On July 1, 2003, a far-reaching California data security law went into effect. The new law applies to any company that stores personally identifiable information of California customers or employees, regardless of whether the company is located in California. The law mandates disclosure to California residents whose information may have been compromised if a company’s security is breached. Companies without a pre-determined action plan and notification policy can incur significant costs in complying or face lawsuits for noncompliance. The law is triggered when an unauthorized person — internal or external — acquires personal information stored in the company’s systems, or even if the company merely believes an unauthorized person may have accessed such information. "Personal information" is very broadly defined, including a first name or initial and last name in combination with a social security number, a driver’s license number, account number or other similar information. Encrypted
