What does California's data breach law ask a business to do?

Who does this law apply to?

The law applies to an individual or business that conducts business in California and owns or licenses computerized data that includes personal information.

It must disclose a breach to each California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

An individual or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person,

What counts as personal information?

Personal information is a first name or first initial and last name joined with items such as a Social Security number, a government identification number, a financial account or card number with its access code, medical or health insurance information, biometric data or genetic data, where either part is not encrypted.

A username or email address with the password or security question and answer for an online account is covered on its own.

(1) An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(2) A username or email address, in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The text says the disclosure must be made within 30 calendar days of discovery or notification of the breach.

It may be delayed for the legitimate needs of law enforcement, or as needed to determine the scope of the breach and restore the reasonable integrity of the data system.

(A) Subject to subparagraph (B), the disclosure required by this subdivision shall be made within 30 calendar days of discovery or notification of the data breach.

(B) An individual or business may delay the disclosure required by this subdivision to accommodate the legitimate needs of law enforcement, pursuant to subdivision (c), or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Who else must be told?

If more than 500 California residents must be notified because of one breach, a sample copy of the notice, without personal details, must be sent electronically to the Attorney General within 15 calendar days of notifying them.

An individual or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers of the security breach.

Is encrypted information treated differently?

Encrypted information counts only when the encryption key or security credential was also acquired, or is reasonably believed to have been, and the business reasonably believes the key could make the information readable.

Encrypted means made unusable, unreadable or indecipherable to an unauthorized person through a method generally accepted in information security.

or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person,

(4) For purposes of this section, "encrypted" means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.

What if a vendor holds the data?

A business that maintains the data for someone else must tell the owner or licensee immediately after discovering a breach.

(b) An individual or business that maintains computerized data that includes personal information that the individual or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.