Civil law: privacy.

Existing law requires a person or business conducting business in California, or any state or local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires the disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. This bill would define "encrypted" for purpose of these provisions to mean rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information technology. This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last. This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 34 and SB 570 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.