California lawmaker tries again with data breach bill

Share this article:

For a third time, a California lawmaker has introduced a bill that would update the state's pioneering data breach notification law, SB-1386, to include additional requirements for organizations that lose sensitive data.

The proposal, introduced Thursday by Democratic state Sen. Joe Simitian, would require that breach notification letters contain specifics of the incident, including the type of personal information exposed, a description of what happened, and advice on steps to take to protect oneself from identity theft. The law also would mandate that organizations that suffer a breach affecting 500 or more people must submit a copy of the alert letter to the state attorney general's office.

Twice before, the bill has gone to former Gov. Arnold Schwarzenegger's desk to be signed but was vetoed

Simitian said in a news release that he hopes the new administration, led by Gov. Jerry Brown, "will give this issue a fresh look."

In defense of his 2009 veto, Schwarzenegger said there was no proof the additional information required by the legislation would actually help consumers. In addition, he said he saw no reason why the attorney general's office needed to become a "repository" of data breach notifications.

“This new measure makes modest but helpful changes for consumers,” Simitian said. “By requiring notice to the attorney general, it will enable law enforcement to identify patterns of data theft and to understand the scope of the threat.”

Meanwhile, another Simitian-backed law, which bans email impersonation, took effect on Jan. 1. SB-1411 makes it a misdemeanor to digitally impersonate another person, through channels such as email or social networking site, with criminal intent to harm, intimidate, threaten, or defraud.
Share this article:

Sign up to our newsletters

More in News

Instagram iOS and Android apps vulnerable to session hijacking

Two researchers wrote about the Instagram app for iOS and Android is vulnerable to session hijacking because both send unsecured information through HTTP.

Report: Hackers stole data from Israeli defense firms

A report by Brian Krebs detailed the intrusions, which occurred between Oct. 2011 and Aug. 2012.

Neverquest trojan targets regional banks in Japan

Symantec researchers found a new variant of the banking trojan.