State government: computerized personal information security plans.

The Information Practices Act of 1977 requires an agency, as defined, to maintain in its records only that personal information, as defined, that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government. That law requires each agency to establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with this law, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to the security or integrity of the records that could result in any injury. Existing law requires an agency that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system in the most expedient time possible and without unreasonable delay, as specified. This bill would require an agency that owns or licenses computerized data that includes personal information to prepare a computerized personal information security plan that details the agency's strategy to respond to a security breach of computerized personal information and associated consequences caused by the disclosed personal information. The bill would make legislative findings and declarations in this regard.