AB 964: Civil law: privacy.
- Session Year: 2015-2016
- House: Assembly
- Latest Version Date: 2015-10-06
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
Existing law requires a person, business, or a state or local agency, that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification to the Attorney General.
This bill would also require a person or business, or state or local agency that is required to issue a security breach notification under these circumstances to inform the Attorney General of the date of the discovery of the breach.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology.
Existing law requires a person, business, or a state or local agency, that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification to the Attorney General.
This bill would also require a person or business, or state or local agency that is required to issue a security breach notification under these circumstances to inform the Attorney General of the date of the discovery of the breach.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information technology.
Existing law requires a person, business, or a state or local agency, that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification to the Attorney General.
This bill would also require a person or business, or state or local agency that is required to issue a security breach notification under these circumstances to inform the Attorney General of the date of the discovery of the breach.
Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would instead require the disclosure to be made within 30 days, consistent with the legitimate needs of law enforcement.
The bill would authorize the Attorney General to grant a person or business an additional period of time, not exceeding 30 days, in which to make the disclosure if the Attorney General determines that the person or business needs additional time in order to determine the scope of the security breach, prevent further disclosures, conduct a risk assessment, restore the integrity of the data system, or provide notice to an entity designated to receive reports and information about information security incidents.
The bill would also provide that if the data containing personal information was encrypted, as defined, there would be a presumption that a breach of the security of the data does not compromise the security, confidentiality, or integrity of the personal information, and no disclosure would be required. That presumption would be rebuttable in a civil action against a person or business for failure to comply with these provisions by facts demonstrating that in the present instance, the security technologies or methodologies used to encrypt the data have been, or are reasonably likely to have been, compromised.
This bill would define encrypted for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information technology.
Existing law requires a person, business, or a state or local agency, that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification to the Attorney General.
This bill would also require a person or business, or state or local agency that is required to issue a security breach notification under these circumstances to inform the Attorney General of the date of the discovery of the breach.
Existing law requires a person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
This bill would state the intent of the Legislature to enact legislation to protect the public from data breaches. instead require the disclosure to be made within 30 days, consistent with the legitimate needs of law enforcement.
The bill would authorize the Attorney General to grant a person or business an additional period of time, not exceeding 30 days, in which to make the disclosure if the Attorney General determines that the person or business needs additional time in order to determine the scope of the security breach, prevent further disclosures, conduct a risk assessment, restore the integrity of the data system, or provide notice to an entity designated to receive reports and information about information security incidents.
The bill would also provide that if the data containing personal information was encrypted, as defined, there would be a presumption that a breach of the security of the data does not compromise the security, confidentiality, or integrity of the personal information, and no disclosure would be required. That presumption would be rebuttable in a civil action against a person or business for failure to comply with these provisions by facts demonstrating that in the present instance, the security technologies or methodologies used to encrypt the data have been, or are reasonably likely to have been, compromised.
Existing law requires a person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
This bill would state the intent of the Legislature to enact legislation to protect the public from data breaches.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 4.(a) Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b) Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c) Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 4.(a) Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b) Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c) Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 4.(a) Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 34. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 34, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b) Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 34 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c) Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 34, and Senate Bill 570. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 34 and Senate Bill 570, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification, pursuant to subdivision (b), notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification, pursuant to subdivision (b), of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification, pursuant to subdivision (b), of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SECTION 1. SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)(1)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification, pursuant to subdivision (b), of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and within 30 days, without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c). (c), or any measures reasonably necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(2)If the data containing personal information was encrypted, there shall be a presumption that a breach of the data does not comprise the security, confidentiality, or integrity of the personal information contained therein, and no disclosure is required. That presumption shall be rebuttable in a civil action pursuant to subdivision (b) of Section 1798.84 against a person or business for failure to make the required disclosure by facts demonstrating that in the present instance the security technologies or methodologies used to encrypt the data have been, or are reasonably likely to have been, compromised and disclosure is required in accordance with paragraph (1).
(3)If a person or business requires additional time to disclose a breach, it shall provide the Attorney General records or other evidence demonstrating the need to delay disclosure. If the Attorney General determines that the person or business needs additional time in order to determine the scope of a security breach, prevent further disclosures, conduct a risk assessment, restore the integrity of the data system, or provide notice to an entity designated to receive reports and information about information security incidents, threats, and vulnerabilities, it may grant the person or business an additional period of time, not exceeding 30 days, in which to make the disclosure. The Attorney General shall grant additional time to make the disclosure in writing specifying the amount of additional time granted.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed pursuant to paragraph (3) of subdivision (a) or as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall inform the Attorney General of the date of the discovery of the breach, and electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(a)(1)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification notification, pursuant to subdivision (b), of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, within 30 days, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. (c).
(2)If the data containing personal information was encrypted, there shall be a presumption that a breach of the data does not comprise the security, confidentiality, or integrity of the personal information contained therein, and no disclosure is required. That presumption shall be rebuttable in a civil action pursuant to subdivision (b) of Section 1798.84 against a person or business for failure to make the required disclosure by facts demonstrating that in the present instance the security technologies or methodologies used to encrypt the data have been, or are reasonably likely to have been, compromised and disclosure is required in accordance with paragraph (1).
(3)If a person or business requires additional time to disclose a breach, it shall provide the Attorney General records or other evidence demonstrating the need to delay disclosure. If the Attorney General determines that the person or business needs additional time in order to determine the scope of a security breach, prevent further disclosures, conduct a risk assessment, restore the integrity of the data system, or provide notice to an entity designated to receive reports and information about information security incidents, threats, and vulnerabilities, it may grant the person or business an additional period of time, not exceeding 30 days, in which to make the disclosure. The Attorney General shall grant additional time to make the disclosure in writing specifying the amount of additional time granted.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed pursuant to paragraph (3) of subdivision (a) or as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SECTION 1.It is the intent of the Legislature to enact legislation to protect the public from data breaches.
It is the intent of the Legislature to enact legislation to protect the public from data breaches.
|
Date
|
Status
|
|---|---|
| Sep 2, 2015 | Read second time. Ordered to third reading. |
| Jun 18, 2015 | Referred to Com. on JUD. |
| Jul 8, 2015 | From committee: Do pass. (Ayes 5. Noes 1.) (July 7). |
| Jul 9, 2015 | Read second time. Ordered to third reading. |
| Sep 1, 2015 | Motion to reconsider made by Senator Jackson. |
| Sep 1, 2015 | Read third time and amended. Ordered to second reading. |
| Sep 1, 2015 | Read third time. Passed. Ordered to the Assembly. |
| Sep 1, 2015 | Read third time. Passed. Ordered to the Assembly. (Ayes 26. Noes 11. Page 2330.). |
| Sep 1, 2015 | Reconsideration granted. |
| Sep 1, 2015 | Reconsideration granted. (Ayes 37. Noes 0. Page 2332.) |
| Jun 3, 2015 | Read third time. Passed. Ordered to the Senate. (Ayes 69. Noes 7. Page 1848.) |
| Sep 3, 2015 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after September 5 pursuant to Assembly Rule 77. |
| Sep 3, 2015 | Read third time. Passed. Ordered to the Assembly. |
| Sep 3, 2015 | Read third time. Passed. Ordered to the Assembly. (Ayes 27. Noes 11. Page 2472.). |
| Sep 8, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. |
| Sep 8, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 63. Noes 11. Page 2946.). |
| Sep 8, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 63. Noes 11.). |
| Sep 17, 2015 | Enrolled and presented to the Governor at 11:30 a.m. |
| Oct 6, 2015 | Approved by the Governor. |
| Oct 6, 2015 | Chaptered by Secretary of State - Chapter 522, Statutes of 2015. |
| May 6, 2015 | Re-referred to Com. on APPR. |
| Feb 27, 2015 | From printer. May be heard in committee March 29. |
| Mar 26, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Mar 26, 2015 | Referred to Com. on P. & C.P. |
| Apr 6, 2015 | Re-referred to Com. on P. & C.P. |
| Apr 20, 2015 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Apr 23, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Apr 27, 2015 | Re-referred to Com. on P. & C.P. |
| May 4, 2015 | From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 7. Noes 1.) (April 30). |
| May 5, 2015 | Read second time and amended. |
| Feb 26, 2015 | Read first time. To print. |
| May 13, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on APPR. Read second time and amended. |
| May 14, 2015 | Re-referred to Com. on APPR. |
| May 20, 2015 | From committee: Do pass. (Ayes 11. Noes 4.) (May 20). |
| May 21, 2015 | Read second time. Ordered to third reading. |
| May 28, 2015 | Read third time and amended. Ordered to third reading. |
| May 28, 2015 | Read third time and amended. Ordered to third reading. (Page 1629.) |
| Jun 3, 2015 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Jun 3, 2015 | Read third time. Passed. Ordered to the Senate. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 8, 2015 | AB 964 CHAU Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Sep 3, 2015 | Assembly 3rd Reading AB964 Chau By Jackson | Senate Floor |
Passed |
|
| Sep 1, 2015 | Assembly 3rd Reading AB964 Chau By Jackson Reconsider | Senate Floor |
Passed |
|
| Sep 1, 2015 | Assembly 3rd Reading AB964 Chau By Jackson | Senate Floor |
Passed |
|
| Jul 7, 2015 | Do pass | Senate Standing Committee on Judiciary |
Passed |
|
| Jun 3, 2015 | AB 964 CHAU Assembly Third Reading | Assembly Floor |
Passed |
|
| May 20, 2015 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 30, 2015 | Do pass as amended and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| 15 version) | ** Against | Apr 30, 2015 |
| America's Health Insurance Plans (3 | ** Against | Apr 30, 2015 |
| California Retailers Association | * Indeterminate | Apr 30, 2015 |
| The Internet Association | * Indeterminate | Apr 30, 2015 |
AB 964
Page 1
CONCURRENCE IN SENATE AMENDMENTS
AB 964
(Chau)
As Amended September 1, 2015
Majority vote
ASSEMBLY: |
69-7 |
(June 03, 2015) |
SENATE: |
27-11 |
(September 3, 2015) |
Original Committee Reference: P. & C.P.
SUMMARY: Defines the word "encrypted" as used in California's Data Breach Notification Law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security. Specifically, this bill:
Defines, for purposes of the existing data breach notification requirements for businesses and public agencies, the term "encrypted" to mean "rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security."
Makes other technical or non-substantive changes.
The Senate amendments add double-jointing language to avoid chaptering conflicts with SB 570 (Jackson) and SB 34 (Hill) of the current legislative session.
FISCAL EFFECT: None. This bill is keyed non-fiscal by the Legislative Counsel.
COMMENTS: This bill is simply intended to clarify the state's existing data breach notification law for private businesses and public agencies that hold unencrypted personal information by providing a definition for what encryption actually means.
2014 was a record-setting year in terms of the number of security breaches reported. According to a January 2015 report by the California Attorney General’s Office, 187 breaches were reported to the California Department of Justice in 2014, compared to 167 in 2013 and 131 in 2012. According to the Identity Theft Resource Center, there were 783 data breaches reported nationwide in 2014 – a 27.5% increase over the previous year. The Privacy Rights Clearinghouse reports that more than 815 million records have been compromised in more than 4,489 publicly acknowledged data breaches since 2005.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002010
AB 964
Page 6
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: AB 964
Amended: 9/1/15 in Senate
SENATE JUDICIARY COMMITTEE: 5-1, 7/7/15
AYES: Jackson, Hertzberg, Leno, Monning, Wieckowski
NOES: Moorlach
NO VOTE RECORDED: Anderson
ASSEMBLY FLOOR: 69-7, 6/3/15 - See last page for vote
DIGEST: This bill defines the word “encrypted” as used in California’s Data Breach Notification Law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Senate Floor Amendments add triple-jointing language to avoid chaptering out conflicts with SB 34 (Hill, 2015) and SB 570 (Jackson, 2015).
Existing law:
Requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
Requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
Defines “personal information,” for purposes of the breach notification statute, to include either a user name or email address, in combination with a password or security question and answer that would permit access to an online account, or the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)
This bill defines, for purposes of the above provisions, the word “encrypted” to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Background
In 2003, California’s first-in-the-nation data breach notification law went into effect. (See Civ. Code Secs. 1798.29(a), 1798.82(a).) Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s breach notification statute requires state agencies, local agencies, and businesses to notify residents when the security of their personal information is breached. This notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.
When the Legislature enacted SB 1386 (Peace, Chapter 915, Statutes of 2002) and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the term “encryption” was not defined in the original law, nor has it been defined by subsequent legislation amending that part of the Civil Code.
This bill adds a definition of the word “encrypted” to the Data Breach Notification Law, specifying that it means to render unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Comments
The author writes:
California is a leader in protecting consumers and businesses from emerging cyber threats. In 2003, California was the first state in the nation to pass a law that required businesses to notify customers when their personal information has been stolen in a data breach. Data breaches involve situations in which sensitive, protected or confidential data, such as credit/debit card information, social security numbers, and health records are stolen.
As more and more of our personal information is used in the course of our daily lives, data breaches have become an almost common occurrence. Recent data breaches on private and public entities have shown us that these attacks are growing in number and are becoming increasingly sophisticated.
In 2012, California was home to 17 percent of the data breaches recorded in the United States, the most in the nation. Even more troubling was the fact that, in 2013, the number of breaches increased by 28 percent. Data breaches pose a serious threat to governments, private industries, and individuals. Data breaches on public entities can put critical infrastructures at risk from criminals and terrorist activities. In addition, private industries risk losing corporate secrets and billions of dollars. For consumers, the loss of personal information can result in identify theft, fraud, and personal embarrassment, all of which could take years to repair and recover from, if ever.
Under current law, if the personal information that was stolen was encrypted, businesses are not required to provide notice. This provision serves to encourage businesses who store personal information to adopt encryption so that if information is stolen, that information would be less vulnerable to abuse. However, encryption is not clearly defined in statue.
The bill would clarify the statute by defining “encrypted” to mean any data at issue that was rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
Related/Prior Legislation
SB 570 (Jackson, 2015) requires entities that must provide affected individuals with notice of a data breach to provide that notice in a specified format. Specifically, this bill would require these entities to provide a notice entitled “Notice of Data Breach,” in which the content required by the Data Breach Notification Law is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” This bill states that additional information may be provided as a supplement to the notice, clarifies the requirements for providing substitute notice of a data breach, and makes other technical and clarifying changes. This bill is pending on the Assembly Floor.
AB 259 (Dababneh, 2015) requires an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. This bill was held on suspense in the Senate Appropriations Committee.
AB 1710 (Dickinson, Chapter 855, Statutes of 2014) amended California’s Data Breach Notification Law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. This bill also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett, Chapter 396, Statutes of 2013) revised the data elements included within the definition of personal information under California’s Data Breach Notification Law by adding certain information that would permit access to an online account, and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1149 (Campos, Chapter 395, Statutes of 2013) expanded existing disclosure requirements concerning breaches of computerized data owned or licensed by state agencies to “local agencies” as defined by Government Code Section 6252(a). This bill also made certain technical corrections to the security breach notification law.
SB 24 (Simitian, Chapter 197, Statutes of 2011) required any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
AB 1298 (Jones, Chapter 699, Statutes of 2007), among other things, added medical information and health insurance information to the data elements that, when combined with the individual’s name, would constitute personal information requiring disclosure when acquired, or believed to be acquired, by an unauthorized person due to a security breach.
AB 1950 (Wiggins, Chapter 877, Statutes of 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace, Chapter 915, Statutes of 2002) enacted California’s Data Breach Notification Law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No
None received
None received
ASSEMBLY FLOOR: 69-7, 6/3/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Roger Hernández, Holden, Irwin, Jones-Sawyer, Lackey, Levine, Lopez, Low, Maienschein, Mayes, McCarty, Medina, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins
NOES: Bigelow, Beth Gaines, Harper, Kim, Mathis, Melendez, Patterson
NO VOTE RECORDED: Chang, Gallagher, Jones, Linder
Prepared by: Tobias Halvarson / JUD. / (916) 651-4113
9/2/15 11:38:45
**** END ****
AB 964
Page 6
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: AB 964
Amended: 5/28/15 in Assembly
SENATE JUDICIARY COMMITTEE: 5-1, 7/7/15
AYES: Jackson, Hertzberg, Leno, Monning, Wieckowski
NOES: Moorlach
NO VOTE RECORDED: Anderson
ASSEMBLY FLOOR: 69-7, 6/3/15 - See last page for vote
DIGEST: This bill defines the word “encrypted” as used in California’s Data Breach Notification Law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Existing law:
Requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
Requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
Defines “personal information,” for purposes of the breach notification statute, to include either a user name or email address, in combination with a password or security question and answer that would permit access to an online account, or the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)
This bill defines, for purposes of the above provisions, the word “encrypted” to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Background
In 2003, California’s first-in-the-nation data breach notification law went into effect. (See Civ. Code Secs. 1798.29(a), 1798.82(a).) Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s breach notification statute requires state agencies, local agencies, and businesses to notify residents when the security of their personal information is breached. This notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.
When the Legislature enacted SB 1386 (Peace, Chapter 915, Statutes of 2002) and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the term “encryption” was not defined in the original law, nor has it been defined by subsequent legislation amending that part of the Civil Code.
This bill adds a definition of the word “encrypted” to the Data Breach Notification Law, specifying that it means to render unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
Comments
The author writes:
California is a leader in protecting consumers and businesses from emerging cyber threats. In 2003, California was the first state in the nation to pass a law that required businesses to notify customers when their personal information has been stolen in a data breach. Data breaches involve situations in which sensitive, protected or confidential data, such as credit/debit card information, social security numbers, and health records are stolen.
As more and more of our personal information is used in the course of our daily lives, data breaches have become an almost common occurrence. Recent data breaches on private and public entities have shown us that these attacks are growing in number and are becoming increasingly sophisticated.
In 2012, California was home to 17 percent of the data breaches recorded in the United States, the most in the nation. Even more troubling was the fact that, in 2013, the number of breaches increased by 28 percent. Data breaches pose a serious threat to governments, private industries, and individuals. Data breaches on public entities can put critical infrastructures at risk from criminals and terrorist activities. In addition, private industries risk losing corporate secrets and billions of dollars. For consumers, the loss of personal information can result in identify theft, fraud, and personal embarrassment, all of which could take years to repair and recover from, if ever.
Under current law, if the personal information that was stolen was encrypted, businesses are not required to provide notice. This provision serves to encourage businesses who store personal information to adopt encryption so that if information is stolen, that information would be less vulnerable to abuse. However, encryption is not clearly defined in statue.
The bill would clarify the statute by defining “encrypted” to mean any data at issue that was rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
Related/Prior Legislation
SB 570 (Jackson, 2015) requires entities that must provide affected individuals with notice of a data breach to provide that notice in a specified format. Specifically, this bill requires these entities to provide a notice entitled “Notice of Data Breach,” in which the content required by the Data Breach Notification Law is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” This bill states that additional information may be provided as a supplement to the notice, clarifies the requirements for providing substitute notice of a data breach, and makes other technical and clarifying changes. This bill is pending in the Assembly Appropriations Committee.
AB 259 (Dababneh, 2015) requires an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. This bill is pending in the Senate Judiciary Committee.
AB 1710 (Dickinson, Chapter 855, Statutes of 2014) amended California’s Data Breach Notification Law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. This bill also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett, Chapter 396, Statutes of 2013) revised the data elements included within the definition of personal information under California’s Data Breach Notification Law by adding certain information that would permit access to an online account, and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1149 (Campos, Chapter 395, Statutes of 2013) expanded existing disclosure requirements concerning breaches of computerized data owned or licensed by state agencies to “local agencies” as defined by Government Code Section 6252(a). This bill also made certain technical corrections to the security breach notification law.
SB 24 (Simitian, Chapter 197, Statutes of 2011) required any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
AB 1298 (Jones, Chapter 699, Statutes of 2007), among other things, added medical information and health insurance information to the data elements that, when combined with the individual’s name, would constitute personal information requiring disclosure when acquired, or believed to be acquired, by an unauthorized person due to a security breach.
AB 1950 (Wiggins, Chapter 877, Statutes of 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace, Chapter 915, Statutes of 2002) enacted California’s Data Breach Notification Law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No
None received
None received
ASSEMBLY FLOOR: 69-7, 6/3/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Roger Hernández, Holden, Irwin, Jones-Sawyer, Lackey, Levine, Lopez, Low, Maienschein, Mayes, McCarty, Medina, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins
NOES: Bigelow, Beth Gaines, Harper, Kim, Mathis, Melendez, Patterson
NO VOTE RECORDED: Chang, Gallagher, Jones, Linder
Prepared by: Tobias Halvarson / JUD. / (916) 651-4113
7/10/15 14:06:05
**** END ****
AB 964 (Chau)
Page 7 of 7
Senator Hannah-Beth Jackson, Chair
2015-2016 Regular Session
AB 964 (Chau)
Version: May 28, 2015
Hearing Date: July 7, 2015
Fiscal: No
Urgency: No
TH
SUBJECT
Civil law: privacy
DESCRIPTION
This bill would define “encrypted” as used in California’s Data Breach Notification Law to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
BACKGROUND
In 2003, California’s first-in-the-nation data breach notification law went into effect. (See Civ. Code Secs. 1798.29(a), 1798.82(a).) Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s breach notification statute requires state agencies, local agencies, and businesses to notify residents when the security of their personal information is breached. This notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.
When the Legislature enacted SB 1386 (Peace, Ch. 915, Stats. 2002) and created California’s Data Breach Notification Law, the law included a safe harbor that generally exempted the exposure of encrypted personal information from the law’s notification provisions. The inclusion of an encryption safe harbor was meant to incentivize organizations to encrypt personal information under their control. However, the term “encryption” was not defined in the original law, nor has it been defined by subsequent legislation amending that part of the Civil Code.
This bill would add a definition of “encrypted” to the Data Breach Notification Law, specifying that it means to render unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
CHANGES TO EXISTING LAW
Existing law requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
Existing law requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
Existing law defines “personal information,” for purposes of the breach notification statute, to include either a user name or email address, in combination with a password or security question and answer that would permit access to an online account, or the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)
This bill would, for purposes of the above provisions, define “encrypted” to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
COMMENT
Stated need for the bill
The author writes:
California is a leader in protecting consumers and businesses from emerging cyber threats. In 2003, California was the first state in the nation to pass a law that required businesses to notify customers when their personal information has been stolen in a data breach. Data breaches involve situations in which sensitive, protected or confidential data, such as credit/debit card information, social security numbers, and health records are stolen.
As more and more of our personal information is used in the course of our daily lives, data breaches have become an almost common occurrence. Recent data breaches on private and public entities have shown us that these attacks are growing in number and are becoming increasingly sophisticated.
In 2012, California was home to 17 [percent] of the data breaches recorded in the United States, the most in the nation. Even more troubling was the fact that, in 2013, the number of breaches increased by 28 [percent]. Data breaches pose a serious threat to governments, private industries, and individuals. Data breaches on public entities can put critical infrastructures at risk from criminals and terrorist activities. In addition, private industries risk losing corporate secrets and billions of dollars. For consumers, the loss of personal information can result in identify theft, fraud, and personal embarrassment, all of which could take years to repair and recover from, if ever.
. . .
[U]nder current law, if the personal information that was stolen was encrypted, businesses are not required to provide notice. This provision, serves to encourage businesses who store personal information to adopt encryption so that if information is stolen, that information would be deemed less vulnerable to abuse. However, encryption is not clearly defined in statue.
The bill would . . . clarify the statute by defining “encrypted” to mean any data at issue that was rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security.
Right to Privacy and Encryption
California recognizes that the right to privacy is a fundamental right, and has enshrined that right along with other fundamental rights in article I, section 1 of the California Constitution. The harm that can result from the theft of personal information via a data breach threatens to undermine that fundamental right. Unfortunately, because of the size of its economy and the number of consumers, the data held by California businesses and government agencies is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ 2014data_breach_rpt.pdf> [as of Jun. 23, 2015].) The frequency of data breaches in California and the threat that such breaches pose to California residents makes timely and effective notification of a breach a matter of critical importance.
However, notification of data breaches involving encrypted personal information has not traditionally raised the same policy concerns. This is because properly encrypted data is much less valuable to whomever acquires it, since the encryption functionally obscures the underlying data. Indeed, “[m]any security experts insist that there ought to be a carve-out that would allow companies to avoid disclosure requirements in a breach that exposes properly encrypted sensitive data.” (Brian Krebs, Toward Better Privacy, Data Breach Laws <http://krebsonsecurity.com/2015/01/toward-better-privacy-data-breach-laws/> [as of Jun. 23, 2015].) California’s Data Breach Disclosure Law has such an exception, stating that notice of a breach must be made when “unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
Existing law does not provide a definition of “encryption.” Taken to an extreme, encryption could be something as simple as a shift cypher, where each letter in a word is replaced by another letter some fixed number of positions down the alphabet. This bill would create a definition of “encryption,” adapted from an amendment to the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. 104–191, 110 Stat. 1936),1 that provides businesses and government agencies with some basic guidance as to the type of encryption that must be used to take advantage of the Data Breach Disclosure Law’s notification safe harbor.
Security of Encryption Keys
Modern encryption technology works by encoding information in such a way that only the person (or computer) with the encryption key can decode it. In general, each computer exchanging encrypted information has a secret key (code) that it can use to encrypt a packet of information before it is sent over a network to another computer, where it is then decrypted using the same or a mathematically related key. Maintaining the secrecy of an encryption key is what ensures compromised encrypted messages cannot be read by an unauthorized person.
As noted above, the Data Breach Notification Law contains a safe harbor for businesses and agencies that lose encrypted information in a data breach. However, recent data breaches have revealed instances where encrypted information was breached along with the encryption key. For example, the ride-hailing company Uber reported in late 2014 that “[t]housands of Uber driver names and driver’s license numbers may be in the hands of an unauthorized third party due to a data breach,” and that “one of its many databases could have potentially been accessed because one of the encryption keys required to unlock it had been compromised.” (Tracey Lien, Uber Security Breach May Have Affected up to 50,000 Drivers, Los Angeles Times (Feb. 27, 2015) <http://www.latimes.com/business/technology/la-fi-tn-uber-data-breach-20150227-story.html > [as of Jun. 24, 2015].) In breaches such as this where an encryption key is taken along with encrypted information, the compromised information has lost the effectiveness of its encryption protection. While not addressed in this bill, the Committee may wish to consider how best to address the problem of compromised encryption keys in future legislation.
Support: None Known
Opposition: None Known
HISTORY
Source: Author
Related Pending Legislation:
SB 570 (Jackson, 2015) would require entities that must provide affected individuals with notice of a data breach to provide that notice in a specified format. Specifically, this bill would require these entities to provide a one-page notice, if written, entitled “Notice of Data Breach,” in which the content required by the Data Breach Notification Law is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” This bill would state that additional information may be provided as a supplement to the notice, would clarify the requirements for providing substitute notice of a data breach, and would make other technical and clarifying changes. This bill is pending in the Assembly Privacy and Consumer Protection Committee.
AB 259 (Dababneh, 2015) would require an agency, if the agency was the source of a breach and the breach compromised a person’s social security number, driver’s license number, or California identification card number, to offer the person identity theft prevention and mitigation services at no cost for not less than 12 months. This bill is pending in the Senate Rules Committee.
Prior Legislation:
AB 1710 (Dickinson, Ch. 855, Stats. 2014) amended California’s Data Breach Notification Law to require a person or business to offer appropriate identity theft prevention and mitigation services to an affected person at no cost for not less than 12 months if the person or business was the source of a data breach. This bill also prohibited the sale, advertisement for sale, or offer to sell an individual’s social security number.
SB 46 (Corbett, Ch. 396, Stats. 2013) revised the data elements included within the definition of personal information under California’s Data Breach Notification Law by adding certain information that would permit access to an online account, and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.
AB 1149 (Campos, Ch. 395, Stats. 2013) expanded existing disclosure requirements concerning breaches of computerized data owned or licensed by state agencies to “local agencies” as defined by Government Code Section 6252(a). This bill also made certain technical corrections to the security breach notification law.
SB 24 (Simitian, Ch. 197, Stats. 2011) required any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
AB 1298 (Jones, Ch. 699, Stats. 2007), among other things, added medical information and health insurance information to the data elements that, when combined with the individual’s name, would constitute personal information requiring disclosure when acquired, or believed to be acquired, by an unauthorized person due to a security breach.
AB 1950 (Wiggins, Ch. 877, Stats. 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace, Ch. 915, Stats. 2002) enacted California’s Data Breach Notification Law and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.
Prior Vote:
Assembly Floor (Ayes 69, Noes 7)
Assembly Appropriations Committee (Ayes 11, Noes 4)
Assembly Privacy and Consumer Protection Committee (Ayes 7, Noes 1)
**************
1 HIPPA defines “unsecured protected health information,” in part, as “health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute.” (See 42 U.S.C. Sec. 17932.)
AB 964
Page 2
ASSEMBLY THIRD READING
AB 964
(Chau)
As Amended May 28, 2015
Majority vote
Committee |
Votes |
Ayes |
Noes |
Privacy |
7-1 |
Gatto, Calderon, Chau, Cooper, Dababneh, Gordon, Low |
Wilk |
Appropriations |
11-4 |
Gomez, Bloom, Bonta, Calderon, Eggman, Eduardo Garcia, Holden, Quirk, Rendon, Weber, Wood |
Bigelow, Chang, Gallagher, Wagner |
SUMMARY: Defines, for purposes of the existing data breach notification requirements for businesses and public agencies, the term "encrypted" to mean "rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security."
FISCAL EFFECT: According to the Assembly Appropriations Committee, there is a negligible fiscal impact.
COMMENTS:
Data breaches are a fast-growing threat. 2014 was a record-setting year in terms of the number of security breaches reported. According to a January 2015 report by the California Attorney General’s Office, 187 breaches were reported to the California Department of Justice in 2014, compared to 167 in 2013 and 131 in 2012.
According to the Identity Theft Resource Center, there were 783 data breaches reported nationwide in 2014 – a 27.5% increase over the previous year. The Privacy Rights Clearinghouse reports that more than 815 million records have been compromised in more than 4,489 publicly acknowledged data breaches since 2005.
Related legislation. AB 83 (Gatto) of the current legislative session requires businesses that own or maintain personal information to secure that data to the extent that any “reasonably prudent business” would provide, and specifies certain requirements and considerations that must be part of any reasonable security procedures and practices. AB 83 is pending in the Senate Judiciary Committee.
AB 259 (Dababneh) of the current legislative session requires a public agency that is the source of a data breach to offer at least 12 months of identity-theft prevention and mitigation services at no cost to affected consumers. AB 259 is pending on the suspense file in the Assembly Appropriations Committee.
SB 34 (Hill) of the current legislative session amends the Data Breach Notification Law to add to the definition of "personal information" any information or data collected through the use or operation of an automated license plate recognition system. SB 34 is pending in the Assembly Transportation Committee.
SB 570 (Jackson) of the current legislative session amends the Data Breach Notification Law to revise the language of the breach notification itself to make it clearer and more conspicuous. SB 570 is pending on the Senate Floor.
Prior legislation. AB 1710 (Dickinson), Chapter 855, Statutes of 2014, required, among other things, that businesses that maintain, own or license the personal information of California residents to use reasonable and appropriate security measures to protect the information.
AB 1950 (Wiggins), Chapter 877, Statutes of 2004, required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure.
SB 1386 (Peace), Chapter 915, Statutes of 2002, enacted California’s Data Breach Notification Law.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000549
AB 964
Page 2
ASSEMBLY THIRD READING
AB 964
(Chau)
As Amended May 13, 2015
Majority vote
Committee |
Votes |
Ayes |
Noes |
Privacy |
7-1 |
Gatto, Calderon, Chau, Cooper, Dababneh, Gordon, Low |
Wilk |
Appropriations |
11-4 |
Gomez, Bloom, Bonta, Calderon, Eggman, Eduardo Garcia, Holden, Quirk, Rendon, Weber, Wood |
Bigelow, Chang, Gallagher, Wagner |
SUMMARY: Requires data breach notifications made by businesses and public agencies to include the date of discovery of the breach in the notice to the Attorney General. Specifically, this bill:
Requires business and public agencies, for purposes of existing data breach notification requirements, to include the date of the discovery of the breach in the notice made to the Attorney General.
Defines, for purposes of the existing data breach notification requirements for businesses and public agencies, the term "encrypted" to mean "rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security."
Makes other technical or non-substantive changes.
FISCAL EFFECT: According to the Assembly Appropriations Committee, there is a negligible fiscal impact.
COMMENTS:
Purpose of this bill. This bill is intended to improve the public tracking of data breaches by including the date of the breach discovery in the required notice to the Attorney General, while also providing a clarifying definition of the term "encrypted." This bill also imposes a reasonableness requirement on a business' efforts to respond to a breach before notifying the victims. This bill is sponsored by the author.
Data breaches are a fast-growing threat. 2014 was a record-setting year in terms of the number of security breaches reported. According to a January 2015 report by the California Attorney General's Office, 187 breaches were reported to the California Department of Justice in 2014, compared to 167 in 2013 and 131 in 2012.
According to the Identity Theft Resource Center, there were 783 data breaches reported nationwide in 2014 – a 27.5% increase over the previous year. The Privacy Rights Clearinghouse reports that more than 815 million records have been compromised in more than 4,489 publicly acknowledged data breaches since 2005.
Related legislation. AB 83 (Gatto) of the current legislative session requires businesses that own or maintain personal information to secure that data to the extent that any "reasonably prudent business" would provide, and specifies certain requirements and considerations that must be part of any reasonable security procedures and practices. AB 83 is currently pending referral in the Senate Rules Committee.
AB 259 (Dababneh) of the current legislative session requires a public agency that is the source of a data breach to offer at least 12 months of identity-theft prevention and mitigation services at no cost to affected consumers. AB 259 is currently pending in the Assembly Appropriations Committee.
SB 34 (Hill) of the current legislative session amends the Data Breach Notification Law to add to the definition of "personal information" any information or data collected through the use or operation of an automated license plate recognition system. SB 34 is currently pending on the Assembly Floor.
SB 570 (Jackson) of the current legislative session amends the Data Breach Notification Law to revise the language of the breach notification itself to make it clearer and more conspicuous. SB 570 is currently pending on the Senate Floor.
Prior legislation. AB 1710 (Dickinson), Chapter 855, Statutes of 2014, required, among other things, that businesses that maintain, own or license the personal information of California residents to use reasonable and appropriate security measures to protect the information.
SB 24 (Simitian), Chapter 197, Statutes of 2011, standardized the breach notification that an agency, person, or business must issue in the event of a data breach, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
AB 1950 (Wiggins), Chapter 877, Statutes of 2004, required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure.
SB 1386 (Peace), Chapter 915, Statutes of 2002, enacted California's Data Breach Notification Law.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000462
AB 964
Page 2
Date of Hearing: May 20, 2015
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Jimmy Gomez, Chair
AB 964
(Chau) – As Amended May 13, 2015
Policy Committee: |
Privacy and Consumer Protection |
Vote: |
7 - 1 |
|
|
|
|
|
|
|
|
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill:
Requires business and public agencies, for purposes of existing data breach notification requirements, to include the date of the discovery of the breach in the notice made to the Attorney General.
Defines, for purposes of the existing data breach notification requirements for businesses and public agencies, the term "encrypted" to mean "rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security."
FISCAL EFFECT:
Negligible fiscal impact.
COMMENTS:
Purpose. This bill is intended to improve the public tracking of data breaches by including the date of the breach discovery in the required notice to the Attorney General, while also providing a clarifying definition of the term "encrypted."
Current Law. California's Data Breach Notification Law requires, in part, that public agencies and businesses notify California residents of security breaches if their unencrypted personal information was, or was reasonably believed to have been, accessed by an unauthorized person. Breaches that affect more than 500 California residents must submit a single copy of the notification to the Attorney General.
While the law contains multiple provisions that speak to the content of the notice, the notice itself may be written or electronic. Businesses may also provide "substitute" notice in cases where the cost of notice exceeds $250,000, affects more than 500,000 people, or where there is insufficient contact information. A substitute notice includes an email notice where possible, plus conspicuous posting on the business' website and notification to statewide media. Companies may also use their own notification procedures instead, if those procedures are otherwise consistent with the timing requirements of the law.Related Legislation. AB 259 (Dababneh), pending on this committee's Suspense file, requires a public agency that is the source of a data breach to offer at least 12 months of identity-theft prevention and mitigation services at no cost to affected consumers.
SB 34 (Hill), pending referral in the Assembly, amends the Data Breach Notification Law to add to the definition of “personal information” any information or data collected through the use or operation of an automated license plate recognition system."
SB 570 (Jackson), pending in the Senate, amends the Data Breach Notification Law to revise the language of the breach notification itself to make it clearer and more conspicuous.
Analysis Prepared by: Chuck Nicol / APPR. / (916) 319-2081
AB 964
Page 5
Date of Hearing: April 30, 2015
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Mike Gatto, Chair
AB 964
(Chau) – As Amended April 23, 2015
SUBJECT: Civil law: privacy
SUMMARY: Requires data breach notifications made by businesses and public agencies to include the date of discovery of the breach in the notice to the Attorney General. Specifically, this bill:
Requires business and public agencies, for purposes of existing data breach notification requirements, to include the date of the discovery of the breach in the notice made to the Attorney General.
Defines, for purposes of the existing data breach notification requirements for businesses and public agencies, the term "encrypted" to mean "rendered unusable, unreadable, or indecipherable through a security technology or methodology generally accepted in the field of information security."
Imposes a reasonableness standard on the extent of the measures necessary to determine the scope of a breach and restore the reasonable integrity of the data system, which are currently grounds for delay of the disclosure.
Makes other technical or non-substantive changes.
EXISTING LAW:
Requires a public agency, or a person or business conducting business in California, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system or data following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civil Code (CC) Section 1798.29; CC 1798.82)
Requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. (CC 1798.29(a); CC 1798.82(a))
Requires a public agency, or a person or business conducting business in California, that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system, to electronically submit that security breach notification to the Attorney General as well. (CC 1798.29(e); CC 1798.82(f))
Defines “personal information,” for purposes of the breach notification statute, to include the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. Personal information also includes a user name or email address, in combination with a password or security question and answer that would permit access to an online account. (CC 1798.29(g); CC 1798.82(h))
Defines “personal information,” for purposes of the breach notification statute, to exclude publicly available information that is lawfully made available to the general public from federal, state, or local government records. (CC 1798.29(h); CC 1798.82(i))
FISCAL EFFECT: Unknown
COMMENTS:
Purpose of this bill. This bill is intended to improve the public tracking of data breaches by including the date of the breach discovery in the required notice to the Attorney General, while also providing a clarifying definition of the term "encrypted." The bill also imposes a reasonableness requirement on a business' efforts to respond to a breach before notifying the victims. AB 964 is author-sponsored.
Author's statement. According to the author, "any person or business or state agency that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification… to the Attorney General… Currently, when businesses and state agencies submit their sample copy of the security breach notification they do so through a form which provides the option and place to enter 'Date of Discovery of Breach.' The date of discovery of breach is important, because it starts the clock for notice to a consumer."
"Furthermore, under current law, if the personal information that was stolen was encrypted, businesses and agencies are not required to provide notice. This provision, serves to encourage businesses and agencies who store personal information to adopt encryption so that if information is stolen, that information would be deemed less vulnerable to abuse. However, encryption is not clearly defined in statue."
Data breaches are a fast-growing threat. 2014 was a record-setting year in terms of the number of security breaches reported. According to a January 2015 report by the California Attorney General’s Office, 187 breaches were reported to the California Department of Justice in 2014, compared to 167 in 2013 and 131 in 2012.
According to the
Identity Theft Resource Center, there were 783 data breaches reported
nationwide in 2014 – a 27.5% increase over the previous year. The
Privacy Rights Clearinghouse reports that more than 815 million
records have been compromised in more than 4,489 publicly
acknowledged data breaches since 2005.
California's Data Breach Notification Law. California's Data Breach Notification Law requires, in part, that public agencies and businesses notify California residents of security breaches if their unencrypted personal information was, or was reasonably believed to have been, accessed by an unauthorized person.
"Personal information" is defined as a person’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver’s license number or California identification card number; account number, credit or debit card number, in combination with any required security code, access code, or password; medical information; or, health insurance information. Personal information also includes "a user name or email address in combination with a password or security question and answer that would permit access to an online account."
The disclosure must be made in "the most expedient time possible and without unreasonable delay," and must also be "consistent with the legitimate needs of law enforcement…or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system." Breaches that affect more than 500 California residents must submit a single copy of the notification to the Attorney General.
While the law contains multiple provisions that speak to the content of the notice, the notice itself may be written or electronic. Businesses may also provide "substitute" notice in cases where the cost of notice exceeds $250,000, affects more than 500,000 people, or where there is insufficient contact information. A substitute notice includes an email notice where possible, plus conspicuous posting on the business' website and notification to statewide media. Companies may also use their own notification procedures instead, if those procedures are otherwise consistent with the timing requirements of the law.
Provisions of the notification law cannot be waived, and any customer injured by a violation has a right to bring suit in civil court for an injunction and for any damages, attorney's fees and court costs.
Technical amendment. According to the author's office, the inclusion of the word "reasonably" as a qualifier for the measures a business may take to respond to a breach and thereby delay notification was a drafting error on the part of Legislative Counsel. The term should be removed to properly reflect the intent of the author and to prevent further differentiation between the data breach provisions for businesses and those for public agencies.
On page 7, line 4, strike the word "reasonably"
Related legislation. AB 83 (Gatto) requires businesses that own or maintain personal information to secure that data to the extent that any 'reasonably prudent business' would provide, and specifies certain requirements and considerations that must be part of any reasonable security procedures and practices. AB 83 is currently pending in the Assembly Privacy and Consumer Protection Committee.
AB 259 (Dababneh) requires a public agency that is the source of a data breach to offer at least 12 months of identity-theft prevention and mitigation services at no cost to affected consumers. AB 259 is currently on the Suspense File in the Assembly Appropriations Committee.
SB 34 (Hill) amends the Data Breach Notification Law to add to the definition of “personal information” any information or data collected through the use or operation of an automated license plate recognition system." SB 34 is currently pending in the Senate Appropriations Committee.
SB 570 (Jackson) amends the Data Breach Notification Law to revise the language of the breach notification itself to make it clearer and more conspicuous. SB 570 is currently pending in the Senate Judiciary Committee.
Prior legislation. AB 1710 (Dickinson and Wieckowski), Chapter 855, Statutes of 2014, required, among other things, that businesses that maintain, own or license the personal information of California residents to use reasonable and appropriate security measures to protect the information.
SB 46 (Corbett), Chapter 396, Statutes of 2013, revised certain data elements included within the definition of personal information under California’s Data Breach Notification Law to include online account information.
SB 24 (Simitian), Chapter 197, Statutes of 2011, standardized the breach notification that an agency, person, or business must issue in the event of a data breach, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.
AB 1950 (Wiggins), Chapter 877, Statutes of 2004, required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party to require by contract that those entities maintain reasonable security procedures.
SB 1386 (Peace), Chapter 915, Statutes of 2002, enacted California’s Data Breach Notification Law, requiring a state agency, a person or business that conducts business in California that owns or licenses computerized data that includes personal information to disclose in specified ways, any breach of the security of the data, as to any resident of California whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.
REGISTERED SUPPORT / OPPOSITION:
Support
None received.
Opposition
America’s Health Insurance Plans (3/26/15 version)
California Bankers Association (3/26/15 version)
California Chamber of Commerce (3/26/15 version)
California Credit Union League (3/26/15 version)
California Grocers Association (3/26/15 version)
California Hospital Association (3/26/15 version)
California Land Title Association (3/26/15 version)
California Medical Association (3/26/15 version)
California Retailers Association (3/26/15 version)
CTIA – The Wireless Association (3/26/15 version)
Direct Marketing Association (3/26/15 version)
Internet Association (3/26/15 version)
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200
Discussed in Hearing
47SEC
Assembly Floor
4MIN
Senate Floor
4MIN
Senate Floor
3MIN
Senate Standing Committee on Judiciary
2MIN
Assembly Floor
1MIN
Assembly Floor
2MIN
Assembly Standing Committee on Appropriations
10MIN
Assembly Standing Committee on Privacy and Consumer Protection
Bill Author
Bill Co-Author(s):