California Hacker Law Takes Effect

Share this article:
A California law takes effect today in which companies that store data electronically and do business in California must warn customers in the state if they suspect that hackers have stolen personal data.


Senate Bill 1386 defines personal information as an individual's first name or initial and last name, with one of the following: Social Security number; driver's license number; state identification number; or credit or debit card account number and security code.


Except when disclosure would impede a criminal investigation, companies must notify consumers "in the most expedient time possible," with an e-mail or letter.


If a hacker gains access to data for 500,000 or more customers, the company may have to notify people through e-mail, a "conspicuous" posting on a Web site and disclosure to a major media outlet.


Meanwhile, U.S. Sen. Dianne Feinstein, D-CA, a senior member on the Judiciary Committee, introduced a bill June 26 that requires businesses or government agencies to notify individuals if a database has been broken into and personal data have been compromised, including Social Security numbers, driver's licenses and credit cards.


The bills seek to help curb the growing problem of identity theft. The Federal Trade Commission said that it received 161,819 reports of identity theft in 2002 alone, according to reports.


The federal bill, the Notification of Risk to Personal Data Act, is modeled partly on the California law. In general, notice would have to be provided to each person whose data were compromised in writing or through e-mail. But there are exceptions.


For example, companies that have developed their own reasonable notification policies get a safe harbor under the bill and are exempted from its notification requirements. In addition, when it is too expensive or impractical, such as when contact information is incomplete, to notify every individual who is harmed, the bill lets entities send out an alternative form of notice called "substitute notice," which includes posting a notice on a Web site or notifying major media.


Share this article:
You must be a registered member of Direct Marketing News to post a comment.
close

Next Article in Data/Analytics

Sign up to our newsletters

Follow us on Twitter @dmnews

Latest Jobs:

Featured Listings

More in Data/Analytics

One Third of Companies Fail to Measure Data Quality ROI

One Third of Companies Fail to Measure Data ...

Twenty percent of companies assume their data quality tools pay off, while another 10% doesn't monitor ROI at all.

Ensighten and Anametrix Unite in an Open Relationship

Ensighten and Anametrix Unite in an Open Relationship

Ensighten's purchase of the analytics company is about giving ultimate ownership of data to marketers, says CEO Josh Manion.

The Perils (and Positives) of Vanity Metrics

The Perils (and Positives) of Vanity Metrics

Experts break down the up- and downsides of popular vanity metrics, such as Facebook likes and Twitter followers.