California State Security Breach Laws

Published July 12, 2010

Senate Bill: 1386

California Civil Code: §1798.82

Effective Date: July 1, 2003

Definition of Personal Information: An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(a) Social security number;

(b) Driver's license number or California Identification Card number;

(c) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account;

(d) Medical information; and

(e) Health insurance information.

Summary: Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Visit the state Web site

Additional Resources

Office of Privacy Protection
A state law enacted in 2000 created the Office of Privacy Protection, with the mission of protecting and promoting the privacy rights of California consumers.

California Online Privacy Protection Act
The California Online Privacy Protection Act requires a privacy policy to be posted on all commercial Web sites that collect personal information on California consumers. It also requires operators of commercial Web sites to comply with their posted policies. In other words, Web sites must say what they do and do what they say with Californians’ personal information.

Assembly Bill 1950
Assembly Bill 1950 (AB 1950) requires a business, other than specified entities, that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, destruction, use, modification, or disclosure. AB 1950 also requires a business that discloses personal information to a nonaffiliated third party, to require by contract that those entities maintain reasonable security procedures, as specified.

A California Business Privacy Handbook
A publication by the Office of Privacy Protection California Department of Consumer Affairs. The publication is for informational purposes and should not be construed as legal advice or as policy of the State of California.

Financial Information Privacy Act
The Financial Information Privacy Act gives Californians more say in how their personal financial information is used. The law, which applies to banks, insurance companies, securities firms and other financial service companies doing business in California, provides more consumer control than federal law. It also requires an easy-to-read, plain-language privacy notice. This Web site contains the full-text of the Act.

A A A

Print Page

Get a free version of Adobe Acrobat Reader