Report security breaches: new rules aid privacy efforts, but challenge businesses.

• Author: Savin, Jerald M.
• Position: 2003 Technology & Business Resource Guide: Privacy Protection

Effective July 1, entities or persons doing business in California will be required to notify California residents if their personal information--contained in databases under their control--may have been acquired by unauthorized people through a security breach.

Signed into law last year, this legislation--Senate Bill 1386--is a leap forward in terms of privacy and identity theft protection. In terms of computer systems, however, this is a nightmare.

In April 2002, the state of California waited more than two weeks before notifying employees that hackers broke into the state's payroll system and compromised its payroll information. While SB 1386 grew out of this incident, it is not unique. The European Union formulated privacy guidelines in 1995, which were subsequently adopted in various forms by numerous European countries, Australia, New Zealand and Canada.

In the United States, the Health Insurance Portability and Accountability Act (HIPAA,) and the Children Online Privacy Protection Act (COPPA) impose special privacy rules in their respective areas. Among the states and federal government, however, California's legislation is the most far-reaching, although no less severe than HIPAA or COPPA.

WHO'S AFFECTED?

This law applies to any person or business doing business in California, including state agencies. It requires the notification of California residents. It does not require notification of non-California residents.

But, from a practical standpoint, who would want to notify only Californians and then be subject to criticism for failing to notify non-Californians?

This law also applies to service bureaus that maintain computerized personal information data for others.

The statute specifically identifies the following as personal information: First name or first initial and last name in combination with Social Security number, driver's license number or California identification card number.

Also considered personal information is an account number or credit or debit card number in combination with any required security code, access code or password.

CHALLENGES TO BUSINESSES

For businesses, there are at least three challenges associated with this legislation:

1. Protecting personal information from unauthorized distribution;

2. Protecting systems from security breaches; and

3. Informing the public that their personal information may have been acquired by unauthorized parties.

The statute defines a security system breach as "...