Personal data.

Existing law requires a person or business that owns, licenses, or maintains personal information, as defined, about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. This bill would expand the definition of "personal information" for purposes of these provisions to include an individual tax identification number, passport number, military identification, number government-issued employment identification number, an individual's geolocation information, or biometric information. The bill would also define "reasonable security procedures and practices" for purposes of these provisions as requiring security of personal information to the degree that any reasonably prudent business would provide, as specified.