Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/22/2019
11:20 AM
50%
50%

New Legislation Builds on California Data Breach Law

This bill requires businesses to notify consumers of compromised passport numbers and biometric data.

California Attorney General Xavier Becerra and Assemblymember Marc Levine this week unveiled legislation to close a loophole in the state's existing data breach notification laws.

AB 1130, introduced by Levine, requires breached organizations to notify consumers if their passport number or biometric data is exposed. Becerra said this bill "closes a gap in California law and ensures that our state remains the nation's leader in data privacy and protection."

California became the first state to pass a data breach notification law in 2003, when it mandated companies inform consumers when they believe an unauthorized party has accessed their information. At the time, this personal data was limited to Social Security numbers, driver's license numbers, credit card numbers, and medical and health insurance data.

Legislation introduced this week will update the law to include passport numbers and biometric data, such as a fingerprint or retina/iris scan, as information protected under the statute.

The addition was prompted by the 2018 breach of Starwood Hotels' guest database. Marriott, which had acquired the company, revealed the incident had exposed more than 327 million records containing travelers' names, addresses, and more than 25 million passport numbers. California officials note how passport numbers are unique, government-issued, static identifiers, making them especially appealing to cybercriminals. Indeed, passport scans are hot on the Dark Web.

Read more details here.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/28/2019 | 9:19:24 PM
Re: RIGHT - Pass a law, that will fix it
100% agree with your post. Also, enjoyed the disclaimer. :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/27/2019 | 2:08:53 PM
Re: RIGHT - Pass a law, that will fix it
This law was passed late last year. It does not go into effect until 2020 (absent an amendment delaying its effective date).

Companies have time -- big or small.

That said, someone earnestly trying their best is going to fare better than someone who just screwed up big time and doesn't seem to care.

 

(Disclaimer: This comment/post is provided for informational, educational and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:12:15 AM
Re: RIGHT - Pass a law, that will fix it
@Joe, definitely understandable. The upstarts are just starting to gain footing, if they are lucky enough. Not sure if there already is but for scenarios like an upstart would you think it wise to delay enforcement of those regulations as long as their is a valid corporate roadmap towards implementing them?

Or would you see it as, regardless of corporate titan or company upstart a company is a company and they all have to follow the same rules?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:07:44 AM
Re: Systemic Change
Apologies, I should have specified. When I stated encrypt your data it should be scoped encryption. It is folly to try to encrypt all data. Specifcally you should encrypt sensitive data. But to ensure that you scope is accurate it needs to be segmented. 

I 100% concur that encrypting all data is implausible.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:37:23 PM
Re: RIGHT - Pass a law, that will fix it
@Ryan: Moreover, as my home-state governor Charlie Baker put it when keynoting ThingWorx a few years back, big mega-corporations secretly love regulations (to some extent) because they're the only ones that can afford to keep up with them -- while scrappy upstarts are driven out of business.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:35:16 PM
Re: Systemic Change
It remains to be seen, though, if federal data-breach notification laws will come into play -- and preempt preexisting state laws on that front.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 11:01:34 AM
Re: Systemic Change
A law that wholesale forbids any but the strictest security practices could undermine the Business Judgement Rule. That makes sense. That is why having the balance becomes more important. There business that may them secure and provide services, I say Google is one of them as long as you do not consider privacy a major issue.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:58:40 AM
Re: Systemic Change
Moreover, as much as I like security, it can't be forgotten that security and accessibility are at constant odds with each other It actually makes sense when you consider CIA. Keeping the balance between confidentiality, integrity and availability what makes security.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:56:38 AM
Re: Biometrics
I'd anticipate that biometric-data clause getting fought tooth and naiL Yes, it makes sense. As we are using it more and more (such as FaceID) there will be more regulations around it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:54:33 AM
Re: Systemic Change
"Oh, we are sorry we lost your data but we did tell you quicker then we use to" Yes, I hear you. That would be just not convincing and not helpful at all.
Page 1 / 2   >   >>
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-1074
PUBLISHED: 2021-04-21
NVIDIA Windows GPU Display Driver for Windows, R390 driver branch, contains a vulnerability in its installer where an attacker with local system access may replace an application resource with malicious files. Such an attack may lead to code execution, escalation of privileges, denial of service, or...
CVE-2021-1075
PUBLISHED: 2021-04-21
NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the program dereferences a pointer that contains a location for memory that is no longer valid, which may lead to code execution, denial of se...
CVE-2021-1076
PUBLISHED: 2021-04-21
NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information disclosure, or data corruption.
CVE-2021-1077
PUBLISHED: 2021-04-21
NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference count to manage a resource that is incorrectly updated, which may lead to denial of service.
CVE-2021-1078
PUBLISHED: 2021-04-21
NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.