Governor Jerry Brown signed SB 46 into law today.
Dominique R. Shelton and Paul G. Martinoof of Alston & Bird had a good summary of the changes the law makes:
S.B. 46 amends Section 1798.82(h) to expand the definition of “personal information” for which breach notification is required. The new law adds to the definition: “A user name or email address, in combination with a password or security question and answer that would permit access to an online account.” [Emphasis added]
Notification for breaches of personal information involving user names and email accounts may or shall, depending on the circumstance, occur differently than with breaches involving other types of personal data. The lawyers summarize it this way:
- Notification for Breaches of Online Account Data that Does Not Involve Login Credentials for an Email Account: In the case of breaches involving Online Account Data and “no other personal information,” businesses may comply with the notification obligations of the statute “by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.” [Emphasis added]
- Notification for Breaches of Online Account Data Involving Login Credentials for an Email Account: In the case of breaches involving Online Account Data that contains “login credentials of an email account furnished by the person or business,” the entity that furnished the login credentials, if breached, “shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in [the statute for breaches of other personal information] or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.” [Emphasis added]
Read more of Alston & Bird’s advisory. The amendments go into effect in January, 2014.