Tanya Forsheit and M. Scott Koller of BakerHostetler have a good write-up of the new provisions in California law and how the language of AB 1710 has led to some confusion as to whether California now requires breached entities to offer free credit monitoring protection for 12 months if certain types of personal information are involved. From their commentary:
Under existing law, California Civil Code Section 1798.82 requires persons or businesses to notify affected individuals and, in some cases, the California Attorney General, in the event of a security breach involving the personal information of a California resident. A.B. 1710 also amends this section, stating that:
“If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).” (emphasis added).
In the short 48 hours since the Governor signed the legislation, a split of opinion has emerged in online commentary (from some of the largest law firms in the country) as to what this amendment requires. Some commentators have interpreted this amendment to mean that persons or businesses in California are now required to provide identity theft prevention and mitigation services in the event of a data security breach involving Social Security or driver’s license numbers if the person or organization at issue is the source of the breach.
Other commentators have taken a different position with respect to this provision of A.B. 1710 – in particular, with respect to the “if any” language noted above. Those commentators interpret this language as requiring that identity theft prevention and mitigation services, if offered, must be provided by the organization without cost to affected individuals and for a period of at least 12 months. In this interpretation, the offering of identity theft prevention and mitigation services by persons or businesses would be permissive, but not mandatory.
Read more on BakerHostetler.