Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/22/2019
11:20 AM
50%
50%

New Legislation Builds on California Data Breach Law

This bill requires businesses to notify consumers of compromised passport numbers and biometric data.

California Attorney General Xavier Becerra and Assemblymember Marc Levine this week unveiled legislation to close a loophole in the state's existing data breach notification laws.

AB 1130, introduced by Levine, requires breached organizations to notify consumers if their passport number or biometric data is exposed. Becerra said this bill "closes a gap in California law and ensures that our state remains the nation's leader in data privacy and protection."

California became the first state to pass a data breach notification law in 2003, when it mandated companies inform consumers when they believe an unauthorized party has accessed their information. At the time, this personal data was limited to Social Security numbers, driver's license numbers, credit card numbers, and medical and health insurance data.

Legislation introduced this week will update the law to include passport numbers and biometric data, such as a fingerprint or retina/iris scan, as information protected under the statute.

The addition was prompted by the 2018 breach of Starwood Hotels' guest database. Marriott, which had acquired the company, revealed the incident had exposed more than 327 million records containing travelers' names, addresses, and more than 25 million passport numbers. California officials note how passport numbers are unique, government-issued, static identifiers, making them especially appealing to cybercriminals. Indeed, passport scans are hot on the Dark Web.

Read more details here.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/28/2019 | 9:19:24 PM
Re: RIGHT - Pass a law, that will fix it
100% agree with your post. Also, enjoyed the disclaimer. :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/27/2019 | 2:08:53 PM
Re: RIGHT - Pass a law, that will fix it
This law was passed late last year. It does not go into effect until 2020 (absent an amendment delaying its effective date).

Companies have time -- big or small.

That said, someone earnestly trying their best is going to fare better than someone who just screwed up big time and doesn't seem to care.

 

(Disclaimer: This comment/post is provided for informational, educational and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:12:15 AM
Re: RIGHT - Pass a law, that will fix it
@Joe, definitely understandable. The upstarts are just starting to gain footing, if they are lucky enough. Not sure if there already is but for scenarios like an upstart would you think it wise to delay enforcement of those regulations as long as their is a valid corporate roadmap towards implementing them?

Or would you see it as, regardless of corporate titan or company upstart a company is a company and they all have to follow the same rules?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:07:44 AM
Re: Systemic Change
Apologies, I should have specified. When I stated encrypt your data it should be scoped encryption. It is folly to try to encrypt all data. Specifcally you should encrypt sensitive data. But to ensure that you scope is accurate it needs to be segmented. 

I 100% concur that encrypting all data is implausible.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:37:23 PM
Re: RIGHT - Pass a law, that will fix it
@Ryan: Moreover, as my home-state governor Charlie Baker put it when keynoting ThingWorx a few years back, big mega-corporations secretly love regulations (to some extent) because they're the only ones that can afford to keep up with them -- while scrappy upstarts are driven out of business.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:35:16 PM
Re: Systemic Change
It remains to be seen, though, if federal data-breach notification laws will come into play -- and preempt preexisting state laws on that front.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 11:01:34 AM
Re: Systemic Change
A law that wholesale forbids any but the strictest security practices could undermine the Business Judgement Rule. That makes sense. That is why having the balance becomes more important. There business that may them secure and provide services, I say Google is one of them as long as you do not consider privacy a major issue.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:58:40 AM
Re: Systemic Change
Moreover, as much as I like security, it can't be forgotten that security and accessibility are at constant odds with each other It actually makes sense when you consider CIA. Keeping the balance between confidentiality, integrity and availability what makes security.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:56:38 AM
Re: Biometrics
I'd anticipate that biometric-data clause getting fought tooth and naiL Yes, it makes sense. As we are using it more and more (such as FaceID) there will be more regulations around it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:54:33 AM
Re: Systemic Change
"Oh, we are sorry we lost your data but we did tell you quicker then we use to" Yes, I hear you. That would be just not convincing and not helpful at all.
Page 1 / 2   >   >>
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5798
PUBLISHED: 2019-05-23
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2019-5799
PUBLISHED: 2019-05-23
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5800
PUBLISHED: 2019-05-23
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5801
PUBLISHED: 2019-05-23
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-5802
PUBLISHED: 2019-05-23
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.