CA Senate Bill 825

AMENDED IN ASSEMBLY JUNE 22, 2005
AMENDED IN SENATE MAY 23, 2005
AMENDED IN SENATE MAY 10, 2005
AMENDED IN SENATE APRIL 26, 2005
AMENDED IN SENATE APRIL 18, 2005
AMENDED IN SENATE APRIL 13, 2005

SENATE BILL No. 852

Introduced by Senator Bowen
(Coauthor: Senator Alquist)
February 22, 2005

An act to amend Sections 1798.29 and 1798.82 of the Civil Code,
relating to identity theft.

LEGISLATIVE COUNSEL'S DIGEST

SB 852, as amended, Bowen. Identity theft.
Existing law requires any agency, or a person or business
conducting business in California, which owns or licenses
computerized data that includes personal information, as defined, to
disclose in specified ways, any breach of the security of the data, as
defined, to any California resident whose unencrypted personal
information was, or is reasonably believed to have been, acquired by
an unauthorized person. Existing law allows that notification to be
delayed if a law enforcement agency determines that the notification
will impede a criminal investigation.
This bill would require an agency, or a person or business
conducting business in California, that owns, licenses, or collects
computerized data that includes the personal information of a
California resident, to notify the resident of any breach of the security
of the data, as specified, regardless of whether the data was
computerized when it was acquired. The bill would require a copy of
the notice to be sent to the Office of Privacy Protection. The bill
would also revise the definition of personal information in this context
and would prescribe that a request by a law enforcement agency to
delay notification be in writing or made electronically, as specified.
By adding to the duties of local law enforcement agencies, this bill
would impose a state-mandated local program.
The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the state.
Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that, if the Commission on State Mandates
determines that the bill contains costs mandated by the state,
reimbursement for those costs shall be made pursuant to these
statutory provisions.
Vote: majority. Appropriation: no. Fiscal committee: yes.
State-mandated local program: yes.

The people of the State of California do enact as follows:

SECTION 1. Section 1798.29 of the Civil Code, as added by
Section 2 of Chapter 1054 of the Statutes of 2002, is amended to
read:
1798.29. (a) Any agency that owns, licenses, or collects
computerized data that includes personal information shall
disclose any breach of the security of the system following
discovery of the breach in the security of the data, or upon receipt
of notice under subdivision (b), to any resident of California
whose personal information was, or is reasonably believed to
have been, acquired by an unauthorized person, regardless of
whether the data was in computerized form at the time of the
unauthorized acquisition. The disclosure shall be made in the
most expedient time possible and without unreasonable delay,
consistent with the legitimate needs of law enforcement, as
provided in subdivision (c), or any measures necessary to
determine the scope of the breach and restore the reasonable
integrity of the data system.

(b) Any agency in possession of computerized data that
includes personal information that the agency does not own shall
notify the owner or licensee of the information of any breach of
the security of the data immediately following discovery, if the
personal information was, or is reasonably believed to have been,
acquired by an unauthorized person, regardless of whether the
data was in computerized form at the time of the unauthorized
acquisition.
(c) If a law enforcement agency determines that the
notification will impede a criminal investigation, the notification
required by this section may be delayed upon the written or
electronic request of the law enforcement agency. The
notification required by this section shall be made without
unreasonable delay after the law enforcement agency determines
that the notice will not compromise the investigation and so
notifies the agency in writing or electronically.
(d) For purposes of this section, “breach of the security of the
system” means unauthorized acquisition of computerized data
that compromises the security, confidentiality, or integrity of
personal information maintained by the agency, regardless of
whether the data was in computerized form at the time of
acquisition. Good faith acquisition of personal information by an
employee or agent of the agency for the purposes of the agency is
not a breach of the security of the system, provided that the
personal information is not used or subject to further
unauthorized disclosure. The mailing of materials containing an
individual’s personal information to the individual’s current
postal address or electronic mail address, as reflected in the
agency’s records, by an employee or agent of the agency, is not a
breach of the security of the system.
(e) (1) For purposes of this section, “personal information”
means an individual’s last name in combination with any one or
more of the following data elements, except as provided in
paragraph (2):
(A) Social security number.
(B) Driver’s license number or California identification card
number.
(C) Account number or credit or debit card number; or, if a
security code, access code, or password is required for access to
an individual’s financial account, the account number or credit or
debit card number in combination with the required code or
password.
(2) A name in combination with a data element is not personal
information, as specified in paragraph (1), if either the name or
data element is encrypted or redacted. However, this exception
shall not apply in either of the following cases:
(A) Encrypted information was, or is reasonably believed to
have been, acquired by an unauthorized person or persons who
had access to a key that could be used to decrypt the information.
(B) An unencrypted or unredacted data element was, or is
reasonably believed to have been, acquired in combination with
the individual’s address or telephone number.
(f) For purposes of this section, “notice” may be provided by
one of the following methods:
(1) Written notice.
(2) Electronic notice, if the notice provided is consistent with
the provisions regarding electronic records and signatures set
forth in Section 7001 of Title 15 of the United States Code.
(3) Substitute notice, if the agency demonstrates that the cost
of providing notice would exceed two hundred fifty thousand
dollars ($250,000), or that the affected class of subject persons to
be notified exceeds 500,000, or the agency does not have
sufficient contact information. Substitute notice shall consist of
all of the following:
(A) E-mail notice when the agency has an e-mail address for
the subject persons.
(B) Conspicuous posting of the notice on the agency’s Web
site page, if the agency maintains one.
(C) Notification to major statewide media.
(g) Notwithstanding subdivision (f), an agency that maintains
its own notification procedures as part of an information security
policy for the treatment of personal information and is otherwise
consistent with the timing requirements of this part shall be
deemed to be in compliance with the notification requirements of
this section if it notifies subject persons in accordance with its
policies in the event of a breach of security of the system.
(h) Regardless of the method by which notice is provided, that
notice shall include a description of the elements of personal
information that were, or are reasonably believed to have been,
acquired by an unauthorized person.

(i) A California resident may be determined to be an
individual whose current postal mailing address, as reflected in
the records of the agency, is in California.
(j) In the event that more than 5,000 California residents are to
be notified at one time, the agency shall also notify, without
delaying the notice to California residents for this reason, the
three consumer reporting agencies that compile and maintain
files on consumers on a nationwide basis, as defined by 15
U.S.C. Sec. 1681a, or their successors, of the timing, content, and
distribution of the notices and approximate number of affected
persons.
(k) A copy of the notice provided in accordance with
subdivision (f) or (g) shall be provided without unreasonable
delay to the Office of Privacy Protection.
SEC. 2. Section 1798.82 of the Civil Code, as added by
Section 4 of Chapter 1054 of the Statutes of 2002, is amended to
read:
1798.82. (a) Any person or business that conducts business
in California, and that owns, licenses, or collects computerized
data that includes personal information, shall disclose any breach
of the security of the system following discovery of the breach in
the security of the data, or upon receipt of notice under
subdivision (b), to any resident of California whose personal
information was, or is reasonably believed to have been, acquired
by an unauthorized person, regardless of whether the data was in
computerized form at the time of the unauthorized acquisition.
The disclosure shall be made in the most expedient time possible
and without unreasonable delay, consistent with the legitimate
needs of law enforcement, as provided in subdivision (c), or any
measures necessary to determine the scope of the breach and
restore the reasonable integrity of the data system.
(b) Any person or business in possession of computerized data
that includes personal information that the person or business
does not own shall notify the owner or licensee of the
information of any breach of the security of the data immediately
following discovery, if the personal information was, or is
reasonably believed to have been, acquired by an unauthorized
person, regardless of whether the data was in computerized form
at the time of the unauthorized acquisition.
(c) If a law enforcement agency determines that the
notification will impede a criminal investigation, the notification
required by this section may be delayed upon the written or
electronic request of the law enforcement agency. The
notification required by this section shall be made without
unreasonable delay after the law enforcement agency determines
that the notice will not compromise the investigation and so
notifies the person or business in writing or electronically.
However, a request or notice by a law enforcement agency to a
person or business pursuant to this subdivision may only be made
electronically if the person or business is able to receive the
request or notice electronically.
(d) For purposes of this section, “breach of the security of the
system” means unauthorized acquisition of computerized data
that compromises the security, confidentiality, or integrity of
personal information maintained by the person or business,
regardless of whether the data was in computerized form at the
time of acquisition. Good faith acquisition of personal
information by an employee or agent of the person or business
for the purposes of the person or business is not a breach of the
security of the system, provided that the personal information is
not used or subject to further unauthorized disclosure. The
mailing of materials containing an individual’s personal
information to the individual’s current postal address or
electronic mail address, as reflected in the records of the person
or business, by the person or business, is not a breach of the
security of the system.
(e) (1) For purposes of this section, “personal information”
means an individual’s last name in combination with any one or
more of the following data elements, except as specified in
paragraph (2):
(A) Social security number.
(B) Driver’s license number or California identification card
number.
(C) Account number or credit or debit card number; or, if a
security code, access code, or password is required for access to
an individual’s financial account, the account number or credit or
debit card number in combination with the required code or
password.
(2) A name in combination with a data element is not personal
information, as specified in paragraph (1), if either the name or
data element is encrypted or redacted. However, this exception
shall not apply in either of the following cases:
(A) Encrypted information was, or is reasonably believed to
have been, acquired by an unauthorized person or persons who
had access to a key that could be used to decrypt the information.
(B) An unencrypted or unredacted data element was, or is
reasonably believed to have been, acquired in combination with
the individual’s address or telephone number.
(f) For purposes of this section, “notice” may be provided by
one of the following methods:
(1) Written notice.
(2) Electronic notice, if the notice provided is consistent with
the provisions regarding electronic records and signatures set
forth in Section 7001 of Title 15 of the United States Code.
(3) Substitute notice, if the person or business demonstrates
that the cost of providing notice would exceed two hundred fifty
thousand dollars ($250,000), or that the affected class of subject
persons to be notified exceeds 500,000, or the person or business
does not have sufficient contact information. Substitute notice
shall consist of all of the following:
(A) E-mail notice when the person or business has an e-mail
address for the subject persons.
(B) Conspicuous posting of the notice on the Web site page of
the person or business, if the person or business maintains one.
(C) Notification to major statewide media.
(g) Notwithstanding subdivision (f), a person or business that
maintains its own notification procedures as part of an
information security policy for the treatment of personal
information and is otherwise consistent with the timing
requirements of this part, shall be deemed to be in compliance
with the notification requirements of this section if the person or
business notifies subject persons in accordance with its policies
in the event of a breach of security of the system.
(h) Regardless of the method by which notice is provided, that
notice shall include a description of the elements of personal
information that were, or are reasonably believed to have been,
acquired by an unauthorized person.
(i) A California resident may be determined to be an
individual whose current postal mailing address, as reflected in
the records of the person or business, is in California.
(j) In the event that more than 5,000 California residents are to
be notified at one time, the person or business shall also notify,
without delaying the notice to California residents for this reason,
the three consumer reporting agencies that compile and maintain
files on consumers on a nationwide basis, as defined by 15
U.S.C. Sec. 1681a, or their successors, of the timing, content, and
distribution of the notices and approximate number of affected
persons.
(k) A copy of the notice provided in accordance with
subdivision (f) or (g) shall be provided without unreasonable
delay to the Office of Privacy Protection.
SEC. 3. If the Commission on State Mandates determines that
this act contains costs mandated by the state, reimbursement to
local agencies and school districts for those costs shall be made
pursuant to Part 7 (commencing with Section 17500) of Division
4 of Title 2 of the Government Code.

back

Did you know

Ninh Phamhi
Information Security Officer
Director of Internal Control
ninh.phamhi@sjsu.edu
(408) 924-1603
SJSU Clark Hall 562