AB 1712: Personal information: data breaches.
- Session Year: 2023-2024
- House: Assembly
- Latest Version Date: 2023-04-27
Current Status:
Failed
(2023-06-14: Referred to Com. on JUD.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
The Information Practices Act of 1977 requires any agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach, as specified. The act also requires any agency that maintains computerized data that includes personal information that the agency does not own to notify the owner or licensee of the information of any breach of the security of the data, in accordance with certain procedures. Existing law requires the security breach notification to include specified information, including, among other things, the names and addresses of the major credit reporting agencies. Existing law authorizes the security breach notification to include, at the discretion of the agency, among other things, advice on steps that people whose information has been breached may take to protect themselves.
This bill would additionally require the security breach notification to include the internet websites of the major credit reporting agencies and the Uniform Resource Locator for the main internet website operated by the Federal Trade Commission to provide information for victims of identity theft. The bill would authorize the security breach notification to include how to place a credit or security freeze by visiting the internet website of the major credit reporting agencies. agencies, as specified.
The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The Information Practices Act of 1977 requires any agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach, as specified. The act also requires any agency that maintains computerized data that includes personal information that the agency does not own to notify the owner or licensee of the information of any breach of the security of the data, in accordance with certain procedures. Existing law requires the security breach notification to include specified information, including, among other things, the names and addresses of the major credit reporting agencies. Existing law authorizes the security breach notification to include, at the discretion of the agency, among other things, advice on steps that people whose information has been breached may take to protect themselves.
This bill would make nonsubstantive changes to these provisions. additionally require the security breach notification to include the internet websites of the major credit reporting agencies and would authorize the security breach notification to include how to place a credit or security freeze by visiting the internet website of the major credit reporting agencies.
The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The Information Practices Act of 1977 requires any agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach, as specified. The act also requires any agency that maintains computerized data that includes personal information that the agency does not own to notify the owner or licensee of the information of any breach of the security of the data, in accordance with certain procedures.
This bill would make nonsubstantive changes to these provisions.
(a) An agency that owns or licenses computerized data that includes personal information shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b) An agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d) An agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [internet website] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers, addresses, and internet websites of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(G)The Uniform Resource Locator (URL) for the main internet website operated by the Federal Trade Commission to provide information for victims and potential victims of identity theft, which at the time the act adding this subparagraph is enacted is at https://www.identitytheft.gov.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that people whose information has been breached may take to protect themselves, including how to place a credit or security freeze by visiting the internet website URLs of specific pages on the internet websites of the major credit reporting agencies. agencies where an individual may place a credit or security freeze.
(e) An agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within Article 1 (commencing with Section 7923.600) of Chapter 1 of Part 5 of Division 10 of Title 1 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.
(G)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(H)Genetic data.
(2)A username or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(5)For purposes of this section, genetic data means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys internet website, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change the persons password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same username or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in Section 7920.510 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render the data usable, readable, and decipherable.
(m)Notwithstanding any other law, the State Bar of California shall comply with this section. This subdivision shall not be construed to apply other provisions of this chapter to the State Bar.
SEC. 2.The Legislature finds and declares that protecting the personal information and financial security of residents of this state is a matter of statewide concern and is not a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Section 1 of this act amending Section 1798.29 of the Civil Code applies to all cities, including charter cities.
SEC. 3.If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.
(a) An agency that owns or licenses computerized data that includes personal information shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b) An agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d) An agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [internet website] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses numbers, addresses, and internet websites of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that people whose information has been breached may take to protect themselves. themselves, including how to place a credit or security freeze by visiting the internet website of the major credit reporting agencies.
(e) An agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within Article 1 (commencing with Section 7923.600) of Chapter 1 of Part 5 of Division 10 of Title 1 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.
(G)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(H)Genetic data.
(2)A username or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(5)For purposes of this section, genetic data means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys internet website, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change the persons password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same username or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in Section 7920.510 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render the data usable, readable, and decipherable.
(m)Notwithstanding any other law, the State Bar of California shall comply with this section. This subdivision shall not be construed to apply other provisions of this chapter to the State Bar.
SEC. 2.The Legislature finds and declares that protecting the personal information and financial security of residents of this state is a matter of statewide concern and is not a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Section 1 of this act amending Section 1798.29 of the Civil Code applies to all cities, including charter cities.
SEC. 3.If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.
(a)Any An agency that owns or licenses computerized data that includes personal information shall disclose any a breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any An agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any An agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [internet website] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that people whose information has been breached may take to protect themselves.
(e)Any An agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within Article 1 (commencing with Section 7923.600) of Chapter 1 of Part 5 of Division 10 of Title 1 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.
(C)Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.
(G)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(H)Genetic data.
(2)A username or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(5)For purposes of this section, genetic data means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys internet website, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change the persons password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same username or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in Section 7920.510 of the Government Code.
(l)For purposes of this section, encryption key and security credential mean the confidential key or process designed to render the data usable, readable, and decipherable.
(m)Notwithstanding any other law, the State Bar of California shall comply with this section. This subdivision shall not be construed to apply other provisions of this chapter to the State Bar.
|
Date
|
Status
|
|---|---|
| Jun 14, 2023 | Referred to Com. on JUD. |
| Jun 1, 2023 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 31, 2023 | Read third time. Passed. Ordered to the Senate. (Ayes 80. Noes 0. Page 2044.) |
| May 18, 2023 | From committee: Do pass. (Ayes 15. Noes 0.) (May 18). |
| May 18, 2023 | Joint Rule 62(a), file notice suspended. (Page 1580.) |
| May 18, 2023 | Read second time. Ordered to third reading. |
| May 17, 2023 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| May 10, 2023 | In committee: Hearing postponed by committee. |
| May 1, 2023 | Re-referred to Com. on APPR. |
| Apr 27, 2023 | Read second time and amended. |
| Apr 26, 2023 | From committee: Amend, and do pass as amended and re-refer to Com. on APPR. with recommendation: To Consent Calendar. (Ayes 11. Noes 0.) (April 25). |
| Mar 14, 2023 | Re-referred to Com. on P. & C.P. |
| Mar 13, 2023 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Mar 9, 2023 | Referred to Com. on P. & C.P. |
| Feb 18, 2023 | From printer. May be heard in committee March 20. |
| Feb 17, 2023 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| May 31, 2023 | AB 1712 Irwin Assembly Third Reading | Assembly Floor |
Passed |
|
| May 18, 2023 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 25, 2023 | Do pass as amended, and be re-referred to the Committee on [Appropriations] with recommendation: To Consent Calendar | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| California Credit Union League | ** Support |
ASSEMBLY THIRD READING
ATR Bill Id:AB 1712
Author:(Irwin)
As Amended Ver:April 27, 2023
Majority vote
SUMMARY
Adds information regarding the internet websites of the major credit reporting agencies, and the Federal Trade Commission's main website for identity theft victims, to the notice required to be given, under the Data Breach Notification Law, to individuals whose social security number or driver's license or California identification card number is exposed in a data breach at a state or local government agency. Permits these agencies to also inform these individuals about how to place a credit or security freeze by visiting the major credit reporting agencies' websites.
Major Provisions
- Requires the security breach notification, given to individuals whose social security number or driver's license or California identification card number is exposed in a data breach at a state or local government agency, to include a) the internet websites of the major credit reporting agencies and b) the Federal Trade Commission's main website for identity theft victims.
- Permits the security breach notification to include information about how to place a credit or security freeze by visiting the internet websites of the major credit reporting agencies, including URLs for the specific webpages where they may place such a freeze.
COMMENTS
Background. California's Data Breach Notification Law requires a state or local agency to notify a California resident of any data breaches where that person's personal information was, or is reasonably believed to have been, acquired by an unauthorized person. "Personal information" means information, such as a username and password, that would allow access to one or more online accounts, as well as information, such as a social security number or credit card number, that would facilitate identity theft or financial fraud.
Data breaches are increasingly prevalent in both the private and public sectors. In February 2022, approximately 260,000 attorney discipline records from the State Bar of California appeared on a public website. (State Bar of California, Data Breach Updates, available at https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates.) In October 2022, Los Angeles Unified School District confirmed that approximately 2,000 student psychological evaluations (including both current and former students, some who are now adults) was exposed on the so-called "dark web" by ransomware hackers. (Keierleber, Trove of L.A. Students' Mental Health Records Posted to Dark Web After Cyber Hack, The74 (Feb. 22, 2023), available at https://www.the74million.org/article/trove-of-l-a-students-mental-health-records-posted-to-dark-web-after-cyber-hack/.) Dozens more examples can be found on the data breach disclosure website that the Office of the Attorney General maintains at https://www.oag.ca.gov/privacy/databreach/list, as required under Civil Code § 1798.29(e) (for public entity breaches) and Section 1798.82(f) (for business breaches).
Data breaches, of course, can lead to identity theft. If hackers have access to personal information such as a person's name, date of birth, social security number, and drivers' license number, they may be able to open fraudulent credit card accounts, turn on utility services, and perpetrate other financial frauds by impersonating the victim.
However, remedies exist. If a potential victim is promptly notified of a data breach, one of the most effective steps they can take against identity theft is to place a security freeze on their credit report, commonly known as a "credit freeze." Almost any attempt to open a financial account is accompanied by a review of data from a credit reporting agency in order to verify a person's identity and creditworthiness. Under federal law, a person can place a credit freeze by requesting credit reporting agencies not to disclose the contents of their credit reports until further notice. (15 U.S.C. Section 1681c-1(i).) The credit freeze continues until the person requests the credit reporting agency to lift it. By preventing lenders, utility companies, and so forth from being able to obtain a person's credit reports, a credit freeze prevents the opening of fraudulent accounts under their identities.
This bill would help provide information to data breach victims on how to place a credit or security freeze, and thereby better protect themselves from identity theft.
The Data Breach Notification Law. While no general federal data breach notification laws exist, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have enacted laws requiring private or governmental entities to notify individuals of security breaches involving personally identifiable information. (National Conference on State Legislatures, Security Breach Notification Laws (Jan .17, 2022), available at https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.)
SB 1986 (Peace), Chapter 915, Statutes of 2002 enacted the Data Breach Notification Law in California. The Data Breach Notification Law requires a state agency, or a person or business that conducts business in California, to disclose any breach of the security of data to California residents whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person as a result of the breach.
Since the passage of SB 1986, the frequency and variety of data breaches has continued to increase dramatically as computing power and the public's reliance on digital information technology grow. In the United States alone, the number of reported data breaches has grown from 447 in 2012 to 1,802 in 2022, with the number of exposed records increasing 916%, from 17.3 million in 2012 to 422.14 million in 2022. (Petrosyan, Cyber crime: number of compromises and impacted individuals in U.S. 2005-2022, Statista (Apr. 1, 2023), available at https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/.) While these increases could result in part from increased reporting as data breach notification laws are adopted across the country, it is undeniable that the quantity and sensitivity of personal information transmitted and stored digitally has vastly increased, as has the risk of harmful data breaches.
Accordingly, California has added numerous provisions to the Data Breach Notification Law in order to protect residents as data breaches become more commonplace. For example, SB 24 (Simitian), Chapter 197, Statutes of 2011 first set out statutory requirements for the contents of data breach notifications, including the provisions amended by this bill. In recent years, AB 2828 (Chau), Chapter 337, Statutes of 2016 required notification of breaches of encrypted personal information if an encryption key or security credential that could render the information readable was also compromised in the breach, and AB 1130 (Levine), Chapter 750, Statutes of 2019 added government-issued identification numbers and unique biometric data to the definition of "personal information."
What this bill would do. The Data Breach Notification Law specifies in some detail the content of the security notification that an agency must give a person whose personal information is subject to a data breach. Among the information that must be given is "[t]he toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a driver's license or California identification card number." (Civ. Code § 1789.29(d)(2)(F).) This bill would amend this provision to require that agencies also provide data breach victims with the internet websites of the major credit reporting agencies. It would also add a provision requiring data breach victims to be provided with the Federal Trade Commission's main website for identity theft victims: https://www.identitytheft.gov. As described on the website, "IdentityTheft.gov is the federal government's one-stop resource for identity theft victims. The site provides streamlined checklists and sample letters to guide you through the recovery process." The website includes specific steps to be taken based on the information that may have been stolen, such as a social security number, driver's license information, or bank account information.
The Data Breach Notification Law does not require, but does permit, agencies to include in the notification "advice on steps that people whose information has been breached may take to protect themselves." (Civ. Code Section 1789.29(d)(3)(B).) This bill would make this provision more specific by clarifying that this advice could include informing victims as to how to place a credit or security freeze, including URLs for the specific webpages on the major credit reporting agencies' websites where they may place such a freeze. Providing this specific information may enhance the speed with which data breach victims freeze their credit reports, and also help them avoid fake websites if they were to use a search engine to try to find these pages.
Given the increasing frequency of data breaches, this bill offers a straightforward way to improve victims' chances of avoiding the time, expense, and stress of identity theft.
According to the Author
A credit freeze or security freeze is one of the most effective defensive actions that can be taken after a data breach. By notifying credit reporting agencies that a freeze should be placed on your credit report, new requests are prevented from being processed and subsequently fraudulent new lines of credit are avoided. Californians who are victims of a data breach at a public agency should have better access to knowledge about this important step they can take to defend themselves. AB 1712 will make it more likely that notifications include this key information.
Arguments in Support
California Credit Union League explains how this bill could help victims of data breaches:
With increased cases of data breaches and identity theft, it is more important now than ever to provide clear guidance to victims on what steps to take following a data breach of their personal information. Placing a credit freeze is an effective and important step for victims to take to prevent identity theft and fraud. By requiring agencies to include the credit reporting agencies websites in the security breach notification and authorizing the notification to include steps on how to freeze your credit, AB 1712 will allow California consumers to better protect themselves and their personal information.
Arguments in Opposition
None on file.
FISCAL COMMENTS
According to the Assembly Appropriations Committee:
- The California Department of Technology would experience minor and absorbable costs to update its data breach notification templates that are used by all state agencies.
- Costs to local government of an unknown but, collectively, statewide, potentially significant amount. If the Commission on State Mandates determines these local costs to be a reimbursable state mandate, the state would need reimburse the costs of any local government that filed a claim with the commission (General Fund).
VOTES
ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0
YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson
ASM APPROPRIATIONS: 15-0-1
YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Hart, Lowenthal, Mathis, Papan, Pellerin, Sanchez, Weber, Ortega
ABS, ABST OR NV: Robert Rivas
UPDATED
VERSION: April 27, 2023
CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0000669
Date of Hearing: May 17, 2023
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Chris Holden, Chair
ABPCA Bill Id:AB 1712
Author:(Irwin) – As Amended Ver:April 27, 2023
Policy Committee: | Privacy and Consumer Protection | Vote: | 11 - 0 |
|
| ||
|
|
Urgency: No State Mandated Local Program: Yes Reimbursable: Yes
SUMMARY:
This bill expands the information a state or local agency is to provide, pursuant to the existing Data Breach Notification Law, to a person who personal information has been subject to data breach at that agency.
Specifically, this bill requires a state or local agency to provide on notice of a data breach (1) the websites of the major credit reporting agencies, (2) the Uniform Resource Locator (URL) for the main internet website operated by the Federal Trade Commission to provide information for victims and potential victims of identity theft, which at the time the act adding this subparagraph is enacted is at https://www.identitytheft.gov. and (3) advice on how to place a credit or security freeze by visiting the URLs of specific pages on the internet websites of the major credit reporting agencies where an individual may place a credit or security freeze.
FISCAL EFFECT:
- The California Department of Technology would experience minor and absorbable costs to update its data breach notification templates that are used by all state agencies.
- Costs to local government of an unknown but, collectively, statewide, potentially significant amount. If the Commission on State Mandates determines these local costs to be a reimbursable state mandate, the state would need reimburse the costs of any local government that filed a claim with the commission (General Fund).
COMMENTS:
Existing California law requires a state agency, or a person or business that conducts business in California, to disclose any breach of the security of data to California residents whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person as a result of the breach. This is known as the Data Breach Notification Law. The CDT report it maintains and updates templates for such notification that every state agency uses.
The author, noting the frequency of data breaches and the ubiquity of personal information stored electronically, asserts this bill will ensure a person subject to a data breach can quickly take effective action. According to the author:
A credit freeze or security freeze is one of the most effective defensive actions that can be taken after a data breach. By notifying credit reporting agencies that a freeze should be placed on your credit report, new requests are prevented from being processed and subsequently fraudulent new lines of credit are avoided. Californians who are victims of a data breach at a public agency should have better access to knowledge about this important step they can take to defend themselves. AB 1712 will make it more likely that notifications include this key information.
Analysis Prepared by: Jay Dickenson / APPR. / (916) 319-2081
Date of Hearing: April 25, 2023
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Jesse Gabriel, Chair
ABPCA Bill Id:AB 1712 (
Author:Irwin) – As Amended Ver:March 13, 2023
Proposed Consent
SUBJECT: Personal information: data breaches
SYNOPSIS
California’s Data Breach Notification Law requires state and local agencies to promptly notify California residents of any agency data breaches in which their personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
This author-sponsored measure proposes to add helpful information to the notification given to data breach victims under current law. First, the bill would mandate that the notification given to individuals whose social security number or driver’s license or California identification card number is exposed also include the internet websites of the major credit reporting agencies. Currently, the notification need only include credit reporting agencies’ toll-free telephone numbers and addresses, which is somewhat antiquated in today’s world. Second, the bill would permit, but not require, notifications to include information about how to place a credit or security freeze by visiting the internet websites of the major credit reporting agencies.
Committee amendments propose to bolster these requirements in two ways. First, the required notification would also have to include the URL of the Federal Trade Commission’s main website for identity theft victims, currently https://www.identitytheft.gov. Second, the notification could (but would not be required to) include the specific webpages on the major credit reporting agencies’ websites where individuals can place credit or security freezes.
This bill is supported by the California Credit Union League. It has no opposition on file.
SUMMARY: Adds information regarding the internet websites of the major credit reporting agencies to the notice required to be given, under the Data Breach Notification Law, to individuals whose social security number or driver’s license or California identification card number is exposed in a data breach at a state or local government agency. Permits these agencies to also inform these individuals about how to place a credit or security freeze by visiting the credit reporting agencies’ websites. Specifically, this bill:
- Requires the security breach notification, given to individuals whose social security number or driver’s license or California identification card number is exposed in a data breach at a state or local government agency, to include the internet websites of the major credit reporting agencies.
- Permits the security breach notification to include information about how to place a credit or security freeze by visiting the internet websites of the major credit reporting agencies.
EXISTING LAW:
- Provides, under the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
- Establishes the Data Breach Notification Law. (Civ. Code §§ 1798.29, 1798.82.)
- Defines “personal information,” for purposes of the Data Breach Notification Law, to include either of the following:
- A user name or email address, in combination with a password or security question and an answer that would permit access to an online account.
- The individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted: social security number; driver’s license number or California identification card number; account number, credit, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; medical information; health insurance information; unique biometric data generated from measurements or technical analysis of human body characteristics used to authenticate a specific individual; or information or data collected through the use or operation of an automated license plate recognition system. (Civ. Code § 1798.29(g).)
- Excludes from the definition of “personal information” publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code § 1798.29(h).)
- Defines “agency,” for purposes of the Data Breach Notification Law, to mean every local agency and every state office, officer, department, division, bureau, board, commission, or other state agency, but to exclude:
- The California Legislature.
- The State Compensation Insurance Fund (SCIF), except as to records containing SCIF employees’ personal information. (Civ. Code § 1798.3; Civ. Code § 1798.29(k); Gov. Code § 7920.510; Cal. Const. art. VI.)
- Requires any agency that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system, as defined, to any California resident whose unencrypted personal information, or encrypted personal information along with an encryption key or security credential, was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code § 1798.29(a).)
- Requires the disclosure under 6) to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Ibid.)
- Requires any agency that maintains computerized data that includes personal information that the agency, person, or business does not own to, immediately following discovery of the breach, notify the owner or licensee of the information of any security breach if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civ. Code § 1798.29(b).)
- Establishes comprehensive requirements for the contents of the security breach notification that an agency must give an individual in the event of a data breach. (Civ. Code § 1798.29(d).)
- Requires the notification to include the name of the agency where the breach occurred, and pertinent information under the headings, “What Happened, “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” (Civ. Code § 1798.29(d)(1).)
- Requires the notification to also include the toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a driver’s license or California identification card number. (Civ. Code § 1798.29(d)(2)(F).)
- Permits, but does not require, the notification to include advice on steps that people whose information has been breached may take to protect themselves. (Civ. Code § 1798.29(d)(3)(B).)
- Defines, under federal law, a “security freeze” as a prohibition on a credit reporting agency disclosing the contents of a credit report to any person that requests it. (15 U.S.C. § 1681c-1(i).)
- Provides, under federal law, a consumer with the right to impose a security freeze free of charge until the consumer requests otherwise. (Ibid.)
FISCAL EFFECT: As currently in print this bill is keyed fiscal.
COMMENTS:
1) Background. California’s Data Breach Notification Law requires a state or local agency to notify a California resident of any data breaches where that person’s personal information was, or is reasonably believed to have been, acquired by an unauthorized person. “Personal information” means information, such as a username and password, that would allow access to one or more online accounts, as well as information, such as a social security number or credit card number, that would facilitate identity theft or financial fraud.
Data breaches are increasingly prevalent in both the private and public sectors. In February 2022, approximately 260,000 attorney discipline records from the State Bar of California appeared on a public website. (State Bar of California, Data Breach Updates, available at https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates.) In October 2022, Los Angeles Unified School District confirmed that approximately 2,000 student psychological evaluations (including both current and former students, some who are now adults) was exposed on the so-called “dark web” by ransomware hackers. (Keierleber, Trove of L.A. Students’ Mental Health Records Posted to Dark Web After Cyber Hack, The74 (Feb. 22, 2023), available at https://www.the74million.org/article/trove-of-l-a-students-mental-health-records-posted-to-dark-web-after-cyber-hack/.) Dozens more examples can be found on the data breach disclosure website that the Office of the Attorney General maintains at https://www.oag.ca.gov/privacy/databreach/list, as required under Civil Code § 1798.29(e) (for public entity breaches) and § 1798.82(f) (for business breaches).
Data breaches, of course, can lead to identity theft. If hackers have access to personal information such a person’s name, date of birth, social security number, and drivers’ license number, they may be able to open fraudulent credit card accounts, turn on utility services, and perpetrate other financial frauds by impersonating the victim.
However, remedies exist. If a potential victim is promptly notified of a data breach, one of the most effective steps they can take against identity theft is to place a security freeze on their credit report, commonly known as a “credit freeze.” Almost any attempt to open a financial account is accompanied by a review of data from a credit reporting agency in order to verify a person’s identity and creditworthiness. Under federal law, a person can place a credit freeze by requesting credit reporting agencies not to disclose the contents of their credit reports until further notice. (15 U.S.C. § 1681c-1(i).) The credit freeze continues until the person requests the credit reporting agency to lift it. By preventing lenders, utility companies, and so forth from being able to obtain a person’s credit reports, a credit freeze prevents the opening of fraudulent accounts under their identities.
This bill would help provide information to data breach victims on how to place a credit or security freeze, and thereby better protect themselves from identity theft.
2) Author’s statement. According to the author:
A credit freeze or security freeze is one of the most effective defensive actions that can be taken after a data breach. By notifying credit reporting agencies that a freeze should be placed on your credit report, new requests are prevented from being processed and subsequently fraudulent new lines of credit are avoided. Californians who are victims of a data breach at a public agency should have better access to knowledge about this important step they can take to defend themselves. AB 1712 will make it more likely that notifications include this key information.
3) The Data Breach Notification Law and AB 2301. While no general federal data breach notification laws exist, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have enacted laws requiring private or governmental entities to notify individuals of security breaches involving personally identifiable information. (National Conference on State Legislatures, Security Breach Notification Laws (Jan .17, 2022), available at https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.)
SB 1936 (Peace, Chap. 915, Stats. 2002) enacted the Data Breach Notification Law in California. The Data Breach Notification Law requires a state agency, or a person or business that conducts business in California, to disclose any breach of the security of data to California residents whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person as a result of the breach.
Since the passage of SB 1936, the frequency and variety of data breaches has continued to increase dramatically as computing power and the public’s reliance on digital information technology grow. In the United States alone, the number of reported data breaches has grown from 447 in 2012 to 1,802 in 2022, with the number of exposed records increasing 916%, from 17.3 million in 2012 to 422.14 million in 2022. (Petrosyan, Cyber crime: number of compromises and impacted individuals in U.S. 2005-2022, Statista (Apr. 1, 2023), available at https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/.) While these increases could result in part from increased reporting as data breach notification laws are adopted across the country, it is undeniable that the quantity and sensitivity of personal information transmitted and stored digitally has vastly increased, as has the risk of harmful data breaches.
Accordingly, California has added numerous provisions to the Data Breach Notification Law in order to protect residents as data breaches become more commonplace. For example, SB 29 (Simitian, Chap. 197, Stats. 2011) first set out statutory requirements for the contents of data breach notifications, including the provisions amended by this bill. In recent years, AB 2828 (Chau, Chap. 337, Stats. 2016) required notification of breaches of encrypted personal information if an encryption key or security credential that could render the information readable was also compromised in the breach, and AB 1130 (Levine, Chap. 750, Stats. 2019) added government-issued identification numbers and unique biometric data to the definition of “personal information.”
4) What this bill would do. The Data Breach Notification Law specifies in some detail the content of the security notification that an agency must give a person whose personal information is subject to a data breach. Among the information that must be given is “[t]he toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a driver’s license or California identification card number.” (Civ. Code § 1789.29(d)(2)(F).) This bill would amend this provision to require that agencies also provide victims with the internet websites of the major credit reporting agencies.
The Data Breach Notification Law does not require, but does permit, agencies to include in the notification “advice on steps that people whose information has been breached may take to protect themselves.” (Civ. Code § 1789.29(d)(3)(B).) This bill would make this provision more specific by clarifying that this advice could include informing victims as to how to place a credit or security freeze by visiting the internet websites of the major credit reporting agencies.
Given the increasing frequency of data breaches, this bill offers a straightforward way to improve victims’ chances of avoiding the time, expense, and stress of identity theft.
5) Committee amendments—providing additional helpful information to data breach victims. Proposed amendments would strengthen this bill’s requirements in two ways. One amendment would add the Federal Trade Commission’s main website for identity theft victims to the information that must be provided to data breach victims:
Civil Code 1798.29. […]
(d) […] (2) The security breach notification described in paragraph (1) shall include, at a minimum, the following information: […]
(G) The Uniform Resource Locator (URL) for the main internet website operated by the Federal Trade Commission to provide information for victims and potential victims of identity theft, which at the time the act adding this subparagraph is enacted is at https://www.identitytheft.gov.
As described on the website, “IdentityTheft.gov is the federal government’s one-stop resource for identity theft victims. The site provides streamlined checklists and sample letters to guide you through the recovery process.” The website includes specific steps to be taken based on the information that may have been stolen, such as a social security number, driver’s license information, or bank account information.
The second amendment would clarify that agencies could include, in the information they are permitted (but not required) to provide data breach victims, URLs for the specific webpages on the major credit reporting agencies’ websites where one may place credit or security freezes:
Civil Code 1798.29. […]
(d) […] (3) At the discretion of the agency, the security breach notification may also include any of the following: […]
(B) Advice on steps that people whose information has been breached may take to protect themselves, including how to place a credit or security freeze by visiting the internet website URLs of specific pages on the internet websites of the major credit reporting agencies where an individual may place a credit or security freeze.
Providing this specific information may enhance the speed with which data breach victims freeze their credit reports, and also help them avoid fake websites if they were to use a search engine to try to find these pages.
ARGUMENTS IN SUPPORT: California Credit Union League explains how this bill could help victims of data breaches:
With increased cases of data breaches and identity theft, it is more important now than ever to provide clear guidance to victims on what steps to take following a data breach of their personal information. Placing a credit freeze is an effective and important step for victims to take to prevent identity theft and fraud. By requiring agencies to include the credit reporting agencies websites in the security breach notification and authorizing the notification to include steps on how to freeze your credit, AB 1712 will allow California consumers to better protect themselves and their personal information.
REGISTERED SUPPORT / OPPOSITION:
Support
California Credit Union League
Opposition
None on file
Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200
Bill Author
Bill Co-Author(s):