Consumer Law

California Improves its Data Security Breach Law

By Kemnitzer, Anderson, Barron, Ogilvie & Brewer

As we all know, businesses collect identifying information on millions of consumers, which is stored in computerized databases. From time to time, hackers get into the system and steal the personal information. Or an employee loses a laptop containing such information. The thieves then use the personal information to open credit card accounts in consumers' names. Or order merchandise using the consumers' information. The result is identity theft on a large scale.

In 2002, California enacted the first law requiring any business that experiences a breach of its security system such that names, addresses, credit card number or social security numbers is lost must inform affected consumers in the most expedient time possible. To comply with the law, businesses typically send letters to the persons whose data was lost; however, studies showed that the letters were often too vague to be of much value.

The Legislature has now amended the law to specify that the notice letters must contain the name and contact information of the business that lost the data, a list of the types of personal information that may have been lost, and a toll-free number for persons to call for more information. The letters must also disclose the date and description of the breach incident, and what the business is willing to do to assist the consumers. This information should help consumers know how to protect their own credit from fraudsters.

Businesses that have not complied with California and other states' laws have been the target of class actions seeking damages.

Full post as published by California Credit Law Blog on October 11, 2010 (boomark / email).