Personal information: data breaches.

The Information Practices Act of 1977 requires any agency that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach, as specified. The act also requires any agency that maintains computerized data that includes personal information that the agency does not own to notify the owner or licensee of the information of any breach of the security of the data, in accordance with certain procedures. Existing law requires the security breach notification to include specified information, including, among other things, the names and addresses of the major credit reporting agencies. Existing law authorizes the security breach notification to include, at the discretion of the agency, among other things, advice on steps that people whose information has been breached may take to protect themselves. This bill would additionally require the security breach notification to include the internet websites of the major credit reporting agencies and the Uniform Resource Locator for the main internet website operated by the Federal Trade Commission to provide information for victims of identity theft. The bill would authorize the security breach notification to include how to place a credit or security freeze by visiting the internet website of the major credit reporting agencies, as specified. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.