Constitutional & Regulatory
Cite as: Anthony D. Milewski Jr., Compliance with California Privacy Laws: Federal Law Also Provides Guidance to Businesses Nationwide, 2 Shidler J. L. Com. & Tech. 19 (Apr. 14, 2006), at <http://www.lctjournal.washington.edu/Vol2/a019Milewski.html>
© 2006 Anthony D. Milewski Jr.
Over the past several years, personal information has been lost or stolen as a result of a series of high profile security breaches. In January 2006, the U.S. Federal Trade Commission announced that ChoicePoint will be required to pay $15 million in fines and penalties for a high profile security breach that occurred in 2005. The ChoicePoint breach and similar events have spurred an explosion of state and federal privacy legislation. In particular, the State of California has taken the lead by enacting the strictest disclosure and security procedure requirements in the country. The implications of California’s new laws can be felt throughout the U.S. since they affect any business that collects personal information about California residents. This article will focus on a new California law, Assembly Bill 1950, which requires businesses to maintain “reasonable security standards” for personal information without further defining such standards. In particular, the article examines how businesses can comply with A.B. 1950 by performing a risk management analysis and borrowing security standards from the federal Gramm-Leach-Bliley and the Health Insurance Portability and Accountability Acts.
Introduction
Why is California’s Privacy Law Important to Your Business?
Overview of California’s New Privacy Laws
What is “Personal Information” Under California Privacy Law?
What does A.B. 1950 require?
Conducting a Risk Analysis Assessment
Looking to Federal Regulations for Guidance
GLBA’s Safeguards Rule
HIPAA’s Security Rule
Conclusion
Practice Pointers
<1> Since the ChoicePoint security breach in February 2005, security lapses have compromised the personal information of more than 50 million Americans.2 According to The Economist, data theft in America resulted in losses totaling nearly $50 billion in 2005.3 In January 2006, the U.S. Federal Trade Commission levied $15 million in fines and penalties against ChoicePoint as a result of a high profile security breach that compromised the personal information of 145,000 U.S. residents.4 To date, nearly 800 of the exposed individuals from ChoicePoint breaches have reported that some form of identity theft related crime has been committed against them.5 As a result of such events, states are enacting new laws to protect personal information and businesses are scrambling to comply with these laws. Every state in America is now contemplating privacy legislation in some form or another.6
<2> The State of California has taken the lead by adopting new privacy laws with the country’s most stringent requirements. A 2002 security breach of California’s state web site, which compromised access to the Social Security numbers of all state employees, served as the impetus for the new laws.7 Three laws characterize California’s approach to privacy protection: Senate Bill 1386 (S.B. 1386),8 Senate Bill 27 (S.B. 27),9 and Assembly Bill 1950 (A.B. 1950).10 This article briefly examines S.B. 1386 and S.B. 27 as precursors to A.B. 1950. The article then focuses on A.B. 1950’s “reasonable security procedures” requirement and explains how businesses can comply with that law’s ambiguous language by strategically borrowing security standards from the Gramm-Leach-Bliley Act (“GLBA”) and the Health Insurance Portability and Accountability Act (“HIPAA”).
<3> California’s privacy laws reach far beyond the state’s borders. As the tenth largest economy in the world,11 nearly all of the nation’s largest businesses work within the state and are therefore bound by its laws to some extent.12 In addition, while the three laws discussed in this article are the first of their kind in the United States, several states, including New York, are considering similar measures.13 Furthermore, the laws became even more influential following a June 2005 meeting of the National Association of Attorneys General. That group advised that, in the absence of conflicting local law, California’s security breach notice requirement applies to residents of nearly every state.14 Thus, understanding how to comply with California law may help businesses satisfy future compliance requirements elsewhere in the United States.
<4> California’s new privacy laws impose three requirements on businesses that maintain personal information about one or more California residents in an electronic database. Businesses covered by the laws must notify California residents when the security of their personal information has been compromised15 and when their information is shared with a third party.16 In addition, businesses must maintain “reasonable security procedures” to protect personal information.17
<5> Senate Bill 1386, which took effect in July 2003, aimed to reduce the risk of theft of personal information maintained by persons or businesses in computer databases.18 Senate Bill 1386 created strict requirements for notification of consumers following any breach of unencrypted personal data that includes an individual’s name and credit card number, social security number, or driver’s license number.19 In addition, if prompt notice is not given to the consumer about a breach of personal information, S.B. 1386 provides a harmed customer with a private cause of action for damages and injunctive relief against the violating institution.20
<6> Senate Bill 27, the so-called “Shine the Light Law,” took effect in January 2005.21 It requires companies with customers in California to account to those customers, upon the customers’ request, when they release personal information to third parties for marketing purposes.22 All personal information shared with third parties within the twelve months prior to the request must be released to the requesting customer.23
<7> Assembly Bill 1950, which went into effect in January 2005, imposes a general security standard on businesses that maintain certain types of personal information about California residents.24 Assembly Bill 1950 builds upon S.B. 1386 by not only requiring disclosure of security breaches that affect personal information, but also by requiring businesses to maintain “reasonable security procedures and practices.”25 Assembly Bill 1950’s reasonableness requirement is discussed later in this article.
<8> Of the three laws discussed, S.B. 27 takes the broadest approach to defining “personal information.” S.B. 27 categorizes personal information into vast categories that make almost any information “personal” if it is not public and is attributable to an individual.26 Under S.B. 27, upon a customer’s request a business will have to disclose the release of such information to third parties.
<9> By contrast, S.B. 1386 and A.B. 1950 define personal information more narrowly as an “individual’s first name or first initial combined with any one or more data elements, when either the name or the data elements are not encrypted.”27 Assembly Bill 1950 defines these additional data elements to include a Social Security number, driver’s license number, California identification card number, account number, medical information, or credit card or debit card numbers when combined with a code that would allow access to the underlying account.28 Senate Bill 1386 similarly defines additional data elements; however, S.B. 1386 omits any reference to medical records. The omission of medical records from S.B. 1386 means that if an individual’s name and medical records are released together, public disclosure may not be mandated. Furthermore, two of the three California laws have provisions which absolve a regulated entity from liability when the information released is already publicly available.29
<10> Assembly Bill 1950 takes a bold approach to protect the personal information of California residents by encouraging “businesses that own or license personal information about Californians to provide reasonable security for that information.”30 In addition, the law provides that businesses that own or license personal information about California residents must “implement and maintain reasonable security procedures” appropriate to the nature of the information.31 Assembly Bill 1950 requires a company, in addition to implementing reasonable security procedures, to also enter into contracts with its subcontractors requiring them to make the same commitment to “implement and maintain reasonable security procedures.” 32 Since A.B. 1950 does not further define these reasonableness standards, it leaves businesses struggling to understand their scope and to implement business practices sufficient to avoid liability under A.B. 1950.
<11> Companies that are typically subject to A.B. 1950 are exempt from that statute's provisions when they comply with HIPAA, the California Financial Information Privacy Act, or any federal law that provides greater protection to personal information than A.B. 1950.33 In other words, if a company that is not subject to HIPAA is wondering how it can best meet the ambiguous requirements of A.B. 1950, it can look to the HIPAA standards or standards imposed by other relevant federal laws such as the GLBA to inform its information policies.
<12> Thus, in order to avoid liability that might arise from failure to provide “reasonable security” under A.B. 1950, businesses should consider using HIPAA and the GLBA as guidelines for their own security practices and procedures. Their decision to borrow from these laws and their associated regulations should be tempered by an individualized risk management strategy, since implementing unneeded procedures may cause businesses to waste valuable resources.
<13> A business turning to HIPAA or GLBA standards for guidance on A.B. 1950 compliance should first conduct a risk analysis assessment as part of the process of borrowing standards. Such an assessment should be conducted using the following two-part risk management strategy.34 The first step is a risk reduction strategy, whereby a company identifies threats and vulnerabilities to personal information. Once it has identified such threats and vulnerabilities, the business should rank and categorize them. Developing a hierarchy of risks allows a business to establish security procedures emphasizing the most pressing risks.35 For example, in the banking industry, risks are typically categorized as legal, operational, reputational, and strategic.36 Businesses should define categories relevant to the privacy goals of their specific industries.
<14> Next, the business must decide to handle identified risks in-house or subcontract a portion of them to third parties. 37 Transferring risk to another party should be considered by businesses that are unable to provide adequate security for personal information, if they can provide adequate security and also save money by outsourcing. Any decision to outsource, however, creates an ongoing duty to assess the performance of the party providing the security assurances. A business that has categorized its risks and assessed its data protection strengths and weaknesses, and decided not to outsource any of its identified risks, might find it helpful to borrow standards from GLBA or HIPAA in developing its internal security plan.
<15> Businesses may look to both GLBA and HIPAA when creating policies and procedures that comply with A.B. 1950. Both regulations seek secure maintenance of consumer information and prevention of unauthorized use of the information inside or outside of businesses.38 The primary differences in the regulations are industry-specific and do not reflect different approaches to protecting private information. For instance, GLBA explicitly requires that companies oversee that “service providers”39 are protecting private information, while HIPAA more specifically requires “workforce”40 compliance. The language in these two requirements is quite different; however, the general objective remains the same: businesses are responsible for protecting private information they collect and are provided with some flexibility in achieving this protection.
<16> GLBA’s Safeguards Rule uses a “reasonable security” standard.41 The Safeguards Rule sets forth standards for developing, implementing, and maintaining reasonable security safeguards to protect private consumer information.42 Businesses trying to comply with A.B. 1950 might find it helpful to look to the Safeguards Rule when they create their security polices and procedures.43
<17> The Safeguards Rule requires that businesses develop an information security program that is comprehensive, obtainable in written form, and appropriate to the size, complexity, and the nature of its activities.44 The security program should be designed to achieve three objectives. It should: (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; and (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to the customer.45 In order to achieve these aims, a company’s security program should contain provisions for employee training, identifying reasonably foreseeable risks, developing appropriate information systems, and preventing information systems failures.46
<18> A business trying to comply with A.B. 1950 should create an information security plan tailored to the business’ size and complexity, keeping in mind the three Safeguard Rule objectives. In particular, when borrowing from the Safeguards Rule, a business should be aware of § 314.4. This section defines the elements that a security program should contain in order to meet the three aforementioned objectives. Section 314.4 requires that the security program shall: (1) designate an employee to coordinate the program; (2) identify reasonably foreseeable internal and external risks that might result in an unauthorized disclosure; (3) design and implement information safeguards to control the risks identified in the risk assessment; and (4) oversee service providers to ensure that they are taking appropriate steps to protect private consumer information.47 These broad requirements allow businesses some flexibility in the implementation. Since complete compliance with GLBA would cause many companies to overspend on information security, businesses should attempt to achieve the Safeguards Rule’s objectives by employing only the elements of the Rule that are appropriate and necessary to their business models.
<19> Though the HIPAA Security Rule is far more exhaustive than most businesses need in order to comply with A.B. 1950, it is a useful source from which businesses can borrow standards for three reasons. First, any company complying with HIPAA regulations is exempt from A.B. 1950 because its standards are more exhaustive than A.B. 1950 requires.48 Second, businesses may rely on HIPAA’s Security Rule because it is based on risk management principles that allow businesses to create policies that will meet A.B. 1950’s requirements.49 Finally, the HIPAA Security Rule contains a “flexibility of approach” whereby covered entities can use “any security measures” that allow the covered entity to reasonably implement the required safeguards.50
<20> HIPAA’s Security Rule is divided into administrative, physical, and technical measures.51 Administrative measures must contain: (1) fully documented policies and procedures that are used to handle protected health information; (2) security awareness training;52 and (3) a contingency plan, including policies and procedures, to address emergency situations such as fire, vandalism, or system failure.53 Next, the required physical measures must consist of three elements: (1) physical access controls;54 (2) policies about workstation use and security;55 and (3) device media controls.56 Finally, technical measures must: (1) encrypt data;57 (2) guard data integrity though automatic logoffs and other procedures;58 and (3) generally protect the confidentiality of the data.59
<21> In addition to the specific requirements outlined by HIPAA’s Security Rule, the Rule also contains general principles that businesses must comply with. In order to comply with HIPAA’s Security Rule a covered entity must: (1) ensure confidentiality of information; (2) protect against reasonable anticipated threats or hazards; (3) protect information from misuse within the scope of its reasonably anticipated use; and (4) ensure compliance by its workforce.60 To achieve compliance, the Security Rule requires businesses to conduct both a risk analysis and risk management assessment.61 The Security Rule requires the risk analysis to include an assessment of the potential risks and vulnerabilities to confidential information.62 Risk management, as defined by the Security Rule, is the implementation of security measures sufficient to reduce risks and vulnerabilities to a reasonable level.63
<22> Applying the risk management principles contained in HIPAA allows companies to employ its “flexibility of approach” and choose from the various types of administrative, physical, and technical safeguards that are required under HIPAA. A.B. 1950’s “reasonable security procedures” requirement may best be met by companies when they borrow risk management principles from HIPAA.
<23> Due to the ambiguous “reasonable security” standard in A.B. 1950, there are no guarantees that businesses complying with GLBA and HIPAA will be immune from liability under A.B. 1950. However, borrowing practices from industries exempted from the law is a common sense approach that should provide businesses with a reasonable degree of protection from liability. Although A.B. 1950 does not explicitly inform businesses how they should employ proper security standards, it does allow businesses to use existing federal standards in order to define security practices and procedures for their unique situations.
GLBA’s Safeguards Rule
HIPAA’s Security Rule