Antitrust Law Daily Wrap Up, PRIVACY NEWS: Bill expanding California data security requirements sent to Governor Brown, (Aug 28, 2014)

By Thomas Long, J.D.

California’s data security requirements will be extended to businesses that “maintain” personal information about a California resident, if a bill approved by the California legislature is signed by Governor Jerry Brown. Currently, California Civil Code Sec. 1798.81.5 requires businesses that own or license personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, in order to protect the information from unauthorized access, destruction, use, modification, or disclosure. The legislation does not define “maintain,” but the bill specifies that the term covers individuals and businesses that do not themselves own or license the information at issue.

California’s breach notification law (Civil Code Sec. 1798.82) would be expanded by the bill to require a notification from a person or business that was the “source” of the security breach to include an offer to provide appropriate identity theft prevention and mitigation services to the affected person at no cost for at least 12 months, if the breach exposed or may have exposed the person’s Social Security number, driver’s license number, or California identification card number. Under existing law, a person or business conducting business in California that owns or licenses computerized data that includes personal information must disclose a data security breach, upon discovery of it, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

The bill also would amend Civil Code Sec. 1798.85 to generally prohibit the sale of, advertisement for sale of, or offer to sell an individual’s Social Security number. The term “sell” would not include the release of a Social Security number that is “incidental to a larger transaction and is necessary to identify the individual in order to accomplish a legitimate business purpose.” The bill specifically states that release of an individual’s Social Security number for marketing purposes would not be permitted. The current version of the law bans posting or displaying an individual’s Social Security number or doing certain other acts that might compromise the security of the number, unless otherwise required by federal or state law.

On August 25, 2014, final Senate amendments to Assembly Bill 1710 were concurred in by the California Assembly, and the measure was enrolled and sent to Governor Brown for his signature.

News: Privacy CaliforniaNews