Has anyone analyzed AB 1386 (Computer Security Law) which is effective 7/1/03?

I did not read this as a "Computer Security Law" however, a contractual law. Here is what I found:

AB 1386 Shirley Horton Contractors.

Effective July 1, 2003, California has a new law that requires anyone conducting business in California that owns or licenses computerized data that includes personal information, as defined below, must disclose any breach of security of the system to any resident of California if it is reasonably believed that his or her unencrypted personal information was acquired by an unauthorized person.

In addition, anyone that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach if it is reasonably believed that unencrypted personal information was acquired by an unauthorized person.

The law sets out the specific types of notice deemed appropriate. Notice must be made in the most expedient time possible and without unreasonable delay. The notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required must be made after the law enforcement agency determines that it will not compromise the investigation.

For the purposes of this law, “Personal Information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements when either the name or the data elements are not encrypted:
a) social security number;
b) driver’s license number or California identification card number;
c) account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to that individual’s financial account.
For purposes of this law, “Personal Information” does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.

The California Bankers' Association is seriously considering have a workshop on this law tentatively scheduled for September. The tentative agenda is:

Definitions Required for Disclosure:
- Best Practices currently being implemented
- Regulatory Considerations
- Risk Issues for Failure to Disclose
- A Consensus on Guidelines for Implementation

Speakers:

- A Regulator or Regulatory Panel
- Technology Consultant
- Best Practices Panel of three Bankers (by asset size): $10 billion and over; $500 million to $10 billion; and under $300 million

If you are a CBA member, the notice should be going out in early August.

Does anyone know where I can obtain a copy of this law? I went to the California website and could not pull one up as AB 1386. Thanks.

Go to the legislature:

http://www.leginfo.ca.gov/bilinfo.html

Check Assembly and enter 1386. You want the "chaptered" version.

I don't mean to be a pain in the rear, but, when I pull up AB 1386, I get a bill about licensing, not computer security. Is this the correct number of the bill? Thanks.

I think I see the problem(s). The number sounded fine, so I didn't question gbalonek's posting.

Problem 1- It is SB 1386, not AB 1386. A Senate Bill.

Problem 2- It is from last year's session, not this year.

Sorry, please try again.

Thanks, Al.

U da man!!!

Thanks Al. That was the problem.

Has anyone designed a notice that they would be willing to share?

Check this site specifically page 19
Cal. Department of Consumer Affairs Privacy Office

I'll check it out!