Existing law requires a person or business conducting business in California or an agency that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose encrypted or unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, as specified.

If the breach exposed a social security number, a drivers license, or a California identification card number, existing law requires the notification to include the toll-free telephone numbers and addresses of the major credit reporting agencies.

This bill would, if the security breach exposed a social security number, a drivers license number, or a California identification card number, require the notice to also include the Internet Web site address of each of the major credit reporting agencies and a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies.

Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose encrypted or unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, as specified. Existing law requires the security breach notification to include specified information, including, among other things, if

If the breach exposed a social security number, a drivers license, or a California identification card number, existing law requires the notification to include the toll-free telephone numbers and addresses of the major credit reporting agencies.

This bill would, if the security breach exposed a social security number, a drivers license number, or a California identification card number, require the notice to also include the Internet Web site address of each of the major credit reporting agencies and a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies.

Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose encrypted or unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, as specified. Existing law requires the security breach notification to include specified information, including, among other things, if the breach exposed a social security number, a drivers license, or a California identification card number, the toll-free telephone numbers and addresses of the major credit reporting agencies.

The bill would also require the notification provided to an affected person, if the breach exposed or may have exposed specified personal information, to include, among other things, notice that the affected person may elect to place a security freeze on his or her credit report and and, if the person or business providing the notification was the source of the breach, an explanation of how a security freeze differs from the identity theft prevention and mitigation services. services it is required to offer to provide to the affected person, or, if it was not the source of the breach, a general description of a security freeze, as specified.

The Information Practices Act of 1977 requires an agency, as defined, to maintain in its records only personal information that is relevant and necessary to accomplish a purpose of the agency required or authorized by law. Existing law regulates the disclosure of personal information under these provisions, as specified.

This bill would state the intent of the Legislature to enact legislation relating to information security practices.

 THIRD READING 

Bill No: AB 2678

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 7-0, 6/19/18

AYES: Jackson, Moorlach, Anderson, Hertzberg, Monning, Stern, Wieckowski

ASSEMBLY FLOOR: 71-0, 5/10/18 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST:

This bill provides that a person or business that is required to provide a security breach notification pursuant to California’s Data Breach Notification Law must include therein a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies and include the mailing address and Internet Web site address of the major credit reporting agencies, as specified.

ANALYSIS:

Existing law:

1. Requires, through the data breach notification law, any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)
2. Requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).)
3. Provides that an agency, person or business that is required to issue a security breach notification shall meet specified requirements. The notification must be written in plain language, meet certain type and format requirements, and be titled “Notice of Data Breach.” The security breach notification is required to include specified information. (Civ. Code Secs. 1798.29(d), 1798.82(d).)
4. Authorizes an agency, person, or business to also include in the security breach notification information about what the person or business has done to protect individuals whose information has been breached; or advice on steps that the person whose information has been breached may take to protect himself or herself. (Civ. Code Secs. 1798.29(d), 1798.82(d).)
5. Permits a consumer to place a security freeze on the consumer’s credit report by making a request in writing by mail to a consumer credit reporting agency (CCRA). “Security freeze” means a notice placed in a consumer’s credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the CCRA from releasing the consumer’s credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumer’s credit report may not be released to a third party without prior express authorization from the consumer. This provision does not prevent a CCRA from advising a third party that a security freeze is in effect with respect to the consumer’s credit report. (Civ. Code Sec. 1785.11.2(a).)
6. Requires a CCRA to place a security freeze on a consumer’s credit report within three business days after receiving the consumer’s request. (Civ. Code Sec. 1785.11.2(b).)
7. Permits a consumer to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place and requires the consumer to provide specified information to the credit reporting agency so that the freeze may be temporarily lifted. (Civ. Code Sec. 1785.11.2(d).)
8. Authorizes a CCRA to develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report in an expedited manner. (Civ. Code Sec. 1785.11.2(f).)
9. Requires a security freeze to remain in place until the consumer requests that the security freeze be removed. (Civ. Code Sec. 1785.11.2(j).)
10. Provides that the above provisions do not prevent a CCRA from charging fees. (Civ. Code Sec. 1785.11.2(m).)

This bill provides that an agency, person or business that is required to provide a security breach notification pursuant to California law must include the following if the underlying breach exposed a social security or a driver’s license or California identification card number:

• the toll-free telephone numbers, mailing address, and Internet Web site address of the major credit reporting agencies; and
• a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies.

Background

“If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies.” (Seena Gressin, The Equifax Data Breach: What to Do (Sep. 9, 2017) Federal Trade Commission (FTC) <https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do (as of Mar. 29, 2018).) The infamous breach at Equifax lasted at least several months in 2017. The hackers involved were able to access people’s names, social security numbers, birth dates, addresses, and driver’s license numbers. Over 200,000 consumers also had their credit card numbers stolen.

There is evidence that the massive hack of personal information has led to extensive identity theft with the thieves using the stolen information to apply for mortgages, credit cards, and student loans. The information is also being used to tap into bank accounts, to file insurance claims, and to incur massive debts on behalf of affected consumers. A nation-wide class action suit has been filed against Equifax, Allen et al. v. Equifax, which alleges the company “failed spectacularly” in its legal responsibilities to protect consumers’ confidential data. It also alleges that the company failed to take steps to upgrade its security protocols, such as installing a remedial patch provided by a software maker, and then delayed informing consumers about the breach, thereby preventing them from taking steps to minimize the damage.

In the wake of the breach, there was a flood of information on what consumers could do to protect themselves. Equifax offered consumers free credit monitoring with controversial terms of use. The FTC’s Web site provided consumers a list of recommended steps, including checking credit reports, monitoring accounts more closely, and filing taxes early. In addition, the site recommended consumers consider placing a credit freeze on their files. A credit freeze makes it harder for someone to open a new account in the consumer’s name.

Under existing California law, consumers can request in writing by mail that each CCRA place a credit freeze on their credit reports for a fee. Recent federal legislation was signed into law, but has not taken effect, that makes credit freezes free. This bill provides that an agency, person or business that is required to provide a security breach notification pursuant to California law must include a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies, when the breach exposed a social security number or a driver’s license or California identification card number. The notification also needs to include the mailing address and Internet Web site address of the major credit reporting agencies.

Comments

The author states:

With large scale data breaches like Equifax becoming the norm, our response to identity theft must be more thoughtful. While data breach notifications provide important information, including the contact information for Consumer Credit Reporting Agencies, they do not alert a consumer to the most effective tool to prevent financial fraud, a security freeze. With this bill, Californians whose sensitive personal information has been stolen will become aware that security freezes are available to them, and can make an informed decision on how they want to protect their financial future.

Ensuring consumers are aware of their ability to place a freeze on their credit

A credit file is a report detailing a consumer’s credit history, compiled by a CCRA such as Experian, Trans Union, or Equifax. The file contains information such as annual income, outstanding debt, bill-paying history, the number, types, and age of accounts, current and previous addresses, and the consumer’s social security number. Under federal law, a CCRA may disclose information contained in a credit report to current and prospective creditors, insurers, employers, provided the consumer has authorized the disclosure, and others who have a “legitimate business need” in connection with a business transaction initiated by the consumer. (15 U.S.C. Sec. 1681b.) Federal law requires CCRAs to give consumers one free credit report each year. (15 U.S.C. Sec. 1681j.)

In 2001, California became the first state in the nation to give consumers the right to place a “freeze” on their credit reports, which prohibits a CCRA from releasing a consumer’s credit report without the express authorization of the consumer while the freeze is in place. [See SB 168 (Bowen, Chapter 720, Statutes of 2001).] Freezes placed on credit reports can be a useful tool in frustrating the ability of identity thieves to open new lines of credit using another person’s stolen identity. Since that time, all 50 states have followed California’s lead and enacted security freeze legislation, limiting disclosure of consumers’ credit reports. Under current law, security freezes are available to any consumer with a credit report, but individuals who have never had credit in their names, such as children, may not have a credit report on file for which a freeze could be placed. Under existing California law, consumers must pay fees for these freezes, can only request them by mail, and must wait three days.

Recent federal legislation, the Economic Growth, Regulatory Relief, and Consumer Protection Act, has been signed into law that requires such freezes to be done free of charge by the CCRAs. Upon receiving a request from a consumer, a CCRA will have to place a freeze not later than one day after receiving the request by telephone or secure electronic means and not later than three business days if received by mail. CCRAs are required to establish a Web page where consumers can allow such freezes to be initiated and requires the FTC to establish a single Web page that includes a link to each of the CCRA’s Web pages.

Unfortunately, because of the size of California’s economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy /2014data_breach_rpt.pdf [as of Apr. 20, 2015].)

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. (California Department of Justice, California Data Breach Report (Feb. 2016) <https://oag.ca.gov/breachreport2016 [as of Apr. 30, 2017].) In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

California’s data breach notification law requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. Such breach notifications must be titled “Notice of Data Breach” and are required to meet certain formatting requirements and include specific information.

This bill requires that when an agency, person, or business is required to issue these notifications, it must also include a notice that informs the consumer that information related to security freezes and fraud alerts is available from the CCRAs where the breach exposes a social security number or a driver’s license or California identification card number.

This makes it more likely that affected consumers are given helpful information in the wake of a breach on their rights to freeze their credit and place fraud alerts in their files. This better equips consumers with the tools to prevent identity theft in the wake of a data breach.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT: (Verified 6/22/18)

None received

OPPOSITION: (Verified 6/22/18)

None received

ASSEMBLY FLOOR: 71-0, 5/10/18

AYES: Acosta, Aguiar-Curry, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooper, Cunningham, Dahle, Daly, Eggman, Fong, Frazier, Gallagher, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NO VOTE RECORDED: Travis Allen, Cooley, Flora, Friedman, Cristina Garcia, Harper, Obernolte

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

6/26/18 11:13:53

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: AB 2678 (Author:Irwin)

Version: June 7, 2018

Hearing Date: June 19, 2018

Fiscal: No

Urgency: No

Consultant: CK

SUBJECT

Privacy: personal information: breach: notification

DESCRIPTION

This bill would provide that a person or business that is required to provide a security breach notification pursuant to California’s Data Breach Notification Law must include therein a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies and include the mailing address and Internet Web site address of the major credit reporting agencies, as specified.

BACKGROUND

”If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies.” (Seena Gressin, The Equifax Data Breach: What to Do (Sep. 9, 2017) Federal Trade Commission <https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do> (as of Mar. 29, 2018).) The infamous breach at Equifax lasted at least several months in 2017. The hackers involved were able to access people’s names, Social Security numbers, birth dates, addresses, and driver’s license numbers. Over 200,000 consumers also had their credit card numbers stolen.

There is evidence that the massive hack of personal information has led to extensive identity theft with the thieves using the stolen information to apply for mortgages, credit cards, and student loans. The information is also being used to tap into bank accounts, to file insurance claims, and to incur massive debts on behalf of affected consumers. A nation-wide class action suit has been filed against Equifax, Allen et al. v. Equifax, which alleges the company “failed spectacularly” in its legal responsibilities to protect consumers’ confidential data. It also alleges that the company failed to take steps to upgrade its security protocols, such as installing a remedial patch provided by a software maker, and then delayed informing consumers about the breach, thereby preventing them from taking steps to minimize the damage.

In the wake of the breach, there was a flood of information on what consumers could do to protect themselves. Equifax offered consumers free credit monitoring with controversial terms of use. The Federal Trade Commission’s Web site provided consumers a list of recommended steps, including checking credit reports, monitoring accounts more closely, and filing taxes early. In addition, the site recommended consumers consider placing a credit freeze on their files. A credit freeze makes it harder for someone to open a new account in the consumer’s name.

Under existing California law, consumers can request in writing by mail that each consumer credit reporting agency place a credit freeze on their credit reports for a fee. Recent federal legislation was signed into law, but has not taken effect, that makes credit freezes free. This bill would provide that a person or business that is required to provide a security breach notification pursuant to California law must include a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies, when the breach exposed a social security number or a driver’s license or California identification card number. The notification would also need to include the mailing address and Internet Web site address of the major credit reporting agencies.

CHANGES TO EXISTING LAW

Existing law, the Information Practices Act of 1977, declares that the right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them. It further states the following legislative findings:

• the right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies;
• the increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information; and
• in order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code Sec. 1798 et seq.)

Existing law, the California Customer Records Act, provides requirements for the maintenance and disposal of customer records and the personal information contained therein. It provides the following definitions:

• “business” means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution, as specified. The term includes an entity that disposes of records;
• “records” means any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed, or electromagnetically transmitted. “Records” does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number;
• “customer” means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business;
• “individual” means a natural person; and
• “personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Sec. 1798.80 et seq.)

Existing law states it is the intent of the Legislature to ensure that personal information about California residents is protected and to encourage businesses that own, license, or maintain personal information about Californians to provide reasonable security for that information. Existing law defines the terms “own” and “license” to include personal information that a business retains as part of the business’ internal customer account or for the purpose of using that information in transactions with the person to whom the information relates. The term “maintain” includes personal information that a business maintains but does not own or license. (Civ. Code Sec. 1798.81.5(a).)

Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure and requires such businesses to contractually require nonaffiliated third parties to which it discloses such personal information to similarly protect that information. (Civ. Code Sec. 1798.81.5(b), (c).)

Existing law requires a business to take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means. (Civ. Code Sec. 1798.81.)

Existing law, the data breach notification law, requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)

Existing law requires any agency, person, or business that maintains computerized data that includes personal information that the agency, person, or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(b), 1798.82(b).) “Personal information” for the purposes of these provisions, means either of the following:

• an individual’s first name or first initial and the individual’s last name in combination with one or more specified data elements, such as social security number, medical information, health insurance information, or credit card number, when either the name or the data elements are not encrypted or redacted; or
• a username or email address in combination with a password or security question and answer that would permit access to an online account. (Civ. Code Secs. 1798.29(g) and (h); 1798.82(h) and (i).)

Existing law provides that an agency, person or business that is required to issue a security breach notification shall meet specified requirements. The notification must be written in plain language, meet certain type and format requirements, and be titled “Notice of Data Breach.” The security breach notification shall include, under specified headings, the following information:

• the name and contact information of the reporting person or business subject to this section;
• a list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
• if the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice;
• whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided;
• a general description of the breach incident, if that information is possible to determine at the time the notice is provided;
• the toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a driver’s license or California identification card number;
• if it is a person or business providing the notification and the person or business was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, which must be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed specified personal information. (Civ. Code Secs. 1798.29(d), 1798.82(d).)

Existing law authorizes an agency, person, or business to also include in the security breach notification any of the following:

• information about what the person or business has done to protect individuals whose information has been breached; or
• advice on steps that the person whose information has been breached may take to protect himself or herself. (Civ. Code Secs. 1798.29(d), 1798.82(d).)

Existing law declares any waiver of the provisions of the California Customer Records Act contrary to public policy and void and unenforceable. It provides any customer injured by a violation of these provisions a civil right of action to recover damages and authorizes injunctive relief against such businesses. (Civ. Code Sec. 1798.84.)

Existing law, the California Consumer Credit Reporting Agencies Act (Civ. Code Sec. 1785.1 et seq.) and the Federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.), require consumer credit reporting agencies to adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, hiring of a dwelling unit, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information. (Civ. Code Sec. 1785.1(d); 15 U.S.C. Sec. 1681(b).)

Existing law permits a consumer to place a security freeze on the consumer’s credit report by making a request in writing by mail to a consumer credit reporting agency. “Security freeze” means a notice placed in a consumer’s credit report, at the request of the consumer, and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumer’s credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumer’s credit report may not be released to a third party without prior express authorization from the consumer. This provision does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer’s credit report. (Civ. Code Sec. 1785.11.2(a).)

Existing law requires a credit reporting agency to place a security freeze on a consumer’s credit report within three business days after receiving the consumer’s request. (Civ. Code Sec. 1785.11.2(b).)

Existing law permits a consumer to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place and requires the consumer to provide specified information to the credit reporting agency so that the freeze may be temporarily lifted. (Civ. Code Sec. 1785.11.2(d).)

Existing law authorizes a consumer credit reporting agency to develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report in an expedited manner. (Civ. Code Sec. 1785.11.2(f).)

Existing law requires a security freeze to remain in place until the consumer requests that the security freeze be removed. (Civ. Code Sec. 1785.11.2(j).)

Existing law provides that the above provisions do not prevent a consumer credit reporting agency from charging fees. (Civ. Code Sec. 1785.11.2(m).)

Existing law provides that specified written disclosures by a consumer credit reporting agency to any consumer shall include a written summary of specified rights the consumer has and, in the case of a consumer credit reporting agency that compiles and maintains consumer credit reports on a nationwide basis, a toll-free telephone number that the consumer can use to communicate with the consumer credit reporting agency. Existing law provides a safe harbor disclosure satisfying this requirement, including language regarding what charges can be made by a consumer credit reporting agency in connection with placing, lifting, removing, or replacing a security freeze. (Civ. Code Sec. 1785.15(f).)

This bill would provide that a person or business that is required to provide a security breach notification pursuant to California law must include the following if the underlying breach exposed a social security or a driver’s license or California identification card number:

• the toll-free telephone numbers, mailing address, and Internet Web site address of the major credit reporting agencies; and
• a notice instructing the affected person that information related to security freezes and fraud alerts is available from the major credit reporting agencies.

COMMENT

1. Stated need for the bill

According to the author:

With large scale data breaches like Equifax becoming the norm, our response to identity theft must be more thoughtful. While data breach notifications provide important information, including the contact information for Consumer Credit Reporting Agencies, they do not alert a consumer to the most effective tool to prevent financial fraud, a security freeze. With this bill, Californians whose sensitive personal information has been stolen will become aware that security freezes are available to them, and can make an informed decision on how they want to protect their financial future.

2. Ensuring consumers are aware of their ability to place a freeze on their credit

A credit file is a report detailing a consumer’s credit history, compiled by a consumer credit reporting agency (CCRA) such as Experian, Trans Union, or Equifax. The file contains information such as annual income, outstanding debt, bill-paying history, the number, types, and age of accounts, current and previous addresses, and the consumer’s Social Security number. Under federal law, a CCRA may disclose information contained in a credit report to current and prospective creditors, insurers, employers, provided the consumer has authorized the disclosure, and others who have a “legitimate business need” in connection with a business transaction initiated by the consumer. (15 U.S.C. Sec. 1681b.) Federal law requires CCRAs to give consumers one free credit report each year. (15 U.S.C. Sec. 1681j.)

In 2001, California became the first state in the nation to give consumers the right to place a “freeze” on their credit reports, which prohibits a CCRA from releasing a consumer’s credit report without the express authorization of the consumer while the freeze is in place. (See SB 168 [Bowen, Ch. 720, Stats. 2001].) Freezes placed on credit reports can be a useful tool in frustrating the ability of identity thieves to open new lines of credit using another person’s stolen identity. Since that time, all 50 states have followed California’s lead and enacted security freeze legislation, limiting disclosure of consumers’ credit reports. Under current law, security freezes are available to any consumer with a credit report, but individuals who have never had credit in their names, such as children, may not have a credit report on file for which a freeze could be placed. Under existing California law, consumers must pay fees for these freezes, can only request them by mail, and must wait three days.

Recent federal legislation, the Economic Growth, Regulatory Relief, and Consumer Protection Act, has been signed into law that requires such freezes to be done free of charge by the CCRAs. Upon receiving a request from a consumer, a CCRA will have to place a freeze not later than one day after receiving the request by telephone or secure electronic means and not later than three business days if received by mail. CCRAs are required to establish a Web page where consumers can allow such freezes to be initiated and requires the FTC to establish a single Web page that includes a link to each of the CCRA’s Web pages.

Unfortunately, because of the size of California’s economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy /2014data_breach_rpt.pdf> [as of Apr. 20, 2015].)

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. (California Department of Justice, California Data Breach Report (Feb. 2016) <https://oag.ca.gov/breachreport2016> [as of Apr. 30, 2017].) In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

California’s data breach notification law requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. Such breach notifications must be titled “Notice of Data Breach” and are required to meet certain formatting requirements and include specific information.

This bill would require that when a person or business is required to issue these notifications, it must also include a notice that informs the consumer that information related to security freezes and fraud alerts is available from the CCRAs where the breach exposes a social security number or a driver’s license or California identification card number.

This would make it more likely that affected consumers are given helpful information in the wake of a breach on their rights to freeze their credit and place fraud alerts in their files. This would better equip consumers with the tools to prevent identity theft in the wake of a data breach. However, one additional amendment to the law is suggested.

Currently, there are two provisions governing data breach notification requirements, Civil Code Sections 1798.29 and 1798.82. The two provisions are nearly identical, but the former applies to public agencies and the latter to persons or businesses. To the extent this new information is helpful for victims of a breach of information held by a person or business, it would be equally helpful if the breach involved information held by a public agency. This bill would only amend the provision governing persons and businesses. Therefore, the Committee suggests an amendment making an identical change to the statute governing public agencies. Otherwise, it may set a troubling precedent to treat breaches of information differently depending on who is holding the information.

Committee Amendment

Amend Civil Code Section 1798.29(d)(2)(F) to mirror Civil Code Section 1798.82(d)(2)(F) as amended by this bill

It is also noted that the new federal law that will take effect in a few months. That law indicates that each CCRA must create a Web page for consumers to initiate credit freezes and fraud alerts and also requires the Federal Trade Commission to create its own Web page that has links to the CCRA pages. When they are established, it could strengthen this law to include information regarding the Internet Web sites created as a result of the federal law in the data breach notifications.

Support: None Known

Opposition: None Known

HISTORY

Source: Author

Related Pending Legislation:

SB 823 (Hill, 2018) would provide consumers a more expedient and accessible process for placing a security freeze on their credit report by, in part, prohibiting fees for placing, temporarily lifting, replacing, or removing such freezes; requiring prominent links be provided by the agencies for quick, electronic control over these actions; shortening the time line for these actions; and requiring agencies to ensure these actions are also taken with other agencies when the consumer so elects. This bill is currently in the Assembly Banking and Finance Committee.

SB 1121 (Dodd, 2018) would, in relevant part, create a more robust enforcement mechanism for violations of the Data Breach Notification law. This bill is currently in the Assembly Judiciary Committee.

SB 1196 (Jackson, 2018) would authorize a person whose personal identifying information has been used unlawfully in a business entity filing to petition a court for an order directing that the information be redacted or otherwise labeled as impersonated and requiring the removal of the personal identifying information from publicly accessible electronic indexes and databases. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 608 (Irwin, 2017) would prohibit consumer credit reporting agencies from charging fees in connection with placing or removing security freezes for protected consumers, defined as individuals who are under 16, incapacitated, or under a county welfare or county probation department’s jurisdiction. This bill is currently in the Senate Judiciary Committee.

AB 1859 (Chau, 2018) would require a consumer credit reporting agency that knows of a vulnerability that could compromise the security of personal information for which there is an update to address, to apply that update or be held liable for any resulting damages. This bill is currently in the Senate Judiciary Committee.

Prior Legislation:

AB 241 (Dababneh, 2017) would have required a public agency that is the source of a data breach, and is required to provide affected persons with notice of the breach, to provide at least 12 months of appropriate identity theft prevention and mitigation services at no cost to the affected persons. This bill died in the Assembly Appropriations Committee.

AB 2374 (Hernández, Ch. 645, Stats. 2012) prohibited credit reporting agencies from charging specified consumers any fee for the initial placement of a security freeze, but authorized such agencies to charge a fee of up to $5 for lifting, removing, or replacing a security freeze.

AB 372 (Salas, Ch. 151, Stats. 2008) permitted a credit reporting agency to charge a fee of no more than $5 to a consumer 65 years of age or older and no more than $10 to other consumers for a request for a security freeze, removal of the freeze, or temporary lifting of the freeze for a period of time or for a specific party.

AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006) authorized specified business entities that become the victims of identity theft to utilize debt relief protections available to natural persons who are victimized by identity theft.

AB 1294 (Wiggins, Ch. 287, Stats. 2003) required a debt collector to stop collecting a consumer’s debt if an alleged debtor provides the collector with specified information showing that the debtor is a victim of identity theft, as specified.

SB 168 (Bowen, Ch. 720, Stats. 2001) gave California consumers the right to place a freeze on their credit reports, which, while in place, prohibits a credit reporting agency from releasing the consumer’s credit report without the express authorization of the consumer.

AB 156 (Murray, Ch. 768, Stats. 1997) formally recognized identity theft as a crime, providing that it is a misdemeanor for a person to willfully obtain personal identifying information of another and use that information to obtain, or attempt to obtain, credit, goods, or services in the name of another person without the consent of that person.

Prior Vote:

Assembly Floor (Ayes 71, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 2678

Author:(Irwin)

As Amended Ver:May 3, 2018

Majority vote

SUMMARY: This bill requires that a business provide, as part of the notification provided to a person affected by a data breach, notice that the affected person may elect to place a security freeze on his or her credit report by making a request in writing by mail, as specified, and an explanation of how a security freeze differs from identity theft prevention and mitigation services.

EXISTING LAW:

1. Requires, under the Data Breach Notification Law (DBNL), that a person or business conducting business in California that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person by a breach of the security of the system or data. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civil Code Section (CIV) 1798.82(a), (c).)
2. Requires a person or business that is the source of a breach of Social Security numbers or driver's license numbers, and is required to provide notice of the breach, to offer appropriate identity theft protection or mitigation services to affected individuals at no cost, for no less than 12 months, as specified. (CIV 1798.82(d)(2)(G).)
3. Requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (CIV 1798.82(b).)
4. Requires the breach notification to include certain information including in part, certain titles and headings, contact information for the breached entity, the type of personal information breached, a general description of the breach incident, and the toll-free telephone numbers and addresses of the major credit reporting agencies. Also provides a model form that is deemed to comply with the requirement. (CIV 1798.82 (d)(1)-(2).)
5. Allows at the discretion of the breached entity, the breach notification to include other information including a description of efforts to protect the information that has been breached, and advice on steps that the person whose information has been breached may take to protect himself or herself. (CIV 1798.82 (d)(3).)
6. Defines "personal information," for purposes of the DBNL, to include the individual's first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver's license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; medical information; or health insurance information. "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (CIV 1798.82(h)-(i).)

FISCAL EFFECT: Unknown. This bill is keyed non-fiscal by the Legislative Counsel.

COMMENTS: In 2013, Target reported that hackers stole up to 40 million credit and debit card numbers of shoppers who had visited the store during the holiday season. In response, AB 1710 (Dickinson, Chapter 855, Statutes of 2014) enacted various changes to the DBNL including requiring the source of the breach to offer appropriate identity theft prevention and mitigation services to consumers at no cost. Such services were already known to be helpful to victims as they give early notice to individuals when criminals use their information to open new accounts in their name. In 2016, the California Department of Justice reported that the provisions of AB 1710 were having the desired effect. "The new breach law requirement that companies must offer identity theft services to victims in certain breaches appears to be having an impact. From 2012 through 2014, organizations did not provide such services in 30 percent of breaches of Social Security or driver's license numbers. [W]hen the law took effect in 2015, the failure rate dropped to half that, 15 percent." (California Department of Justice, California Data Breach Report (Feb. 2016) [as April 19, 2018].)

This bill would now require that victims of security breaches are also notified of their ability to place a security freeze on their credit report. Unlike mitigation services, which are reactive in nature, security freezes on a credit profile will hinder the establishment of new accounts in an individual's name, thereby thwarting the efforts of identity thieves. That being said, the lifting of a security freeze can take up to three days, which can cause inconvenience for consumers. In addition to offering identity theft prevention and mitigation services to consumers whose personal information has been compromised due to data breach, this bill would require that persons, businesses, or agencies provide information about how to initiate a credit freeze, and how a security freeze differs from other identity theft prevention and mitigation services. This requirement should ensure that consumers have access to a variety of useful information that should aid in both preventing identity theft and monitoring one's accounts in the event that identity theft has occurred.

Recent amendments clarify that if the person or business providing notification was not the source of the breach, and therefore, is not offering identity theft prevention and mitigation services, in lieu of an explanation of how a security freeze differs, that person or business should instead provide a general description of a security freeze.

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200 FN: 0002869

Date of Hearing: May 1, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2678 (

Author:Irwin) – As Amended Ver:March 23, 2018

SUBJECT: Privacy: personal information: breach: notification

SUMMARY: This bill would require that a business provide, as part of the notification provided to a person affected by a data breach, notice that the affected person may elect to place a security freeze on his or her credit report by making a request in writing by mail, as specified, and an explanation of how a security freeze differs from identity theft prevention and mitigation services.

EXISTING LAW:

1. Requires, under the Data Breach Notification Law (DBNL), that a person or business conducting business in California that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person by a breach of the security of the system or data. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (1798.82(a), (c).)
2. Requires a person or business that is the source of a breach of Social Security numbers or driver’s license numbers, and is required to provide notice of the breach, to offer appropriate identity theft protection or mitigation services to affected individuals at no cost, for no less than 12 months, as specified. (Civ. Code Sec. 1798.82(d)(2)(G).)
3. Requires a person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any security breach immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code Sec. 1798.82(b).)
4. Requires the breach notification to include certain information including in part, certain titles and headings, contact information for the breached entity, the type of personal information breached, a general description of the breach incident, and the toll-free telephone numbers and addresses of the major credit reporting agencies. Also provides a model form that is deemed to comply with the requirement. (Civ. Code Sec. 1798.82 (d)(1)-(2).)
5. Allows at the discretion of the breached entity, the breach notification to include other information including a description of efforts to protect the information that has been breached, and advice on steps that the person whose information has been breached may take to protect himself or herself. (Civ. Code Sec. 1798.82 (d)(3).)
6. Defines “personal information,” for purposes of the DBNL, to include the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: Social Security number; driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Sec. 1798.82(h)-(i).)

FISCAL EFFECT: None. This bill has been keyed nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill: This bill seeks to ensure that consumers who have been affected by a data breach are provided with additional information about how to protect their identity. This bill is author-sponsored.
2. Author’s statement: According to the author, “Data breaches are becoming more common, and breaches of sensitive data that could result in identity theft are also on the rise. With large-scale breaches like Equifax making 145.5 million people susceptible to identity theft, victims need to be informed of all of their options to secure their identity.

Current law requires identity theft prevention and mitigation services to be provided to victims for one year after an incident, but the threat of identity theft persists for much longer. The difficulty in changing certain personally identifiable information like Social Security Numbers, the inability to change others like Date of Birth, and the absurdity of having to change your Name, means a data breach of certain [personally identifiable information] PII can follow victims for the rest of their lives.

While identity theft prevention and mitigation services have numerous benefits to data breach victims, many are services that monitor and notify the victim after fraud has been committed. Even when these services also provide assistance in remediating that fraud, a data breach victim has now also become a victim of fraud.

In the wake of the Equifax data breach, the solution of security freezes at each of the major credit freezes has been spotlighted as a long-term and proactive solution to identity theft and credit fraud. A credit freeze does not expire after a year, and prevents most forms of financial fraud from the outset rather than in response to criminal conduct. Credit Freezes while the strongest tool to prevent fraud, are not inflexible to the needs of the consumer, who under statute can temporarily lift the freeze to access valid credit, or remove the freeze if the barriers it erects are too cumbersome.

Even with security freezes offering stronger protections, few Americans have taken advantage of the service. According to market research firm Wakefield Research, only 1 in 5 Americans have frozen their credit. With many credit reporting agency websites highlighting their subscription based paid monitoring services on their homepages, even consumers who know about security freezes may struggle to find where to access this mandated service.”

That is why it is important to require in data breach notifications that provide one year of identity theft prevention and mitigation services, the key information that a consumer needs to make a decision on whether or not a security freeze is a better option for their personal and financial safety.”

1. California’s data breach notification law (DBNL): Effective 2003, California became the first state in the nation to require businesses and government agencies to notify California residents of security breaches if personal information was, or was reasonably believed to have been, stolen. (SB 1386 (Peace, Ch. 915, Stats. 2002).)

Until January 1, 2017, the DBNL did not apply to “encrypted” information, which created an incentive for businesses and government agencies to encrypt personal data and thereby avoid the notice requirement. AB 2828 (Chau, Ch. 337, Stats. 2016) required agencies, persons, and businesses to also disclose a breach of a security of a system containing encrypted personal information when the encryption key or security credential that could render that personal information readable or useable was also compromised in the breach. Despite this change, it is important to note that notice is not required unless the data breach involved “personal information” relating to a California resident. “Personal information” means a person’s first name or first initial and last name in combination with one or more of the following data elements:

• Social Security number;
• driver’s license number or California identification card number;
• account number, credit or debit card number, in combination with any required security code, access code, or password;
• medical information; health insurance information; or
• a user name or email address in combination with a password or security question and answer that would permit access to an online account.

“Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

The DBNL has two distinct parts: one part that applies to state and local agencies, and one part that applies to private persons and businesses. In addition, California has very specific guidelines on breach notification, and the notification must include, at a minimum, the following: (1) the name and contact information of the reporting person or business; (2) a list of the types of personal information that were or are reasonably believed to have been the subject of a breach; (3) whether notification was delayed as a result of law enforcement investigation; (4) a description of the breach incident; (5) toll-free phone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number, driver’s license or California identification card number; and (6) if the person or business making the notification was the source of the breach, then it must offer to provide identity theft prevention services at no cost for at least 12 months.

1. Security freezes aid consumers in preventing identity theft: In 2013, Target reported that hackers stole up to 40 million credit and debit card numbers of shoppers who had visited the store during the holiday season. In response, AB 1710 (Dickinson, Ch. 855, Stats. 2014) enacted various changes to the DBNL including requiring the source of the breach to offer appropriate identity theft prevention and mitigation services to consumers at no cost. Such services were already known to be helpful to victims as they give early notice to individuals when criminals use their information to open new accounts in their name. In 2016, the California Department of Justice reported that the provisions of AB 1710 were having the desired effect. “The new breach law requirement that companies must offer identity theft services to victims in certain breaches appears to be having an impact. From 2012 through 2014, organizations did not provide such services in 30 percent of breaches of Social Security or driver’s license numbers. [W]hen the law took effect in 2015, the failure rate dropped to half that, 15 percent.” (California Department of Justice, California Data Breach Report (Feb. 2016) [as April 19, 2018].)

This bill would now require that victims of security breaches are also notified of their ability to place a security freeze on their credit report. Unlike mitigation services, which are reactive in nature, security freezes on a credit profile will hinder the establishment of new accounts in an individual’s name, thereby thwarting the efforts of identity thieves. That being said, the lifting of a security freeze can take up to three days, which can cause inconvenience for consumers. In addition to offering identity theft prevention and mitigation services to consumers whose personal information has been compromised due to data breach, this bill would require that persons, businesses, or agencies provide information about how to initiate a credit freeze, and how a security freeze differs from other identity theft prevention and mitigation services. Arguably this requirement should ensure that consumers have access to a variety of useful information that should aid in both preventing identity theft and monitoring one’s accounts in the event that identity theft has occurred.

1. Author’s amendments: In response to technical concerns raised by stakeholders and to ensure compatibility with bills similarly dealing with security freezes, the author offers the following amendments. Specifically, the amendments take into account SB 823 (Hill) which would require internet and application-based freeze options be available to consumers, and would also address the narrow scenario where an entity is providing notification because they owned the data, but not have to provide mitigation services because they were not the source of the breach.

Author’s amendments:

On page 5, at line 32, amend Civil Code Section1798.82 (d)(2)(H) to read as follows:

(H) If the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h), notice that the affected person may elect to place a security freeze on his or her credit report  by making a request in writing by mail to with a consumer credit reporting agency by any means authorized by law and an explanation of how a security freeze differs from the identity theft prevention and mitigation services being offered pursuant to subparagraph (G) of this subdivision. If the person or business providing notification was not the source of the breach, and therefore is not offering identity theft prevent and mitigation services, in lieu of an explanation of how a security freeze differs, a general description of a security freeze.

1. Related legislation: SB 823 (Hill) would prohibit fees for placing, temporarily lifting, replacing, or removing security freezes on credit reports; require prominent links be provided by the agencies for quick, electronic control over these actions; shorten the time line for these actions; and require agencies to ensure these actions are also taken with other agencies when the consumer so elects. This bill is currently on the Senate Floor.

AB 1742 (Quirk) would require a CCRA to place or lift a security freeze on a consumer’s credit report within 15 minutes upon receiving an electronic request from a consumer and offer to submit a security freeze request on behalf of a consumer to all CCRAs that compile and maintain files on consumers on a nationwide basis.

1. Prior legislation: AB 2828 (Chau, Ch. 337, Stats. 2016) required agencies, persons, and businesses to disclose the breach of the security of a system containing encrypted personal information when the encryption key or security credential that could render that personal information readable or useable is also compromised in the breach.

SB 570 (Jackson, Ch. 543, Stats. 2015) required, in the event of a data breach, agencies and persons conducting business in California to provide affected individuals with a notice entitled “Notice of Data Breach,” in which required content is presented under the following headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.”

AB 1710 (Dickinson, Ch. 855, Stats. 2014) enacted various changes to the DBNL including requiring the source of the breach to offer appropriate identity theft prevention and mitigation services to consumers at no cost.

SB 46 (Corbett, Ch. 396, Stats. 2013) revised certain data elements included within the definition of personal information under the DBNL, by adding certain information that would permit access to an online account and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.

SB 24 (Simitian, Ch. 197, Stats. 2011) required any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, and required any agency, person, or business that is required to issue a security breach notification to more than 500 California residents to electronically submit a single sample copy of that security breach notification to the Attorney General.

AB 1950 (Wiggins, Ch. 877, Stats. 2004) required a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also required a business that discloses personal information to a nonaffiliated third party, to require by contract that those entities maintain reasonable security procedures.

SB 1936 (Peace, Ch. 915, Stats. 2002) enacted the DBNL and required a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the data to California’s residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. SB 1936 permitted notifications to be delayed if a law enforcement agency determines that it would impede a criminal investigation, and required an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200