Bill Would Boost Breach Disclosure Rules

A co-author of the landmark six-year-old California data-breach notification law said that a new bill he filed late last year would standardize the process of notifying consumers and government agencies of data breaches that expose personal information.

Speaking at a symposium on breach notification issues held earlier this month at the University of California, Berkeley, State Sen. Joe Simitian said that his latest bill, known as SB 20, would give “greater clarity and specificity as to the content of security breach notices, which I think is long past due.”

Simitian said he hopes that California Gov. Arnold Schwarzenegger will sign the new bill into law by year’s end.

While letters sent by some companies and government agencies do a good job of telling affected users exactly what happened to their data, a “substantial number” do not, often leaving consumers “more confused than informed,” he said.

SB 20 also requires that the state attorney general’s office or another agency keep track of breaches, which Simitian said would give public officials “a better understanding of the nature and scope of the problem.”

Fred Cate, a law professor at Indiana University’s Maurer School of Law in Bloomington, told symposium attendees that government agencies may underestimate breaches because they lack information. “We actually have very poor data on data breaches,” Cate said, noting that current laws mostly require consumers, not governments, to be notified that personal data was accessed.

The initial California law, which took effect in 2003, requires that consumers be notified when unencrypted financial data is lost or stolen from computer systems. The law is credited with inspiring similar legislation in 43 other states.