agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (CC 1798.29(b), 1798.82(b))
- Requires a person or business that is the source of a breach of Social Security numbers or driver’s license numbers, and is required to provide notice of the breach, to offer an identity theft protection or mitigation service to affected individuals at no cost, for no less than 12 months. (CC 1798.82 (d)(2)(G))
- Defines “personal information,” for purposes of the breach notification statute, to include the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (CC 1798.29(g), (h), 1798.82(h), (i))
FISCAL EFFECT:
Unknown
COMMENTS:
- Purpose of this bill. This bill is intended to better inform likely data breach victims by requiring businesses and government agencies to provide a notice of breach in cases where both encrypted Personally Identifiable Information (PII) and the encryption keys or security credentials that can unlock the encrypted PII are believed to have been compromised. Current law only requires notice if unencrypted data is breached. This measure is author-sponsored.
- Author’s statement. According to the author's office, “AB 2828 updates California’s breach notice law to require businesses and government agencies to provide notice of a breach if both encrypted data and the keys to the encryption are believed to have been breached. This expansion of the breach notice requirement reflects what has become an industry best practice since the original passage of the breach notice law more than a decade ago.”
- Recent data breaches in California. Unfortunately, the incidence and sophistication of data breaches is growing year to year. According to a February 2016 report by Attorney General Kamala Harris, the number of data breaches between 2012 and 2015 grew from 131 breach incidents in 2012 to 178 incidents in 2015. Even more dramatic is the number of records breached during the same time period, which rose from 2.6 million in 2012 to 24 million records containing sensitive personal information in 2015 (“California Data Breach Report 2012-2015,” California Department of Justice, February 2016).
Data breaches are also becoming increasingly sophisticated. Hackers are constantly looking for new and innovative ways to penetrate networks, such as gaining access to encryption keys or security credentials, in order to access encrypted data. As a result, security experts contend that encryption, by itself, cannot thwart criminals if the hack involves gaining access to security credentials as well.
In February 2015, criminals accessed personal information, including names, addresses, birthdates, and Social Security numbers of more than 80 million United States patients covered by Anthem, one of the country’s largest health insurance and health plan providers. The incident was the single biggest theft of health care data in history. Anthem’s data was not encrypted, which is what triggered a breach notice to the 80 million victims under current state and federal laws.
Unfortunately, state and local agencies are not immune to data breaches. During 2012-2014, the following California public agencies reported breaches: California State University, Department of Corrections and Rehabilitation, Department of Public Health, Department of State Hospitals, Correctional Health Care Services, Department of Social Services, Department of Justice, Department of Child Support Services, Employment Development Department, and the Department of Motor Vehicles.
- Requiring notice of encrypted data. State law currently requires notice of a security breach only if the data is unencrypted under the premise that: 1) the law provides an incentive to government and business to encrypt sensitive data; and 2) the law triggers notice only when there is a reasonable possibility of fraud or identity theft, so that victims can take steps to protect themselves before criminals use the data. This bill requires notice of breach in cases where the data is in fact encrypted, but only if the encryption key or security credentials are also reasonably believed to have been compromised.
Interestingly, the hacked data in the 2015 Anthem breach was unencrypted, but even if Anthem had encrypted the data, it still would have been easily accessible. The Anthem hackers also gained access to at least five sets of employee security credentials, which could have unlocked the encryption – meaning that the data would likely have been lost anyway.
The author contends that while encryption is an important tool to secure sensitive data, if the keys that unlock the data are stolen in conjunction with a hacking incident, then the stolen data is as good as decrypted. In that case, the business or government agency should be required by law to provide notice of the breach.
- California's Data Breach Notification Law. California law requires businesses as well as state and local agencies that experience a breach of unencrypted personal information to send a notice of the breach to the people affected by the breach. The breach notice must include basic information about what happened, what information was breached, what the business or agency is doing in response to the breach, and what the person affected by the breach can do to protect themselves from fraud and identity theft.
Under current law, a business or agency that experiences a breach can avoid mailing the breach notice to each and every affected customer if doing so would cost more than $250,000. In this case, the law permits “substitute notice” which must include: emailing the notice to affected customers (if an email address is available); posting the notice on the business’s website, and notifying major statewide media and the Office of Information Security within the Department of Technology.
California's current data breach notice law does not require notice when encrypted information is lost. This creates an incentive for businesses and government agencies to encrypt personal data and thereby avoid the notice requirement. Breach notice is also not required unless the data breach involved "personal information" relating to a California resident. "Personal information" means a person’s first name or first initial and last name in combination with one or more of the following data elements:
- Social Security number;
- Driver’s license number or California identification card number;
- Account number, credit or debit card number, in combination with any required security code, access code, or password;
- Medical information; health insurance information;
- Information or data collected through the use of operation of an automated license plate recognition system; or
- A user name or email address in combination with a password or security question and answer that would permit access to an online account.
"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
The Data Breach Notification Law has two distinct parts: one part that applies to state and local agencies, which is located in the Information Practices Act of 1977 (Civil Code 1798.29), and one part that applies to businesses (Civil Code 1798.82).
This bill would change both laws, so that both the public sector and the private sector would have a duty to provide notice of breach to affected customers if both the encrypted data and the encryption key that unlocks it are compromised.
The author and the Committee may wish to consider whether the bill should exempt situations where only the encryption key is hacked or stolen, but not the data itself. For example, if only the encryption key is stolen and the business or government agency changes its encryption as a result – essentially changing the locks on its doors – then this bill arguably should not require notice of breach if the encrypted data is later breached since the stolen key no longer unlocks the encrypted data.
- Arguments in support. Consumer Federation of California states in support that, “Access to sensitive data files, as well as security credentials, by unauthorized persons is increasingly common. AB 2828 is a common sense update that recognizes this unfortunate reality. Providing consumers with data breach notifications will allow them to take steps to correct the injuries caused by the breach and guard against future identity theft.”
Electronic Frontier Foundation states, “AB 2828 would fill an important gap in California’s current data breach notification law. A thief might steal an encrypted laptop, along with a note carelessly taped to the device stating the decryption password. Or a thief might remotely steal encrypted data, and later use social engineering to acquire the security credentials. In these and many other circumstances, wrongdoers will acquire both encrypted personal information and the power to decrypt that information. In such circumstances, people should be notified that they are at risk of wrongdoers misusing their personal information.”
- Prior Legislation. AB 964 (Chau), Chapter 522, Statutes of 2015, defined the word "encrypted" as used in California's Data Breach Notification Law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
SB 570 (Jackson), Chapter 543, Statutes of 2015, modified the existing data breach notification requirement for agencies and persons or businesses conducting business in California that own or license computerized data that includes personal information.
SB 46 (Corbett), Chapter 396, Statutes of 2013, revised certain data elements included within the definition of personal information under California’s Data Breach Notification Law, by adding certain information that would permit access to an online account and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
SB 24 (Simitian), Chapter 197, Statutes of 2011, required any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
SB 1386 (Peace), Chapter 915, Statutes of 2002, enacted California’s Data Breach Notification Law and required a public agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
REGISTERED SUPPORT / OPPOSITION:
Support
ACLU
Consumer Federation of California
Electronic Frontier Foundation
Privacy Rights Clearinghouse
Opposition
None on file.
Analysis Prepared by: Jennie Bretschneider / P. & C.P. / (916) 319-2200
Discussed in Hearing
3MIN
Senate Floor
10MIN
Senate Standing Committee on Judiciary
1MIN
Assembly Floor
6MIN
Assembly Standing Committee on Privacy and Consumer Protection
Bill Author
Bill Co-Author(s):