Personal information: privacy.

Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. This bill would require any agency, person, or business that is required to issue a security breach notification pursuant to existing law to fulfill certain additional requirements pertaining to the security breach notification, as specified. The bill would also require any agency, person, or business that is required to issue a security breach notification to more than 500 California residents pursuant to existing law to electronically submit a single sample copy of that security breach notification to the Attorney General, as specified. This bill would provide that a covered entity under the federal Health Insurance Portability and Accountability Act of 1996 is deemed to have complied with these provisions, if it has complied with existing federal law, as specified. The bill would also incorporate additional changes made by the Governor's Reorganization Plan No. 1 of 2009.