California Leads The Way Over Data Theft Laws

by Glen Shapiro, LawAndTax-News.com, New York

25 June 2003

California is set to introduce legislation which will require companies to inform customers if their personal information has been stolen or viewed by any unauthorised person.

Under the terms of the new law, set to come into effect on 1 July, companies, government bodies, and other organisations must notify the state's residents if any personal data which is stored by them in an unencrypted format - such as name, social security number, drivers license number, or credit card details - is viewed following a security breach.

The law has been welcomed by privacy groups, which allege that most breaches of security with regard to customer details are never revealed, leading to a higher level of identity theft, which is often detected later as a result of the secrecy.

However, the requirement that firms should inform their customers of any breach by letter or e-mail, or if more than 500,000 people are affected by posting a notice on their website, is unlikely to be welcomed by the organisations themselves.

'The last thing companies want to do is publicly disseminate information about security breaches, particularly companies that are fiduciaries of people's information, like banks and health care providers,' Mark Rasch, former head of the computer crimes unit at the Department of Justice told the US media on Tuesday.

Recommended