Who’s Hacked You Now? Changes To California’s Security Breach Statute

It seems as though a week does not go by without a company reporting that its customers' personal information was either intentionally hacked or inadvertently exposed. In April 2011, Sony reported that hackers had stolen the names, birth dates, and possibly credit‐card numbers of more than a 100 million users of its online videogames. In May 2011, Citigroup discovered that almost 400,000 credit‐card accounts were hacked, resulting in $2.7 million in losses. One of the many questions that arises after discovering such a breach is how to notify the affected customers.

In 2003, California became the first state to enact a data security breach notification law. California Civil Code Section 1798.82 requires those who own or license computerized data that includes personal information, to disclose breaches of security to any state resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.¹