Intellectual Property Law

California Database Security Breach Statute

By IBLS Editor

Databases with customers' sensitive information became the target of identity thieves.  Identity thieves discovered that by accessing relevant databases they have row material for months to come.  Consequently, State legislators in the United States ("US") have placed some burden on database holders (companies or individuals) and demanded them to secure unencrypted information and notify customers of database breaches.  The State of California enacted the first data breach statute in the US in 2003.  Many other states followed the California initiative.  This article briefly explains the notification requirement under California Data Breach statute.

Basic Rule: California Civil Code §1798.82 (as amended on January 2008) requires business to disclose any data breach involving California residents.   "Any person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." 

It is important to note that the requirement applies to any business keeping 'personal" information about California residents no matter where the database is physically located.  Thus, a company doing business with California residents and having its database physically located in any other US state must comply with this statutory norm. 

Definition of personal information: Personal information is defined as the individuals first name or first initial and last name, together with any of the following documents, (i) social security number; (ii) California driver license number; (iii) credit, debit, or bank account numbers, including security and access codes, and passwords' (iv) medical information; and (v) health insurance information.  According to the statute, personal information does not include information made available through general public records from the federal, state, or local government.

Definition of security breach: "unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business."

Notifications:  the statute does not provide a specific timeframe to make notifications for data breaches.  The statute says, notifications have to be made ?in the most expedient time possible and without unreasonable delay." Yet, notifications may be delayed if a law enforcement agency determines that the notification may impede a criminal investigation.  

Notifications may be made by the following means:

1.      Written notice to the customers whose personal information has been compromised;

2.      Electronic notice provided that is according to the electronic records and e-signatures of 15 U.S.C §7001;

If providing these notices is costly to the business or individual as to exceed US$250,000 or the customers to be notified exceed 500,000 or the business or individual does not have sufficient contact information, a substitute notice may be sent in any of the following forms:

1.      E-mail notice if e-mail addresses are available;

2.      Posting the notice in the business or individuals' website;

3.      Notification to major statewide media.

Since non-compliance of this notification requirement allows customers to sue the data holder for damages, the notification requirement has been carefully followed by companies experiencing data breach problems.  For instance, in the case of Garcia v. Unionbancal Corp., a briefcase from an employee of Unionbancal was stolen.  That briefcase contained personal information about California residents and customers of the bank.  The bank made proper notifications under California Civil Code § 1798.82 but the affected parties still filed a lawsuit under tort and commercial grounds. This is a common example of cases under state data breach statutes.  Even when the notifications are properly made, consumers and owners of the compromised data may file lawsuits under other grounds; typically, torts and commercial cause of actions. 
 

Full post as published by IBLS Internet Law Blog on April 01, 2008 (boomark / email).