California Adds More Teeth To Its Data Breach Notification Law

On September 30, 2014, California's Governor Brown signed A.B. 1710, a bill establishing new requirements under California's data breach notification statute. The new law adds three provisions to the existing statute, California Civil Code section 1798.81.5: (i) it prohibits the sale, advertisement for sale, or offer to sell an individual's Social Security number, other than as permitted by law; (ii) it extends the requirement to maintain reasonable security practices and procedures to businesses that maintain the personal information of California residents (i.e., data processors and service providers), not only those that own or license such information; and (iii) in the event that the party providing breach notification was the source of the breach, it contains requirements regarding offers to provide identity theft prevention and mitigation services to the person affected by the breach.