California moves closer to making retailers responsible for data breaches

Share this article:

California, which has the most stringent consumer and data privacy laws in the country, has moved a step closer to forcing retailers — rather than financial institutions — to notify consumers when theyve suffered a data breach.

The state Senate Judiciary Committee passed AB 779 on a 3-to-1 vote, bringing it into step with the state Assembly, which in June approved a matching breach notification bill, authored by Assemblyman Dave Jones, D-Sacramento.

As with California SB 1386, which requires financial institutions to notify California consumers when they lose personal information, the bill would apply to all companies doing business with state residents.

"This is good for consumers. It's a bill that's long overdue," said Joe Ridout, a spokesman for Consumer Action, a non-profit consumer-advocacy group. "Putting the responsibility on retailers is appropriate when there's been a data breach because retailers simply shrug off the burden and pass the mess they've made off to consumers."

The assembly bill, passed with overwhelming bipartisan support, would require retailers to notify consumers after losing credit or debit card information. Retailers would be required to pay for the cost of notifying consumers and replacing their cards, and they would be forced to follow Payment Card Industry (PCI) standards, which mandate security for credit and debit card information.

California's legislation is "the reason why many people in other states have been notified" of data breaches in the last couple of years, Ridout said. He pointed to the ChoicePoint data breach of February, 2005, which became well known because of SB 1386.

The bill faces approval by the Senate Appropriations Committee this summer, then a vote by the full Senate. The bill then must be signed into law by Gov. Arnold Schwarzenegger, a Republican.

Such a law could serve as a model for federal policy, although efforts to pass similar federal legislation have stalled in committee in both houses of Congress.

Minnesota legislators passed a similar bill, the Minnesota Plastic Card Security Act, which regulates the storage of consumers’ personal information after a purchase.

Get more IT security news. Click here for SC Magazine Blogs.

Share this article:

Sign up to our newsletters

More in News

Feds warn health care sector of looming cyber attacks

The FBI believes that the lax security systems that the health care industry has in place make it a prime target for cyber attacks.

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.