California data protection law vetoed.

• Author: Swartz, Nikki
• Position: UP FRONT: News, Trends & Analysis

California Gov. Arnold Schwarzenegger recently vetoed what would have been one of the nation's most stringent retail data breach security laws, saying he believed the bill would have resulted in higher compliance costs for small businesses.

According to media sources, the proposed California law (AB 779) would have required retailers to protect data in a manner more stringent than what the current Payment Card Industry Data Security Standard requires.

According to eweek.com, the bill would have banned the retention of sensitive consumer data information except for businesses with a payment data retention and disposal policy. Even then, the bill would have allowed little data to be stored after a purchase because it also restricted the storage of "sensitive authentication data subsequent to authorization, even if that data is encrypted."

Schwarzenegger said he was open to a reworked version of the bill, saying, "I encourage the author and the industry to work together on a more balanced legislative approach." However, he said the current version of the bill "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers. In addition, the Payment Card Industry has already established minimum data security standards when storing, processing, or transmitting...