Cybersecurity: critical infrastructure business: breach notification.

(1) The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the Chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information to disclose expeditiously and without unreasonable delay a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person if the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. This bill would require, on or after January 1, 2019, a critical infrastructure business that experiences a breach of security of critical infrastructure information or critical infrastructure controls and is required by federal law to disclose that breach to also disclose that breach to the Office of Emergency Services, as specified. The bill would deem a critical infrastructure business to be in compliance with this requirement with respect to a breach if it complies with specified requirements related to disclosing that breach to the multistate information sharing and analysis center. The bill would require a critical infrastructure business to disclose breaches in a form and manner provided by the office, and without unreasonable delay, except as provided. The bill would otherwise prohibit public disclosure of the information and reports required by its provisions. (2) Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.