California blazes trail again with enhanced breach alert law

Share this article:

After being vetoed twice by the prior administration, a bill that updates California's pioneering data breach notification law was signed into law Wednesday by Gov. Jerry Brown.

Introduced by Democratic state Sen. Joe Simitian, SB-24 bolsters SB-1386, the nation's first law requiring companies to alert California residents if their personal data is accessed illegally. Since that legislation took effect eight years ago, nearly all 50 states have followed suit with their own versions.

The update, meanwhile, requires that breach notification letters contain specifics of the incident, including the type of personal information exposed, a description of what happened, and advice on steps to take to protect oneself from identity theft. The law also mandates that organizations that sustain a breach affecting 500 or more people submit a copy of the alert letter to the state attorney general's office.

"No one likes to get the news that personal information about them has been stolen," Simitian said. "But when it happens, people deserve to get the information they need to decide what to do next."

The bill faced an uphill climb, however. Twice before, it had gone to former Gov. Arnold Schwarzenegger's desk to be signed, but was vetoed. In defense, Schwarzenegger said there was no proof the additional information required by the legislation would actually help consumers. In addition, he said he saw no reason why the attorney general's office needed to become a "repository" of breach notifications.

Share this article:

Sign up to our newsletters

More in News

Instagram iOS and Android apps vulnerable to session hijacking

Two researchers wrote about the Instagram app for iOS and Android is vulnerable to session hijacking because both send unsecured information through HTTP.

Report: Hackers stole data from Israeli defense firms

A report by Brian Krebs detailed the intrusions, which occurred between Oct. 2011 and Aug. 2012.

Neverquest trojan targets regional banks in Japan

Symantec researchers found a new variant of the banking trojan.