California Hacker Law Takes Effect

Share this article:
A California law takes effect today in which companies that store data electronically and do business in California must warn customers in the state if they suspect that hackers have stolen personal data.


Senate Bill 1386 defines personal information as an individual's first name or initial and last name, with one of the following: Social Security number; driver's license number; state identification number; or credit or debit card account number and security code.


Except when disclosure would impede a criminal investigation, companies must notify consumers "in the most expedient time possible," with an e-mail or letter.


If a hacker gains access to data for 500,000 or more customers, the company may have to notify people through e-mail, a "conspicuous" posting on a Web site and disclosure to a major media outlet.


Meanwhile, U.S. Sen. Dianne Feinstein, D-CA, a senior member on the Judiciary Committee, introduced a bill June 26 that requires businesses or government agencies to notify individuals if a database has been broken into and personal data have been compromised, including Social Security numbers, driver's licenses and credit cards.


The bills seek to help curb the growing problem of identity theft. The Federal Trade Commission said that it received 161,819 reports of identity theft in 2002 alone, according to reports.


The federal bill, the Notification of Risk to Personal Data Act, is modeled partly on the California law. In general, notice would have to be provided to each person whose data were compromised in writing or through e-mail. But there are exceptions.


For example, companies that have developed their own reasonable notification policies get a safe harbor under the bill and are exempted from its notification requirements. In addition, when it is too expensive or impractical, such as when contact information is incomplete, to notify every individual who is harmed, the bill lets entities send out an alternative form of notice called "substitute notice," which includes posting a notice on a Web site or notifying major media.


Share this article:
close

Next Article in Data/Analytics

Sign up to our newsletters

Follow us on Twitter @dmnews

Latest Jobs:

Featured Listings

More in Data/Analytics

SAP Ramps Up Canadian Cloud Investment

SAP Ramps Up Canadian Cloud Investment

It's one of 16 new data centers the software company will open this year to meet a 39% increase in demand for cloud services.

Top 5 Spending and Investment Insights from Marketers

Top 5 Spending and Investment Insights from Marketers

Confidence in data-driven marketing led marketers to set high Q1 2014 goals.

MeritDirect Introduces Predictive Marketing Suite

MeritDirect Introduces Predictive Marketing Suite

New solutions include next logical product and customer lookalike modeling. The long-time direct marketing player announces it will open a San Jose office in September.