Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Attorneys contribute representations and warranties chapter to healthcare contracts book

Civil price-fixing case may shed light on whether plaintiffs can win where the DOJ has lost

Four decades after AT&T was broken up, is Google headed down that dark road?

AD Nauseam

AD Nauseam: A Very Special AD Nauseam – Back to School

<img decoding="async" loading="lazy" class="alignright wp-image-5866" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/09/California-iStock_000015398858_1200x630_72dpi.jpg" alt="" width="438" height="230" />In what appears to be yearly tradition, the California State Senate has again amended its Data Breach Notification Law. [Civ. Code § 1798.29.] On Sept. 11, 2019, the California State Senate voted in favor of <a href="https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill_id=201920200AB1130">AB-1130</a> Personal information: data breaches, which expands the existing definition of “personal information” under California’s Data Breach Notification Law. Assuming the governor signs AB-1130 before the Oct. 13, 2019 deadline, personal information under California’s Data Breach Notification Law will now include (1) unique biometric data, and (2) government-issued identification numbers, such as passport numbers.
Closing a Gap
AB-1130 seeks to close openings within California’s Data Breach Notification Law. The current law requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person. [Civ. Code. §§ 1798.29(a), (c); 1798.82(a), (c).] The current definition of “personal information” does not extend to passport numbers or unique biometric data, a gap that was highlighted in the wake of several high-profile data breaches.
Under AB-1130, a “government-issued identification card” is now defined to include (1) tax identification number, (2) passport number, (3) military identification number, or (4) other unique identification number issued on a government document commonly used to verify the identity of a specific individual. And “unique biometric data” is data “generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual.” Unique biometric data does not include “a physical or digital photograph, unless used or stored for facial recognition purposes.”
These definitions reflect a compromise between proponents and opponents of the bill. Opponents of the bill believed earlier definitions of “government-issued identification cards” were too broad and would include any government-issued identification card, such as a fishing license, regardless of whether that card is commonly used to identify an individual. Similarly, earlier definitions of “unique biometric data” included the phrase “or other unique physical representation or digital representation of biometric data,” which opponents argued could include such things as photographs and clothes.
Conclusion
While on the surface AB-1130 may represent yet another amendment to the California Data Breach Notification Law, a seemingly annual occurrence, the expansion of the definition of “personal information” represents a significant increase in potential liability to businesses, especially considering the private right of action under the CCPA that goes into effect on Jan. 1, 2020.

AB-1130 Expands the Definition of Personal Information for Data Breaches

Featured Insights

Related Services

Featured Insights