California Legislature—2013–14 Regular Session

Assembly BillNo. 1149


Introduced by Assembly Member Campos

February 22, 2013


An act to amend Section 1798.29 of the Civil Code, relating to identity theft.

LEGISLATIVE COUNSEL’S DIGEST

AB 1149, as introduced, Campos. Identity theft: local agencies.

Existing law requires any state office, officer, or executive agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

This bill would expand this disclosure requirement to apply to a breach of computerized data that is owned or licensed by a local agency. The bill would create a state-mandated local program by imposing new duties on local agencies.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to these statutory provisions.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.

The people of the State of California do enact as follows:

P2    1

SECTION 1.  

Section 1798.29 of the Civil Code is amended
2to read:

3

1798.29.  

(a) Any agency that owns or licenses computerized
4data that includes personal information shall disclose any breach
5of the security of the system following discovery or notification
6of the breach in the security of the data to any resident of California
7whose unencrypted personal information was, or is reasonably
8believed to have been, acquired by an unauthorized person. The
9disclosure shall be made in the most expedient time possible and
10without unreasonable delay, consistent with the legitimate needs
11of law enforcement, as provided in subdivision (c), or any measures
12necessary to determine the scope of the breach and restore the
13reasonable integrity of the data system.

14(b) Any agency that maintains computerized data that includes
15personal information that the agency does not own shall notify the
16owner or licensee of the information of any breach of the security
17of the data immediately following discovery, if the personal
18information was, or is reasonably believed to have been, acquired
19by an unauthorized person.

20(c) The notification required by this section may be delayed if
21a law enforcement agency determines that the notification will
22impede a criminal investigation. The notification required by this
23section shall be made after the law enforcement agency determines
24that it will not compromise the investigation.

25(d) Any agency that is required to issue a security breach
26notification pursuant to this section shall meet all of the following
27requirements:

28(1) The security breach notification shall be written in plain
29language.

30(2) The security breach notification shall include, at a minimum,
31the following information:

32(A) The name and contact information of the reporting agency
33subject to this section.

34(B) A list of the types of personal information that were or are
35reasonably believed to have been the subject of a breach.

36(C) If the information is possible to determine at the time the
37notice is provided, then any of the following: (i) the date of the
38breach, (ii) the estimated date of the breach, or (iii) the date range
P3    1within which the breach occurred. The notification shall also
2include the date of the notice.

3(D) Whether the notification was delayed as a result of a law
4enforcement investigation, if that information is possible to
5determine at the time the notice is provided.

6(E) A general description of the breach incident, if that
7information is possible to determine at the time the notice is
8provided.

9(F) The toll-free telephone numbers and addresses of the major
10credit reporting agencies, if the breach exposed a social security
11number or a driver’s license or California identification card
12number.

13(3) At the discretion of the agency, the security breach
14notification may also include any of the following:

15(A) Information about what the agency has done to protect
16individuals whose information has been breached.

17(B) Advice on steps that the person whose information has been
18breached may take to protect himself or herself.

19(e) Any agency that is required to issue a security breach
20notification pursuant to this section to more than 500 California
21residents as a result of a single breach of the security system shall
22electronically submit a single sample copy of that security breach
23notification, excluding any personally identifiable information, to
24the Attorney General. A single sample copy of a security breach
25notification shall not be deemed to be within subdivision (f) of
26Section 6254 of the Government Code.

27(f) For purposes of this section, “breach of the security of the
28system” means unauthorized acquisition of computerized data that
29compromises the security, confidentiality, or integrity of personal
30information maintained by the agency. Good faith acquisition of
31personal information by an employee or agent of the agency for
32the purposes of the agency is not a breach of the security of the
33system, provided that the personal information is not used or
34subject to further unauthorized disclosure.

35(g) For purposes of this section, “personal information” means
36an individual’s first name or first initial and last name in
37combination with any one or more of the following data elements,
38when either the name or the data elements are not encrypted:

39(1) Social security number.

P4    1(2) Driver’s license number or Californiabegin delete Identification Cardend delete
2begin insert identification cardend insert number.

3(3) Account number, credit or debit card number, in combination
4with any required security code, access code, or password that
5would permit access to an individual’s financial account.

6(4) Medical information.

7(5) Health insurance information.

8(h) (1) For purposes of this section, “personal information”
9does not include publicly available information that is lawfully
10made available to the general public from federal, state, or local
11government records.

12(2) For purposes of this section, “medical information” means
13any information regarding an individual’s medical history, mental
14or physical condition, or medical treatment or diagnosis by a health
15care professional.

16(3) For purposes of this section, “health insurance information”
17means an individual’s health insurance policy number or subscriber
18identification number, any unique identifier used by a health insurer
19to identify the individual, or any information in an individual’s
20application and claims history, including any appeals records.

21(i) For purposes of this section, “notice” may be provided by
22one of the following methods:

23(1) Written notice.

24(2) Electronic notice, if the notice provided is consistent with
25the provisions regarding electronic records and signatures set forth
26in Section 7001 of Title 15 of the United States Code.

27(3) Substitute notice, if the agency demonstrates that the cost
28of providing notice would exceed two hundred fifty thousand
29dollars ($250,000), or that the affected class of subject persons to
30be notified exceeds 500,000, or the agency does not have sufficient
31contact information. Substitute notice shall consist of all of the
32following:

33(A) E-mail notice when the agency has an e-mail address for
34the subject persons.

35(B) Conspicuous posting of the notice on the agency’s Internet
36Web site page, if the agency maintains one.

37(C) Notification to major statewide media and the Office of
38Information Security within thebegin delete California Technology Agencyend delete
39begin insert Department of Technologyend insert.

P5    1(j) Notwithstanding subdivision (i), an agency that maintains
2its own notification procedures as part of an information security
3policy for the treatment of personal information and is otherwise
4consistent with the timing requirements of this part shall be deemed
5to be in compliance with the notification requirements of this
6section if it notifies subject persons in accordance with its policies
7in the event of a breach of security of the system.

begin insert

8(k) Notwithstanding the exception specified in paragraph (4)
9of subdivision (b) of Section 1798.3, for purposes of this section,
10“agency” includes a local agency, as defined in subdivision (a)
11of Section 6252 of the Government Code.

end insert
12

SEC. 2.  

If the Commission on State Mandates determines that
13this act contains costs mandated by the state, reimbursement to
14local agencies and school districts for those costs shall be made
15pursuant to Part 7 (commencing with Section 17500) of Division
164 of Title 2 of the Government Code.



O

    99