AB 739: Civil law: liability: communication of cyber security-threat information.
- Session Year: 2015-2016
- House: Assembly
- Latest Version Date: 2015-05-01
Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose, as specified, a breach of the security of the system or data following discovery or notification of the security breach to any California resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, unless the information was encrypted. Existing law also requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, as specified.
This bill would, until January 1, 2020, provide that there shall be no civil or criminal liability for, and no cause of action shall arise against, an lie or be maintained against any private entity based upon its communication of cyber security-threat information to another private entity, or to a state law enforcement agency. for the sharing or receiving of cyber security-threat information if the sharing or receiving is conducted, as specified. The immunity from liability would only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made to address a vulnerability in, or to prevent a threat to the integrity, confidentiality, or availability of, a system, network, or critical infrastructure component of a public or private entity, to provide support for cyber security crime investigation, or to protect individuals, entities, or the state from harm, gross negligence, as specified. The bill would also prohibit a private entity that communicates is engaged in sharing or receiving cyber security-threat information from using that information to gain an unfair competitive advantage and require that it, in good faith, make reasonable efforts to safeguard communications, comply with any lawful restriction placed on the communication, transfer the cyber security-threat information as expediently as possible while upholding reasonable protections, and ensure that appropriate anonymization and minimization of the information contained in the communication, as specified.
This bill would specify that a communication of cyber security-threat information made in compliance with this section and shared with a public agency is confidential and shall not be disclosed under the California Public Records Act.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose, as specified, a breach of the security of the system or data following discovery or notification of the security breach to any California resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, unless the information was encrypted. Existing law also requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, as specified.
This bill would require the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, as defined. The bill would also would, until January 1, 2020, provide that there shall be no civil or criminal liability for, and no cause of action shall arise against, a registered an entity based upon its communication of cyber security-threat information to another private entity, or to a state entity. law enforcement agency. The immunity from liability would only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made to address a vulnerability in, or to prevent a threat to the integrity, confidentiality, or availability of, a system, network, or critical infrastructure component of a public or private entity, to provide support for cyber security crime investigation, or to protect individuals individuals, entities, or the state from harm, as specified. The bill would also prohibit a private entity that communicates cyber security-threat information from using that information to gain an unfair competitive advantage and require that it it, in good faith, make reasonable efforts to safeguard communications, comply with any lawful restriction placed on the communication, and transfer the cyber security-threat information as expediently as possible while upholding reasonable protections, and ensure that appropriate anonymization and minimization of the information contained in the communication, as specified.
The bill would also require the Attorney General to submit an annual report to the Legislature regarding the operation of these provisions that includes an assessment of the impact of these provisions on the privacy of the personal information of California residents.
This bill would specify that a communication of cyber security-threat information made in compliance with this section and shared with a public agency is confidential and shall not be disclosed under the California Public Records Act.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose, as specified, a breach of the security of the system or data following discovery or notification of the security breach to any California resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, unless the information was encrypted. Existing law also requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, as specified.
This bill would require the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, as defined. The bill would also provide that there shall be no civil or criminal liability for, and no cause of action shall arise against, a registered entity based upon its communication of cyber security-threat information to another private entity, or to a state entity. The immunity from liability would only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made to address a vulnerability in, or to prevent a threat to the integrity, confidentiality, or availability of, a system, network, or critical infrastructure component of a public or private entity, to provide support for cyber security crime investigation, or to protect individuals or the state from harm, as specified. The bill would also prohibit a private entity that communicates cyber security-threat information from using that information to gain an unfair competitive advantage and require that it make reasonable efforts to safeguard communications, comply with any lawful restriction placed on the communication, and transfer the cyber security-threat information as expediently as possible while upholding reasonable protections, as specified.
The bill would also require the Attorney General to submit an annual report to the Legislature regarding the operation of these provisions that includes an assessment of the impact of these provisions on the privacy of the personal information of California residents.
Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose, as specified, a breach of the security of the system or data following discovery or notification of the security breach to any California resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, unless the information was encrypted. Existing law also requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, as specified.
This bill would make a nonsubstantive change to those provisions. require the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, as defined. The bill would also provide that there shall be no civil or criminal liability for, and no cause of action shall arise against, a registered entity based upon its communication of cyber security-threat information to another private entity, or to a state entity. The immunity from liability would only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made to address a vulnerability in, or to prevent a threat to the integrity, confidentiality, or availability of, a system, network, or critical infrastructure component of a public or private entity, to provide support for cyber security crime investigation, or to protect individuals or the state from harm, as specified.
Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose, as specified, a breach of the security of the system or data following discovery or notification of the security breach to any California resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, unless the information was encrypted. Existing law also requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, as specified.
This bill would make a nonsubstantive change to those provisions.
(a)There shall be no civil or criminal liability for, and no (1)No cause of action shall arise lie, or be maintained against, a any private entity whose actions comply for the sharing or receiving of cyber security-threat information if the sharing or receiving is conducted in accordance with subdivision (b) based upon its communication of cyber security-threat information to another private entity, or to a state law enforcement agency. or public entity. The immunity from liability granted by this section shall only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made for one of the following purposes: gross negligence.
(1)To address a vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)To prevent a threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)To provide support for cyber security crime investigation.
(4)To protect individuals and entities from personal or economic harm.
(5)To protect the states economic interests, including, but not limited to, networks, assets, and personal information.
(2)Nothing in this subdivision shall be construed to require dismissal of a cause of action against a private entity that has engaged in gross negligence in the course of sharing or receiving cyber security-threat information, or to undermine or limit the availability of otherwise applicable common law or statutory defenses.
(3)In any action claiming that the immunity from liability described in paragraph (1) does not apply due to the defendant acting with gross negligence, the plaintiff shall have the burden of proving by substantial evidence the gross negligence and that the gross negligence caused injury to the plaintiff.
(4)For purposes of this section, gross negligence includes actions that include all of the following elements engaged in:
(A)To intentionally injure, defraud, or otherwise endanger any individual or public or private entity.
(B)Knowingly without legal or factual justification.
(C)Without regard for a foreseeable risk that is so great as to make it highly probable that the harm will outweigh the benefit.
(D)Involving information that serves as criminal evidence for matters unrelated to a cyber security-threat or the otherwise known business of the private entity.
(b)A private entity that communicates is engaged in sharing or receiving cyber security-threat information shall not use that information to gain an unfair competitive advantage and shall, in good faith, do all of the following:
(1)Make reasonable efforts to safeguard communications that can be used to identify specific persons from unauthorized access or acquisition.
(2)Comply with any lawful restriction placed on the communication, including the removal of information that can be used to identify specific persons.
(3)Transfer the cyber security-threat information as expediently as possible while upholding reasonable protections.
(4)Ensure, at a minimum, appropriate anonymization and minimization of the information contained in the communication.
(c)For purposes of this section, cyber security-threat information means information pertaining directly to one of the following:
(1)A vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)A threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)Efforts to deny access to, or to cause the degradation, disruption, or destruction of a system, network, or critical infrastructure component of a public or private entity.
(4)Efforts to gain unauthorized access to a system, network, or critical infrastructure component of a public or private entity, including efforts to gain unauthorized access for the purpose of exfiltrating information stored on, processed on, or transitioning through, a system, network, or critical infrastructure component of a public or private entity.
(d)A communication of cyber security-threat information made in compliance with this section and shared with a public agency is confidential and shall not be disclosed under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(e)
(d)This section shall become inoperative on January 1, 2020, and as of that date is repealed.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which adds Section 6254.32 to the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The need to protect information regarding the specific vulnerabilities of and threats to information technology systems to preclude use of that information to facilitate attacks on those systems outweighs the interest in the public disclosure of that information.
(a)There shall be no civil or criminal liability for, and no cause of action shall arise against, a private entity whose actions comply with subdivision (b), and that has registered with the Attorney General pursuant to subdivision (c), (b) based upon its communication of cyber security-threat information to another private entity, or to a state entity identified by the Attorney General. law enforcement agency. The immunity from liability granted by this section shall only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made for one of the following purposes:
(1)To address a vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)To prevent a threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)To provide support for cyber security crime investigation.
(4)To protect individuals and entities from personal or economic harm.
(5)To protect the states economic interests, including, but not limited to, networks, assets, and personal information.
(b)A private entity that communicates cyber security-threat information shall not use that information to gain an unfair competitive advantage and shall shall, in good faith, do all of the following:
(1)Make reasonable efforts to safeguard communications that can be used to identify specific persons from unauthorized access or acquisition.
(2)Comply with any lawful restriction placed on the communication, including the removal of information that can be used to identify specific persons.
(3)Transfer the cyber security-threat information as expediently as possible while upholding reasonable protections.
(c)The Attorney General shall create a registry of private entities that intend to engage in communication of cyber security-threat information.
(d)The Attorney General shall submit an annual report to the Legislature regarding the operation of these provisions that includes an assessment of the impact of these provisions on the privacy of the personal information of California residents.
(4)Ensure, at a minimum, appropriate anonymization and minimization of the information contained in the communication.
(e)
(c)For purposes of this section, cyber security-threat information means information pertaining directly to one of the following:
(1)A vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)A threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)Efforts to deny access to, or to cause the degradation, disruption, or destruction of a system, network, or critical infrastructure component of a public or private entity.
(4)Efforts to gain unauthorized access to a system, network, or critical infrastructure component of a public or private entity, including efforts to gain unauthorized access for the purpose of exfiltrating information stored on, processed on, or transitioning through, a system, network, or critical infrastructure component of a public or private entity.
(f)(1)The requirement for submitting a report imposed under subdivision (d) is inoperative on January 1, 2020, pursuant to Section 10231.5 of the Government Code.
(2)A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code.
(d)A communication of cyber security-threat information made in compliance with this section and shared with a public agency is confidential and shall not be disclosed under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code).
(e)This section shall become inoperative on January 1, 2020, and as of that date is repealed.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which adds Section 6254.32 to the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The need to protect information regarding the specific vulnerabilities of and threats to information technology systems to preclude use of that information to facilitate attacks on those systems outweighs the interest in the public disclosure of that information.
(a)There shall be no civil or criminal liability for, and no cause of action shall arise against, a private entity whose actions comply with subdivision (b), and that has registered with the Attorney General pursuant to subdivision (b), (c), based upon its communication of cyber security-threat information to another private entity, or to a state entity identified by the Attorney General. The immunity from liability granted by this section shall only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made for one of the following purposes:
(1)To address a vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)To prevent a threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)To provide support for cyber security crime investigation.
(4)To protect individuals from personal or economic harm.
(5)To protect the states economic interests, including, but not limited to, networks, assets, and personal information.
(b)A private entity that communicates cyber security-threat information shall not use that information to gain an unfair competitive advantage and shall do all of the following:
(1)Make reasonable efforts to safeguard communications that can be used to identify specific persons from unauthorized access or acquisition.
(2)Comply with any lawful restriction placed on the communication, including the removal of information that can be used to identify specific persons.
(3)Transfer the cyber security-threat information as expediently as possible while upholding reasonable protections.
(b)
(c)The Attorney General shall create a registry of private entities that intend to engage in communication of cyber security-threat information.
(d)The Attorney General shall submit an annual report to the Legislature regarding the operation of these provisions that includes an assessment of the impact of these provisions on the privacy of the personal information of California residents.
(c)
(e)For purposes of this section, cyber security-threat information means information pertaining directly to one of the following:
(1)A vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)A threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)Efforts to deny access to, or to cause the degradation, disruption, or destruction of a system, network, or critical infrastructure component of a public or private entity.
(4)Efforts to gain unauthorized access to a system, network, or critical infrastructure component of a public or private entity, including efforts to gain unauthorized access for the purpose of exfiltrating information stored on, processed on, or transitioning through, a system, network, or critical infrastructure component of a public or private entity.
(f)(1)The requirement for submitting a report imposed under subdivision (d) is inoperative on January 1, 2020, pursuant to Section 10231.5 of the Government Code.
(2)A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code.
(a)There shall be no civil or criminal liability for, and no cause of action shall arise against, a private entity that has registered with the Attorney General pursuant to subdivision (b), based upon its communication of cyber security-threat information to another private entity, or to a state entity identified by the Attorney General. The immunity from liability granted by this section shall only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity and is made for one of the following purposes:
(1)To address a vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)To prevent a threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)To provide support for cyber security crime investigation.
(4)To protect individuals from personal or economic harm.
(5)To protect the states economic interests, including, but not limited to, networks, assets, and personal information.
(b)The Attorney General shall create a registry of private entities that intend to engage in communication of cyber security-threat information.
(c)For purposes of this section, cyber security-threat information means information pertaining directly to one of the following:
(1)A vulnerability of a system, network, or critical infrastructure component of a public or private entity.
(2)A threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity.
(3)Efforts to deny access to, or to cause the degradation, disruption, or destruction of a system, network, or critical infrastructure component of a public or private entity.
(4)Efforts to gain unauthorized access to a system, network, or critical infrastructure component of a public or private entity, including efforts to gain unauthorized access for the purpose of exfiltrating information stored on, processed on, or transitioning through, a system, network, or critical infrastructure component of a public or private entity.
SECTION 1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made as quickly as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time as quickly as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
|
Date
|
Status
|
|---|---|
| Apr 13, 2015 | Re-referred to Coms. on P. & C.P. and JUD. pursuant to Assembly Rule 96. |
| Feb 1, 2016 | From committee: Filed with the Chief Clerk pursuant to Joint Rule 56. |
| Jan 31, 2016 | Died pursuant to Article IV, Sec. 10(c) of the Constitution. |
| May 12, 2015 | In committee: Set, second hearing. Hearing canceled at the request of author. |
| May 4, 2015 | Re-referred to Com. on JUD. |
| May 1, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on JUD. Read second time and amended. |
| Apr 28, 2015 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Apr 22, 2015 | From committee: Do pass and re-refer to Com. on JUD. (Ayes 11. Noes 0.) (April 21). Re-referred to Com. on JUD. |
| Apr 20, 2015 | Re-referred to Com. on P. & C.P. |
| Apr 16, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Feb 25, 2015 | Read first time. To print. |
| Apr 13, 2015 | Re-referred to Com. on JUD. |
| Apr 13, 2015 | In committee: Hearing postponed by committee. |
| Apr 9, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on JUD. Read second time and amended. |
| Apr 6, 2015 | Re-referred to Com. on JUD. |
| Apr 6, 2015 | In committee: Hearing postponed by committee. |
| Mar 26, 2015 | Referred to Coms. on JUD. and P. & C.P. |
| Mar 26, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on JUD. Read second time and amended. |
| Feb 26, 2015 | From printer. May be heard in committee March 28. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Apr 21, 2015 | Do pass and be re-referred to the Committee on [Judiciary] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| California Bankers Association | * Support | Apr 21, 2015 |
| California Retailers Association | * Support | Apr 21, 2015 |
| Civil Justice Association Of California | * Support | Apr 21, 2015 |
| CTIA-The Wireless Association | * Support | Apr 21, 2015 |
| Tech America | * Neutral | Apr 21, 2015 |
| Tech Net | * Support | Apr 21, 2015 |
AB 739
Page 6
Date of Hearing: April 21, 2015
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Mike Gatto, Chair
AB 739
Irwin – As Amended April 16, 2015
SUBJECT: Civil law: liability: communication of cyber security: threat information
SUMMARY: Provides legal immunity from civil or criminal liability for private entities that communicate anonymized cyber security-threat information and meet specified requirements, until January 1, 2020. Specifically, this bill:
Declares that there shall be no civil or criminal liability for, and no legal cause of action against, a private entity that communicates cyber security-threat information to another private entity or a state law enforcement entity in compliance with the requirements of this bill.
Requires that immunity from liability shall only apply if the communication is made without the intent to injure, defraud, or to otherwise endanger any individual or public or private entity, and is made for one of the following purposes:
To address a vulnerability of a system, network, or critical infrastructure component of a public or private entity;
To prevent a threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity;
To provide support for cyber security crime investigation;
To protect individuals and entities from personal or economic harm; or
To protect the state’s economic interests, including, but not limited to, networks, assets, and personal information.
Prohibits a private entity that communicates cyber security-threat information from using that information to gain an unfair competitive advantage, and further requires that entity to do all of the following in good faith:
Make reasonable efforts to safeguard communications that can be used to identify specific persons from unauthorized access or acquisition;
Comply with any lawful restriction placed on the communication, including the removal of information that can be used to identify specific persons;
Transfer the cyber security-threat information as expediently as possible while upholding reasonable protections; and,
Ensure, at a minimum, the appropriate anonymization and minimization of such information.
Defines "cyber security-threat information" as information pertaining directly to one of the following:
A vulnerability of a system, network, or critical infrastructure component of a public or private entity;
A threat to the integrity, confidentiality, or availability of a system, network, or critical infrastructure component of a public or private entity;
Efforts to deny access to, or to cause the degradation, disruption, or destruction of a system, network, or critical infrastructure component of a public or private entity; and
Efforts to gain unauthorized access to a system, network, or critical infrastructure component of a public or private entity.
Declares that communication of cyber security-threat information in compliance with these provisions and shared with a public agency to be exempt from disclosure under the California Public Records Act.
Declares these provisions to become inoperative on January 1, 2020.
Makes findings and declarations relative to the limitations placed on the public's right of access to specified information, and the state's strong interest in protecting its information technology (IT) systems from intrusion.
EXISTING LAW:
Requires a person or business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civil Code (CC) Section 1798.81.5(b))
Requires a person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (CC 1798.82)
Establishes the Department of Technology (CalTech) within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. CalTech is responsible for the approval and oversight of IT projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. (Government Code (GC) Sections 11545, 12803.2)
Requires each state agency to have a chief information officer who is appointed by the head of the state entity, and is responsible for supervising all IT, including information security. (GC 11546.1)
Establishes the Office of Information Security (OIS) within DOT, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications. The law requires the OIS to develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk. (GC 11549, et seq.)
Provides, pursuant to the California Public Records Act, for public access to public agencies’ records, and requires that public records be open to inspection and that every person has the right to inspect any public record, with some exceptions. (GC 6250, et seq.)
FISCAL EFFECT: Unknown
COMMENTS:
Purpose of this bill. This bill is intended to increase the sharing of time-sensitive cyber security threat information by providing legal immunity to private parties who share anonymized threat information, subject to certain safeguards. The provisions of this bill would sunset on January 1, 2020. AB 739 is author-sponsored.
Author's statement. According to the author, "This bill will encourage cybersecurity information sharing by shielding companies from lawsuits based upon that process of sharing cybersecurity threat information. The lack of such liability protection has prevented further development of our information sharing channels between the private sector and government, and amongst private companies.
"The financial sector has been sharing information for the purposes specified in this bill since 1999. In response to critical incidents, other sectors have launched their own cyber threat information sharing portals. For example, the retail sector recently launched the R-CISC to share cybersecurity threat information between retailers, law enforcement, the Department of Homeland Security and other stakeholders.
"Cybersecurity crime accounts for an estimated $400 billion global economic impact. California is the most targeted state in the country with 17% of reported attacks or breaches occurring within the state. Prevention is the best policy and this bill will provide protection for preventative information sharing which empowers the private sector to take steps to protect themselves and mitigate the risk in the larger economy."
California and the cyber security threat. According to the California Military Department, California's size and prominence makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security. In 2012, 17 percent of the data breaches recorded in the United States took place in California – more than any other state; and the number of reported breaches in California increased by 28 percent in 2013. According to a January 2015 report by the California Attorney General’s Office, 187 breaches were reported to the California Department of Justice in 2014, compared to 167 in 2013 and 131 in 2012. CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy.
According to the Identity Theft Resource Center, there were 783 data breaches reported nationwide in 2014 – a 27.5 percent increase over the previous year. The Privacy Rights Clearinghouse reports that more than 815 million records have been compromised in more than 4,489 publicly acknowledged data breaches since 2005.
Existing efforts at threat information sharing. Cyber security-threat information sharing is based on the idea that the faster that individual entities share information about cyber-attacks discovered on their networks, the faster other entities can prepare more effective defenses – thereby reducing vulnerability to cyber-attack across the entire system.
Coordinated information sharing as a defensive tactic is not new. One well-established example is the creation of the Information Sharing and Analysis Centers (ISAC) for the financial services industry by Presidential Decision Directive 63 in 1998. The directive requested the public and private sector to create a partnership to share information about physical and cyber threats, vulnerabilities, and events to help protect the critical infrastructure of the United States. After analysis by industry experts, alerts are delivered to participants based on their level of service. Today there are ISACs for fourteen critical infrastructures, such as financial services, electric, energy and surface transportation.
Even non-critical infrastructure industries have set up their own threat information systems. For example, the retail industry has developed the Retail Cyber Intelligence Sharing Center which shares threat information between retailers, law enforcement, the Department of Homeland Security and other stakeholders.
However, faced with rapid growth in the number and sophistication of attacks in recent years, there have substantial efforts at the federal level and across the country to better prepare for cyber-attacks and increase the sharing of threat information. In February 2013, the President Signed Executive Order 13636, which calls for the development of what the National Institute for Standards and Technology (NIST) called "a voluntary risk-based Cybersecurity Framework – a set of industry standards and best practices to help organizations manage cyber security risks. The resulting Framework, created through collaboration between government and the private sector, uses a common language to address and manage cyber security risk in a cost-effective way based on business needs without placing additional regulatory requirements on businesses." NIST issued its policy recommendations in February 2014.
In February 2015, President Obama signed an
Executive Order that encourages the development of central
clearinghouses where information can be shared between the public and
private sectors quickly and securely.
There are also no
fewer than four bills currently pending in Congress, H.R.234
(Ruppersberger), H.R.1560 (Nunes), S.456 (Carper), and S.754 (Burr),
that would variously codify practices for threat information sharing,
and in some cases provided some form of legal immunity for threat
information sharing. President Obama has also released a
cyber-security information sharing proposal with liability
protections for participants.
Concerns about the current state of threat information sharing. While there are multiple threat information-sharing systems in place, there is some question as to how comprehensive or effective those systems are.
According to a January 2015 article by securityweek.com, "Threat information-sharing is a phrase that gets thrown often, but there isn't much agreement on how organizations should be working together or the methods they should be using… Some forms of information sharing already exist—the ISACs for various industries, including financial services, retail, and industrial control systems are just a few examples. Industry consortiums and groups have launched several sharing platforms, such as the one from MITRE. But some organizations remain wary about information-sharing for a myriad of reasons, including competitive concerns, liability worries, and reputation damage. Despite years of talking about it, there are still roadblocks to effective, widespread information sharing."
Effective information sharing also needs to happen quickly. A recently released "2015 Data Breach Investigations Report" from Verizon found that the speed with which threat information moves – or 'herd alertness' – is critical to limiting follow-on cyber-attacks. The report found that, "[b]ased on attacks observed by RiskAnalytics during 2014, 75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours). Over 40% hit the second organization in less than an hour. That puts quite a bit of pressure on us as a community to collect, vet, and distribute indicator-based intelligence very quickly in order to maximize our collective preparedness."
Related legislation. AB 670 (Irwin) would require CalTech to conduct security assessments of the IT resources of every state agency, department or office at least once every two years. AB 670 is currently pending in the Assembly Appropriations Committee.
AB 1172 (Chau) would create a California Cyber Security Task Force within the Governor's Office of Emergency Services to act in an advisory capacity and make policy recommendations on cyber security for the state of California. AB 1172 is currently set for hearing in the Assembly Privacy and Consumer Protection Committee on April 21, 2015.
Prior legislation. AB 2200 (Perez) of 2014 would have created a 13-member California Cyber Security Steering Committee within the Governor’s Office of Emergency Services (OES), and would have continued the existence of the California Cyber Security Task Force until January 1, 2020. This bill was held at the Assembly Desk.
SB 1286 (Corbett) of 2014 would have raised from $35 million to $65 million the amount that the Public Utilities Commission may devote to research and development projects for the purposes of cyber security and grid integration. This bill was held in the Senate Rules Committee.
SB 90 (Budget and Fiscal Review), Chapter 183, Statutes of 2007, created the Office of Information Security and Privacy Protection within the State and Consumer Services Agency. The duties of that office included providing direction for information security and privacy to state government agencies; conducting security assessments and review of any state agency; providing educational information to consumers on effective ways of protecting personal information; and assisting in the prosecution of identity theft and other privacy-related crimes.
Double-referral. This bill is double-referred to the Assembly Judiciary Committee, where it will be heard on April 28, 2015, if passed by this Committee.
REGISTERED SUPPORT / OPPOSITION:
Support
None received.
Opposition
None received.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200
Discussed in Hearing
6MIN
Assembly Standing Committee on Privacy and Consumer Protection
Bill Author
Bill Co-Author(s):