Privacy: breach.

Existing law, the Information Practices Act of 1977, requires an agency, which includes a local agency, that owns or licenses computerized data that includes personal information, as defined, to disclose expeditiously and without unreasonable delay a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable. Existing law also requires an agency that maintains computerized data that includes personal information that the agency does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. This bill would make the above-described requirements applicable if the information is accessed by an unauthorized person. The bill would also make conforming changes. Because it would impose a requirement to provide a higher level of service with regard to data breaches on a local agency, the bill would create a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.