U.S. Data Protection Laws, With A Focus On California

In the U.S., no comprehensive national law yet exists, which generally requires notification of security breaches involving personal information.¹ California passed the first data breach notification statute in 2003² and over 30 states have since enacted similar laws. The California law, commonly referred to as "SB 1386,"³ requires owners, licensors, or custodians of personal information to notify data subjects whose information was (or is reasonably believed to have been) acquired in an unauthorized fashion. California laws also include proactive obligations related to data destruction and maintaining reasonable security measures.

Courts have not yet interpreted the California Data Protection Act⁴ (the "Act"), originally enacted in September 2000, but its legislative history reflects an intent to provide individuals with damages or injunctive relief from businesses who violate certain individual privacy rights.⁵