What must a company do if my personal data is breached?

What the Law Says

California law imposes strict requirements on businesses that experience a breach of personal information. The key statute is the California Data Breach Notification Law, which defines what constitutes a breach, who must be notified, and when.

A 'breach of security' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business.

Personal information includes your first name or initial and last name combined with one or more of the following: Social Security number, driver’s license number, account number with access code, medical information, health insurance information, or unique biometric data.

If a breach occurs, the business must notify affected California residents 'in the most expedient time possible and without unreasonable delay,' but no later than 45 calendar days after discovering the breach — unless law enforcement determines notification will impede a criminal investigation.

The notice must include the name and contact information of the reporting business, a list of the types of personal information disclosed, the date or date range of the breach (if known), and contact information for major credit reporting agencies. If Social Security number or driver’s license number was compromised, the business must also offer 12 months of free identity theft prevention and mitigation services.

Statutory Text

Any person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data…

— Civil Code § 1798.82(a) — Notice of security breach

Statutory Text

The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement… and no later than 45 days after the discovery of a breach.

— Civil Code § 1798.82(g) — Notice of security breach

Statutory Text

If the person or business providing notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided to the person whose personal information was subject to the breach… for not less than 12 months.

— Civil Code § 1798.82(i)(2) — Notice of security breach

What to Do

Sources