California has led the way in implementing data breach notification laws that were later adopted by nearly every other state in some form. As of January 1, 2016, the statutory requirements under California’s breach notification law will be amended to increase the scope of covered data and provide enhanced notices to inform individuals of a data breach. While these rules are applicable to California employers, they are also relevant to any entity that collects and stores information related to an individual in California.
The data breach notification amendments are covered in three bills- SB 34, AB 964 and SB 570. The legislation redefines personal information to encompass all data gathered through a license plate recognition system, in addition to the traditional forms of data, such as Social Security numbers, driver’s license information and health and insurance records. The amended law also clarifies the definition of “encrypted” data, which was not precisely delineated under the original law. Encrypted data refers to information that is “rendered unusable, unreadable or indecipherable” to an “unauthorized person” using the technology employed in the area of information security. Because the current law applies only to unencrypted data obtained by an unauthorized party, encrypting the data circumvents accountability under the law.
The most far-reaching aspect of the reform bills concerns the language required in the written or electronic notifications to be furnished to individuals whose private information has been compromised. Rather than providing notice in “plain language,” the law provides a new format for notice that must be explicitly entitled “Notice of Data Breach” and contain clear captions to summarize the following information: details of the data breach incident, the type of information that was disclosed, corrective measures undertaken by the company, actions to be taken by the affected party and references for obtaining more information.
Shane Coons offers expertise in various laws affecting businesses in California. Contact him at 949-333-0900 or visit his website at www.ShaneCoonsLaw.com to find out more about the practice.