Personal information: data breaches.

Existing law defines and regulates the use of personal information by public agencies and businesses. The Information Practices Act of 1977 requires a public agency, as defined, that owns or licenses computerized data that includes personal information to disclose any breach of the security of the system following discovery or notification of the breach, as specified. Existing law imposes the same duty on a person or business in California that owns or licenses computerized data that includes personal information and generally requires that such a business implement and maintain reasonable security procedures and practices. Existing law authorizes a person or business that is required to issue a security breach notification to include in that notification specified information. This bill would revise the definition of personal information for purposes of the provisions described above to add specified unique biometric data and tax identification numbers, passport numbers, military identification numbers, and unique identification numbers issued on a government document in addition to those for driver's licenses and California identification cards to these provisions. This bill would authorize a person or business that is required to issue a security breach notification, as described above, to include in a notification for a breach involving biometric data, instructions on how to notify other entities that used the same type of biometric data as an authenticator to no longer rely on data for authentication purposes.