California Senate Moves On New Data Breach Law

With 2003's landmark data breach notification law, SB-1386, California set the tone for the wave of state breach notification laws that would follow. Today, more states have similar laws than don't. Last week, the California Senate approved SB-1166 which aims to add more detail to the existing law.SB-1186, if signed in law, would require breach notification letters to shed more light on the nature of the breach affecting consumers. For instance, SB-1166 would require the letter include the type of information exposed, a description of the breach, and steps potential victims can take to mitigate risks.

Democratic California State Senator Joe Simitian, who authored SB-1186 and the original SB-1366, issued a statement detailing how the bill, should it become law, would strengthen California's existing law:

"Establish standard, core content for data breach notification - such as the type of information breached, the time of breach and a toll-free telephone number of major credit reporting agencies for security breach notices in California; and,

Require public agencies, businesses and people subject to California's security breach notification law to send an electronic copy of the breach notification to the Attorney General if more than 500 Californians are affected by a single breach.

"

In addition to SB 1386, California tends to lead the nation when it comes to cyberlaws. For instance, last fall the state passed new medical privacy laws. Those two state medical privacy laws, AB211 and SB541, make it possible for institutions and individuals to be fined up to $250,000 for being lax when it comes to the medical privacy of California residents. See my post: New Calif. State Legislation Threatens Stiff Medical Privacy Penalties.

Not all cyberlaws passed by California have had much impact, such as the anti-spyware legislation that went into effect Jan 1, 2005, certainly didn't seem to have dented the use of that scourge.

There's no guarantee that SB-1186 will become law. Last fall Gov. Schwarzenegger vetoed a similar bill, that that version, to me, was too prescriptive in mandating what security controls need to be in place. We covered the death of that bill, here.

For my security and technology observations throughout the day, follow me on Twitter.