SACRAMENTO—From central stations to churches, businesses and organizations across the country that electronically store personal information on customers who live in California will have to disclose to them any unauthorized access of that information. The requirement is the result of a new state law intended to protect residents against identity theft.
California Senate Bill 1386 took effect July 1 and applies to any organization—businesses, nonprofits, government entities—regardless of where they are headquartered.
Personal data is specifically defined in the legislation, but it generally refers to the combination of a person’s name with another identifying item, such as a Social Security number, driver’s license number, credit card number or bank account.
If an organization is sued for violating the law, it would have to prove that no unauthorized access had occurred.
Under the law, unauthorized access can mean outside hackers breaking into company systems to company employees who access customer databases without authorization.
Legislation similar to SB 1386 has already been proposed in the U.S. Congress.
