Existing law requires a person or business conducting business in California and any state or local agency, as defined, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person in the most expedient time possible and without unreasonable delay, as specified. Existing law requires a person or business, if it was the source of the breach, to offer to provide appropriate identity theft prevention and mitigation services at no cost to the person whose information was or may have been breached if the breach exposed or may have exposed the persons social security number, drivers license number, or California identification card number.

This bill also would require a state or local agency, if it was the source of the breach, to offer to provide appropriate identity theft prevention and mitigation services at no cost to a person whose information was or may have been breached if the breach exposed or may have exposed the persons social security number, drivers license number, or California identification card number.

The bill would make other clarifying and nonsubstantive changes.

Date of Hearing: April 5, 2017

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 241

Author:(Dababneh) – As Introduced Ver:January 30, 2017

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires a public agency that is the source of a data breach to offer affected customers at least 12 months of identity theft prevention and mitigation services at no cost. Specifically, this bill:

1. Requires a public agency that is the source of a data breach, where a person’s name and Social Security number or driver license number are exposed, to provide affected persons with notice of the breach and at least 12 months of appropriate identity theft prevention and mitigation services at no cost.
   
2. Requires a public agency to give affected persons all information necessary to take advantage of the offer for identity theft prevention and mitigation services.
   
3. Requires a public agency that delays the specified notification at the direction of law enforcement to make the notification promptly after a law enforcement agency determines that notification will not compromise any criminal investigation.
   

FISCAL EFFECT:

1. Unknown potential GF and/or special fund costs, in the hundreds of millions to billions of dollars range for a major security breach at an agency that holds substantial personal data. Unknown potential GF and/or special fund costs in the hundreds of thousands to low millions of dollars for a relatively minor data breach.

For example, if the Department of Motor Vehicles were to have a breach of one-quarter of its 26 million driver license records, the cost for providing identity theft prevention and mitigation services to the affected individuals for one year would be over $1 billion, assuming a cost of $15 monthly per person. If a breach were to occur and require that 6,000 individuals receive identity theft protection at cost of $15 per month, the cost for one year would be about $1 million.

1. Unknown potentially significant nonreimbursable local costs, depending of the scope of a data breach.

COMMENTS:

1. Background. Existing law requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. This requirement does not apply to the Judiciary, the Legislature, or the University of California. Existing law also requires a person or business that is the source of a breach of Social Security numbers or driver license numbers, and is required to provide notice of the breach, to offer an identity theft protection or mitigation service to affected individuals at no cost, for no less than 12 months. However, public agencies are not subject to the requirement to provide identity theft protection or mitigation services.
2. Purpose. According to the author, this bill “will protect consumers in the event of a data breach at public agencies by requiring identity theft prevention or mitigation services.” This bill would require public agencies to provide identity theft protection or mitigation services to affected individuals at no cost, for no less than 12 months. By doing so, this bill would place the same requirements on public agencies that existing law places on a person or business that is the source of a breach of a person’s name and Social Security number or driver license number.
3. Prior Legislation. This bill is almost identical to AB 259 (Dababneh) of 2015 that sought to require public agencies to provide identity theft protection and mitigation services for data breaches where a person’s name and Social Security number or driver license number are exposed. AB 259 was held on Suspense in Senate Appropriations.
4. Implementation Issues and Associated Costs. The bill in its current form raises a few questions about how the provisions would be implemented. First, the bill does not specify whether a single state agency, such as the California Department of Technology or the Department of General Services would have responsibility for coordinating the provision of identity theft prevention or mitigation services in the event of a data breach. A coordinated approach would ensure that services provided by various state agencies are consistent and could also potentially achieve some economies of scale, thereby reducing costs.

Second, the bill does not require state agencies to have a contract for identity theft prevention and mitigation services in place prior to a data breach occurring. This means that a state agency could have to go through the state’s procurement process to hire a vendor to provide the services required under this bill after a data breach has occurred, which would likely delay the provision of the intended services to individuals affected by the data breach. Requiring the procurement of a contract in advance of a data breach that allows state agencies to access the services in an “on-call” manner would expedite the provision of identity theft prevention and mitigation services and better achieve the intended goals of this bill. This approach would likely increase costs in the short-term because the state would pay to procure a contract and maintain it on an on-call basis even if no data breaches occur. However, in the event of a data breach, having a contract already in place could reduce costs because identity theft prevention services would likely be more effective and limit the need for extensive and potentially costly identity theft mitigation that could be required if there is a delay in providing services. Such a procurement approach would also likely require a single state agency to coordinate the provisions of this bill as discussed above.

Lastly, in the event of a major data breach the potential costs would be extremely high under an approach where the state contracts for identity theft prevention and mitigation services. Additionally, it is unlikely that any single vendor who provides identity theft prevention and mitigation services could handle the volume of cases that would be generated in the event of a breach of tens of millions of records. Thus, in the event of a major breach, it might be necessary and potentially more cost effective for the state to evaluate alternatives to providing identity theft protection and mitigation services, however, such potential alternatives are not identified in the bill and might not be allowed under the provisions of the bill in its current form.

Analysis Prepared by: Jessica Peters / APPR. / 916 319-2081

Date of Hearing: March 14, 2017

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 241 (

Author:Dababneh) – As Introduced Ver:January 30, 2017

SUBJECT: Personal information: privacy: state and local agency breach

SUMMARY: Requires a public agency that is the source of a data breach to offer at least 12 months of identity theft prevention and mitigation services at no cost to affected consumers. Specifically, this bill:

1. Requires a public agency that is the source of a data breach, and is required to provide affected persons with notice of the breach, to provide at least 12 months of appropriate identity theft prevention and mitigation services at no cost to the affected persons.
   
2. Requires a public agency to give affected persons all information necessary to take advantage of the offer for identity theft prevention and mitigation services.
3. Requires a public agency to offer identity theft prevention and mitigation services only if the breach exposed, or may have exposed, a person’s name in combination with a Social Security number or a driver's license number.
   
4. Requires a public agency that delays the specified notification at the direction of law enforcement to make the notification promptly after a law enforcement agency determines that notification will not compromise any criminal investigation.
   
5. Makes other technical and nonsubstantive amendments.

EXISTING LAW:

1. Requires a public agency, person, or business that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. Note that this requirement does not apply to the Judiciary, the Legislature, or the University of California. (Civil Code (Civ. Code) Sections 1798.29(a), (c); 1798.82(a), (c))
   
2. Requires a person or business that is the source of a breach of Social Security numbers or driver’s license numbers, and is required to provide notice of the breach, to offer an identity theft protection or mitigation service to affected individuals at no cost, for no less than 12 months. (Civ. Code 1798.82 (d)(2)(G))
   
3. Requires a public agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code 1798.29(b), 1798.82(b))
   
4. Defines “personal information,” for purposes of the breach notification statute, to include the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code 1798.29(g), (h), 1798.82(h), (i))

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill is intended to provide individuals affected by a state or local agency data breach with at least 12 months of identity theft protection for free. While existing law already requires any private business responsible for a significant breach to offer at least 12 months of identity theft prevention mitigation services, no such requirement exists for public agencies. This bill would extend these protections to include state and local agencies. This measure is author-sponsored.
   
2. Author’s statement: According to the author's office, “Whether it comes from the private or the public sector, a data breach can have serious detrimental effects for California’s consumers. It is important that state agencies are held to the same standard as private entities when these incidents occur. Californians must feel confident that state agencies and departments are protecting their sensitive information. This bill enhances consumer protections and ensures that the state is taking necessary steps to prevent fraud and identity theft.”
3. Recent data breaches: According to the California Department of Justice’s most recent “California Data Breach Report,” from 2012 to 2015, the Attorney General received 657 reports of data breaches, which compromised the information of over 49 million Californians. In 2015 alone, nearly three in five Californians were victims of a data breach when 24 million records were put at risk. Social Security numbers made up nearly half (48 %) of all breaches from 2012 to 2015. The potential costs to consumers of having their SSNs stolen are very high as thieves can open new credit accounts, take out loans, and apply for government benefits among other fraudulent activities. In addition to the variety of abuses, SSNs are difficult to change, which makes SSN fraud extremely challenging to detect, prevent, and recover from.
   
   Unfortunately, state and local agencies are not immune to data breaches. The following California public agencies have reported breaches in recent years: California State University, Department of Corrections and Rehabilitation, Department of Public Health, Department of State Hospitals, Correctional Health Care Services, Department of Social Services, Department of Justice, Department of Child Support Services, Employment Development Department, and the Department of Motor Vehicles.
   
4. California's Data Breach Notification Law: In 2003, California became the first state in the nation to require businesses and government agencies to notify California residents of security breaches if unencrypted personal information was, or was reasonably believed to have been, stolen. (SB 1386 (Peace), Chapter 915, Statutes of 2002)

The notification law does not apply to "encrypted" information, which creates an incentive for businesses and government agencies to encrypt personal data and thereby avoid the notice requirement. Also, notice is not required unless the data breach involved "personal information" relating to a California resident. "Personal information" means a person’s first name or first initial and last name in combination with one or more of the following data elements:

• 1. Social Security number;
  2. Driver’s license number or California identification card number;
  3. Account number, credit or debit card number, in combination with any required security code, access code, or password;
  4. Medical information; health insurance information; or
  5. A user name or email address in combination with a password or security question and answer that would permit access to an online account.
     

"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

The Data Breach Notification Law has two distinct parts: one part that applies to state and local agencies, which is located in the Information Practices Act of 1977 (Civ Code 1798.29), and one part that applies to businesses (Civ. Code 1798.82). Both parts began as mirror images of each other. Over the years, however, as the Legislature has refined and updated the Data Breach Notification Law, the language of the two parts has not always been kept consistent.

In 2014, the Legislature passed and Governor Brown signed AB 1710 (Dickinson), which required an affected business to offer appropriate identity theft prevention and mitigation services for at least 12 months at no cost to people affected by the breach, in cases where a breach involved Social Security or driver’s license numbers. This bill would extend these same protections to persons affected by a state or local agency data breach.

1. The benefits of identity theft prevention and mitigation services: According to the author, the term “identity theft prevention and mitigation services” includes credit report monitoring services, which help prevent fraud and identity theft by giving consumers ongoing information about credit card account balance increases and new loans and credit cards opened in the consumer’s name. Identity theft prevention and mitigation services may also include security freeze services offered by credit reporting agencies, which stop identity thieves from opening up new accounts in a victim’s name by “freezing” the victim’s credit report, so that lending institutions cannot check a credit report or credit score to approve new loans or credit cards.
2. Questions about the “if any” clause: There has been some discussion within the legal community as to whether or not the phrasing of the existing statute as it applies to businesses – which is mirrored in this bill for public agencies – is open to more than one interpretation. As passed by the Legislature and signed by Governor Brown, AB 1710 (Dickinson), requires a business that issues a breach notification to offer “appropriate identity theft prevention and mitigation services, if any” to affected individuals at no cost. However, the question has been raised as to whether or not the offer of services itself is required or discretionary.
   
   Read plainly, the “if any” clause (Civ Code 1798.29 (d)(2)(G)) would presumably modify the preceding phrase “appropriate identity theft prevention and mitigation services” – i.e., if there are no prevention or mitigation services that are appropriate for a consumer after a particular breach, then the business is not required to offer services. For example, a retail breach involving the theft of credit card numbers might be appropriately mitigated by re-issuing cards with new card numbers rather than setting up credit reporting monitoring services for a year, since theft of a credit card number is not enough information for criminals to open up new accounts in the cardholder’s name. However, the presumption is in favor of the provision of services unless there is no service that would help a consumer prevent or mitigate identity theft.
   
   Conversely, the law firm Morrison & Foerster suggested in an online Client Alert on October 9, 2014, that the “if any” clause could be interpreted to modify the “offer” of services itself to make it voluntary. Under this reading, a business would simply be permitted by statute – not required – to offer identity theft prevention and mitigation services after a breach.
   
   The question is pertinent to this bill because this bill’s language mirrors the existing language in question from AB 1710 (Dickinson) in applying the requirement to public agencies. While perhaps it would be ideal to clarify the matter in statute, the author's office has previously stated to Committee staff that it is the intent of this bill to require – not simply authorize – public agencies to provide affected consumers with identity theft prevention and mitigation services for a minimum of 12 months.

The author's stated intent would appear to be in line with the intent of AB 1710 as well. The June 24, 2014, Senate Judiciary Committee analysis of AB 1710 describes that bill as imposing a requirement, not a discretionary authorization: “This bill would also require the person or business providing notification that was the source of the breach to provide to affected consumers with identity theft prevention and mitigation services for a minimum of 12 months.”

As such, it is the understanding of Committee staff that the language of this bill requires an offer of identity theft prevention and mitigation services, except in those cases where there is clearly no appropriate service applicable to a particular consumer's situation.

1. Arguments in support: According to the Los Angeles County Professional Peace Officers Association, “This is a simple bill to ensure public agencies are held to the same standard as private entities when data breaches occur in order to build confidence in our public institutions to handle personal information in the 21^st century.” A coalition of business groups, including the California Chamber of Commerce and Computing Technology Industry Association – CompTIA states, “The level of protection an affected individual receives should not be dependent on the type of entity breached. AB 241 ensures all entities maintaining personal information offer theft prevention and mitigation services.”
2. Arguments in opposition: The California State Association of Counties, League of California Cities, and Urban Counties of California state in opposition to this bill, “Our coalition is troubled that a lack of specificity [regarding what are “appropriate” remedial services] could lead to an expansive opinion of what measures must be taken by local governments to remedy a data breach. […] The additional requirement to provide the free services outlined in AB 241 could pose crippling costs to our agencies.”
3. Prior Legislation: AB 259 (Dababneh) of 2016 was identical to this bill. AB 259 passed this committee unanimously, but was later held on the Senate Appropriations suspense file.

AB 1710 (Dickinson), Chapter 855, Statutes of 2014, required a person or business that is the source of a breach of Social Security numbers or driver’s license numbers to offer an identity theft protection or mitigation service to affected individuals at no cost, for no less than 12 months. It expands the information security law to require businesses that maintain, own or license the personal information of California residents to use reasonable and appropriate security measures to protect the information. It also prohibits the sale or marketing of Social Security numbers, with certain exceptions.

SB 1386 (Peace), Chapter 915, Statutes of 2002, enacted California’s Data Breach Notification Law and required a public agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1386 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.

REGISTERED SUPPORT / OPPOSITION:

Support

Association of California Life & Health Insurance Companies

California Bankers Association

California Business Properties Association

California Cable and Telecommunications Association

California Chamber of Commerce

California Grocers Association

Computing Technology Industry Association – CompTIA

Los Angeles County Professional Peace Officers Association

Organization of SMUD Employees

Personal Insurance Federation of California

San Diego Court Employees

San Luis Obispo County Employees

Opposition

California State Association of Counties

League of California Cities

Urban Counties of California

Analysis Prepared by: Jennie Bretschneider / P. & C.P. /