Amended in Senate September 4, 2013

California Legislature—2013–14 Regular Session

Assembly BillNo. 1149


Introduced by Assembly Member Campos

February 22, 2013


An act to amend Section 1798.29 of the Civil Code, relating to identity theft.

LEGISLATIVE COUNSEL’S DIGEST

AB 1149, as amended, Campos. Identity theft: local agencies.

Existing law requires any state office, officer, or executive agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

This bill would expand this disclosure requirement to apply to a breach of computerized data that is owned or licensed by a local agency. The bill would create a state-mandated local program by imposing new duties on local agencies.

begin insert

This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 46 that would become operative if this bill and SB 46 are enacted and this bill is enacted last.

end insert

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to these statutory provisions.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.

The people of the State of California do enact as follows:

P2    1

SECTION 1.  

Section 1798.29 of the Civil Code is amended
2to read:

3

1798.29.  

(a) Any agency that owns or licenses computerized
4data that includes personal information shall disclose any breach
5of the security of the system following discovery or notification
6of the breach in the security of the data to any resident of California
7whose unencrypted personal information was, or is reasonably
8believed to have been, acquired by an unauthorized person. The
9disclosure shall be made in the most expedient time possible and
10without unreasonable delay, consistent with the legitimate needs
11of law enforcement, as provided in subdivision (c), or any measures
12necessary to determine the scope of the breach and restore the
13reasonable integrity of the data system.

14(b) Any agency that maintains computerized data that includes
15personal information that the agency does not own shall notify the
16owner or licensee of the information of any breach of the security
17of the data immediately following discovery, if the personal
18information was, or is reasonably believed to have been, acquired
19by an unauthorized person.

20(c) The notification required by this section may be delayed if
21a law enforcement agency determines that the notification will
22impede a criminal investigation. The notification required by this
23section shall be made after the law enforcement agency determines
24that it will not compromise the investigation.

25(d) Any agency that is required to issue a security breach
26notification pursuant to this section shall meet all of the following
27requirements:

28(1) The security breach notification shall be written in plain
29language.

30(2) The security breach notification shall include, at a minimum,
31the following information:

32(A) The name and contact information of the reporting agency
33subject to this section.

P3    1(B) A list of the types of personal information that were or are
2reasonably believed to have been the subject of a breach.

3(C) If the information is possible to determine at the time the
4notice is provided, then any of the following: (i) the date of the
5breach, (ii) the estimated date of the breach, or (iii) the date range
6within which the breach occurred. The notification shall also
7include the date of the notice.

8(D) Whether the notification was delayed as a result of a law
9enforcement investigation, if that information is possible to
10determine at the time the notice is provided.

11(E) A general description of the breach incident, if that
12information is possible to determine at the time the notice is
13provided.

14(F) The toll-free telephone numbers and addresses of the major
15credit reporting agencies, if the breach exposed a social security
16number or a driver’s license or California identification card
17number.

18(3) At the discretion of the agency, the security breach
19notification may also include any of the following:

20(A) Information about what the agency has done to protect
21individuals whose information has been breached.

22(B) Advice on steps that the person whose information has been
23breached may take to protect himself or herself.

24(e) Any agency that is required to issue a security breach
25notification pursuant to this section to more than 500 California
26residents as a result of a single breach of the security system shall
27electronically submit a single sample copy of that security breach
28notification, excluding any personally identifiable information, to
29the Attorney General. A single sample copy of a security breach
30notification shall not be deemed to be within subdivision (f) of
31Section 6254 of the Government Code.

32(f) For purposes of this section, “breach of the security of the
33system” means unauthorized acquisition of computerized data that
34compromises the security, confidentiality, or integrity of personal
35information maintained by the agency. Good faith acquisition of
36personal information by an employee or agent of the agency for
37the purposes of the agency is not a breach of the security of the
38system, provided that the personal information is not used or
39subject to further unauthorized disclosure.

P4    1(g) For purposes of this section, “personal information” means
2an individual’s first name or first initial and last name in
3combination with any one or more of the following data elements,
4when either the name or the data elements are not encrypted:

5(1) Social security number.

6(2) Driver’s license number or California identification card
7number.

8(3) Account number, credit or debit card number, in combination
9with any required security code, access code, or password that
10would permit access to an individual’s financial account.

11(4) Medical information.

12(5) Health insurance information.

13(h) (1) For purposes of this section, “personal information”
14does not include publicly available information that is lawfully
15made available to the general public from federal, state, or local
16government records.

17(2) For purposes of this section, “medical information” means
18any information regarding an individual’s medical history, mental
19or physical condition, or medical treatment or diagnosis by a health
20care professional.

21(3) For purposes of this section, “health insurance information”
22means an individual’s health insurance policy number or subscriber
23identification number, any unique identifier used by a health insurer
24to identify the individual, or any information in an individual’s
25application and claims history, including any appeals records.

26(i) For purposes of this section, “notice” may be provided by
27one of the following methods:

28(1) Written notice.

29(2) Electronic notice, if the notice provided is consistent with
30the provisions regarding electronic records and signatures set forth
31in Section 7001 of Title 15 of the United States Code.

32(3) Substitute notice, if the agency demonstrates that the cost
33of providing notice would exceed two hundred fifty thousand
34dollars ($250,000), or that the affected class of subject persons to
35be notified exceeds 500,000, or the agency does not have sufficient
36contact information. Substitute notice shall consist of all of the
37following:

38(A) begin deleteE-mail end deletebegin insertEmail end insertnotice when the agency has anbegin delete e-mailend deletebegin insert emailend insert
39 address for the subject persons.

P5    1(B) Conspicuous posting of the notice on the agency’s Internet
2Web site page, if the agency maintains one.

3(C) Notification to major statewide media and the Office of
4Information Security within the Department of Technology.

5(j) Notwithstanding subdivision (i), an agency that maintains
6its own notification procedures as part of an information security
7policy for the treatment of personal information and is otherwise
8consistent with the timing requirements of this part shall be deemed
9to be in compliance with the notification requirements of this
10section if it notifies subject persons in accordance with its policies
11in the event of a breach of security of the system.

12(k) Notwithstanding the exception specified in paragraph (4) of
13subdivision (b) of Section 1798.3, for purposes of this section,
14“agency” includes a local agency, as defined in subdivision (a) of
15Section 6252 of the Government Code.

16begin insert

begin insertSEC. 1.5.end insert  

end insert

begin insertSection 1798.29 of the end insertbegin insertCivil Codeend insertbegin insert is amended to
17read:end insert

18

1798.29.  

(a) Any agency that owns or licenses computerized
19data that includes personal information shall disclose any breach
20of the security of the system following discovery or notification
21of the breach in the security of the data to any resident of California
22whose unencrypted personal information was, or is reasonably
23believed to have been, acquired by an unauthorized person. The
24disclosure shall be made in the most expedient time possible and
25without unreasonable delay, consistent with the legitimate needs
26of law enforcement, as provided in subdivision (c), or any measures
27necessary to determine the scope of the breach and restore the
28reasonable integrity of the data system.

29(b) Any agency that maintains computerized data that includes
30personal information that the agency does not own shall notify the
31owner or licensee of the information of any breach of the security
32of the data immediately following discovery, if the personal
33information was, or is reasonably believed to have been, acquired
34by an unauthorized person.

35(c) The notification required by this section may be delayed if
36a law enforcement agency determines that the notification will
37impede a criminal investigation. The notification required by this
38section shall be made after the law enforcement agency determines
39that it will not compromise the investigation.

P6    1(d) Any agency that is required to issue a security breach
2notification pursuant to this section shall meet all of the following
3requirements:

4(1) The security breach notification shall be written in plain
5language.

6(2) The security breach notification shall include, at a minimum,
7the following information:

8(A) The name and contact information of the reporting agency
9subject to this section.

10(B) A list of the types of personal information that were or are
11reasonably believed to have been the subject of a breach.

12(C) If the information is possible to determine at the time the
13notice is provided, then any of the following: (i) the date of the
14breach, (ii) the estimated date of the breach, or (iii) the date range
15within which the breach occurred. The notification shall also
16include the date of the notice.

17(D) Whether the notification was delayed as a result of a law
18enforcement investigation, if that information is possible to
19determine at the time the notice is provided.

20(E) A general description of the breach incident, if that
21information is possible to determine at the time the notice is
22provided.

23(F) The toll-free telephone numbers and addresses of the major
24credit reporting agencies, if the breach exposed a social security
25number or a driver’s license or California identification card
26number.

27(3) At the discretion of the agency, the security breach
28notification may also include any of the following:

29(A) Information about what the agency has done to protect
30individuals whose information has been breached.

31(B) Advice on steps that the person whose information has been
32breached may take to protect himself or herself.

begin insert

33(4) In the case of a breach of the security of the system involving
34personal information defined in paragraph (2) of subdivision (g)
35for an online account, and no other personal information defined
36in paragraph (1) of subdivision (g), the agency may comply with
37this section by providing the security breach notification in
38electronic or other form that directs the person whose personal
39information has been breached to promptly change his or her
40password and security question or answer, as applicable, or to
P7    1take other steps appropriate to protect the online account with the
2agency and all other online accounts for which the person uses
3the same user name or email address and password or security
4question or answer.

end insert
begin insert

5(5) In the case of a breach of the security of the system involving
6personal information defined in paragraph (2) of subdivision (g)
7for login credentials of an email account furnished by the agency,
8the agency shall not comply with this section by providing the
9security breach notification to that email address, but may, instead,
10comply with this section by providing notice by another method
11described in subdivision (i) or by clear and conspicuous notice
12delivered to the resident online when the resident is connected to
13the online account from an Internet Protocol address or online
14location from which the agency knows the resident customarily
15accesses the account.

end insert

16(e) Any agency that is required to issue a security breach
17notification pursuant to this section to more than 500 California
18residents as a result of a single breach of the security system shall
19electronically submit a single sample copy of that security breach
20notification, excluding any personally identifiable information, to
21the Attorney General. A single sample copy of a security breach
22notification shall not be deemed to be within subdivision (f) of
23Section 6254 of the Government Code.

24(f) For purposes of this section, “breach of the security of the
25system” means unauthorized acquisition of computerized data that
26compromises the security, confidentiality, or integrity of personal
27information maintained by the agency. Good faith acquisition of
28personal information by an employee or agent of the agency for
29the purposes of the agency is not a breach of the security of the
30system, provided that the personal information is not used or
31subject to further unauthorized disclosure.

32(g) For purposes of this section, “personal information” means
33begin delete anend deletebegin insert either of the following:end insert

34begin insert(1)end insertbegin insertend insertbegin insertAnend insert individual’s first name or first initial and last name in
35combination with any one or more of the following data elements,
36when either the name or the data elements are not encrypted:

begin delete

37(1)

end delete

38begin insert(A)end insert Social security number.

begin delete

39(2)

end delete

P8    1begin insert(B)end insert Driver’s license number or Californiabegin delete Identification Cardend delete
2begin insert identification cardend insert number.

begin delete

3(3)

end delete

4begin insert(C)end insert Account number, credit or debit card number, in
5combination with any required security code, access code, or
6password that would permit access to an individual’s financial
7account.

begin delete

8(4)

end delete

9begin insert(D)end insert Medical information.

begin delete

10(5)

end delete

11begin insert(E)end insert Health insurance information.

begin insert

12(2) A user name or email address, in combination with a
13password or security question and answer that would permit access
14to an online account.

end insert

15(h) (1) For purposes of this section, “personal information”
16does not include publicly available information that is lawfully
17made available to the general public from federal, state, or local
18government records.

19(2) For purposes of this section, “medical information” means
20any information regarding an individual’s medical history, mental
21or physical condition, or medical treatment or diagnosis by a health
22care professional.

23(3) For purposes of this section, “health insurance information”
24means an individual’s health insurance policy number or subscriber
25identification number, any unique identifier used by a health insurer
26to identify the individual, or any information in an individual’s
27application and claims history, including any appeals records.

28(i) For purposes of this section, “notice” may be provided by
29one of the following methods:

30(1) Written notice.

31(2) Electronic notice, if the notice provided is consistent with
32the provisions regarding electronic records and signatures set forth
33in Section 7001 of Title 15 of the United States Code.

34(3) Substitute notice, if the agency demonstrates that the cost
35of providing notice would exceed two hundred fifty thousand
36dollars ($250,000), or that the affected class of subject persons to
37be notified exceeds 500,000, or the agency does not have sufficient
38contact information. Substitute notice shall consist of all of the
39following:

P9    1(A) begin deleteE-mail end deletebegin insertEmail end insertnotice when the agency has anbegin delete e-mailend deletebegin insert emailend insert
2 address for the subject persons.

3(B) Conspicuous posting of the notice on the agency’s Internet
4Web site page, if the agency maintains one.

5(C) Notification to major statewide media and the Office of
6Information Security within thebegin delete California Technology Agencyend delete
7begin insert Department of Technologyend insert.

8(j) Notwithstanding subdivision (i), an agency that maintains
9its own notification procedures as part of an information security
10policy for the treatment of personal information and is otherwise
11consistent with the timing requirements of this part shall be deemed
12to be in compliance with the notification requirements of this
13section if it notifies subject persons in accordance with its policies
14in the event of a breach of security of the system.

begin insert

15(k) Notwithstanding the exception specified in paragraph (4)
16of subdivision (b) of Section 1798.3, for purposes of this section,
17“agency” includes a local agency, as defined in subdivision (a)
18of Section 6252 of the Government Code.

end insert
begin insert
19

begin insertSEC. 2.end insert  

Section 1.5 of this bill incorporates amendments to
20Section 1798.29 of the Civil Code proposed by both this bill and
21Senate Bill 46. It shall only become operative if (1) both bills are
22enacted and become effective on or before January 1, 2014, (2)
23each bill amends Section 1798.29 of the Civil Code, and (3) this
24bill is enacted after Senate Bill 46, in which case Section 1 of this
25bill shall not become operative.

end insert
26

begin deleteSEC. 2.end delete
27begin insertSEC. 3.end insert  

If the Commission on State Mandates determines that
28this act contains costs mandated by the state, reimbursement to
29local agencies and school districts for those costs shall be made
30pursuant to Part 7 (commencing with Section 17500) of Division
314 of Title 2 of the Government Code.



O

    98