Intellectual Property Law

California State Senator Joe Simitian, the man responsible in large part for the nation's first data-breach notification law, said he's working on legislation, already introduced, that would require companies that do business in California to provide more information in their breach notification letters to consumers and send simultaneous notification to state authorities.

But Simitian (pictured at right) said getting consumers compensated for data breaches isn't high on the priority list for legislators.

Simitian, speaking at the Security Breach Notification symposium in Berkeley, said the new legislation would force entities that are breached to provide more specific and clearer information in their breach notices so that consumers, and public agencies that monitor breaches, might know more about when a breach occurred, the extent of it, and, in the case of consumers, have enough information to determine on their own whether they face a risk of harm.

Such information, combined with simultaneous notification to state authorities, he said, would give law enforcement, researchers and others better data for understanding the nature and scope of the data breach problem instead of relying on reports from media outlets, which don't cover every breach that occurs.

But Simitian, responding to a question from the audience of lawyers, academics and privacy advocates, said efforts to impose compensation for victims of a breach are not on the table and are not likely to be for a while. He said that legislating compensation to consumers raises questions about whether it would become a deterrent to a company reporting a breach.

"Right now, there is already a significant deterrent [to reporting a breach] in terms of the shame and cost factor," Simitian said. "If that cost becomes more significant, will people push it aside in the hope that no one will ever determine they had a breach?"

Instead, the next focus of legislation, he said, would likely be on who should bear the cost of sending out notifications to consumers. For example, should a credit-card processing company that experiences a breach be responsible for the cost of notifying bank customers whose cards are breached?

When retailer TJX discovered in 2006 that hackers had breached credit and debit card numbers passing through its network, banks were left notifying the customers, then sued TJX to get compensation for those costs. Heartland Payment Systems, which experienced a breach of credit and debit card numbers in January, has recently been sued by banks to recover their breach notification costs.

Simitian spent a large part of his talk discussing how the country's first data breach notification law came to pass in California in 2003. According to the law, any entity that does business in the state and experiences a breach involving personally identifiable information of California residents must notify residents when their information is compromised. California's law prompted more than 40 other states to pass similar legislation in the absence of a single federal notification law.

The law has led to more transparency about computer security practices at companies, but had an inauspicious start.

In early 2001, Simitian said he had just been elected a California state assembly member when he became chair of a privacy committee in the assembly. He began investigating issues related to online privacy and identified nine important ones on which to focus his attention.

But Simitian said he needed one well-defined issue around which he could write a bill that would have a high chance of being passed as a law. He decided to focus on privacy policies for web sites. He wrote a bill that would require companies doing business in California, that also collected personally identifiable information from their users, post a privacy policy and be obligated to comply with the policy.

Forty-eight hours before the deadline for introducing the bill, he consulted two privacy legal experts and one of them, Deirdre Mulligan, now an assistant professor at UC Berkeley's School of Information, suggested he add something to the bill related to breach notification.

"If you actually got it passed," she said, "it would be a very big deal."

Simitian thought it was too ambitious but added it to his bill as a bargaining chip, a giveaway for negotiating the other privacy issue he really wanted to pass.

His fellow assembly members, however, rejected it.

The issue seemed dead until Simitian caught a break. On April 5, 2002, hackers accessed sensitive information on about 265,000 state workers that were maintained in a state database. The information included employee names, Social Security Numbers, and payroll deduction information.

The breach wasn't discovered until May 7, and state employees weren't notified until May 21st. During this time, someone in Germany attempted to access one state worker's bank account, and someone else attempted to conduct a fraudulent charge on another worker's credit account.

Among those who received notices that their information was breached were 80 members of the California assembly and 40 members of the state senate. The chair of the senate privacy committee was among those who received a notice and immediately wanted to draft legislation to address the issue.

"The issue was no longer hypothetical," Simitian said. "It was personal."

The state passed the notification law in 2003.

Simitian hoped the shame of reporting a breach would be an incentive for companies to improve their security. He also hoped consumers outside California would benefit from the law since, from a public relations perspective, it would be hard for a company that experienced a nationwide breach to notify consumers in California and not notify consumers in other states.

"I think this has been more fully realized than we could ever have hoped at the time," Simitian said.

Simitian said he was surprised by the resistance he received at the time from Silicon Valley companies that opposed the bill.

"The future of e-commerce is directly linked to the public's confidence in online protection and data security," he said. "Enlightened self-interest should have made the hi-tech industry an advocate rather than an adversary for this legislation."

Simitian was asked after his talk if California would consider including notification requirements for breaches involving paper records. The law currently covers only electronic records.

Simitian acknowledged that breaches of paper records are a problem, but said it was questionable whether he could get such a law passed in California. He said he had focused his original bill on electronic data breaches because the "sheer volume of information [collected in databases] and the speed with which it can be moved online" made it a more pressing issue.

Photo: David M. Grady