Personal information: privacy.

Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines "personal information" for these purposes, to include an individual's first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, driver's license numbers, financial accounts, and medical information. This bill would revise certain data elements included within the definition of personal information, by adding certain information that would permit access to an online account. This bill would impose additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account. This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by AB 1149 that would become operative if this bill and AB 1149 are enacted and this bill is enacted last.