Big Steps Forward on California Identity Theft Laws This Year--But Challenges Remain for Protecting Financial Data

The same common-sense standard should apply to SSNs held by government offices.

That’s why I’m very pleased that over the last weekend Governor Schwarzenegger signed my bill, AB 1168, into law. Under AB 1168, the Franchise Tax Board, the Secretary of State, and all 58 county recorders would have to truncate SSNs in records they hold so that no more than the last 4 digits are displayed to the public. (To their credit, the FTB and the SOS got a head start and began truncating SSNs earlier this year.)

It’s a first step in shutting down what’s been tantamount to an ongoing, legally-sanctioned breach of consumers’ personal information.

Of course, “data breaches” come in all sizes and stripes. Sometimes, it’s medical information that falls into the wrong hands. A study last year by Phoenix Health Systems found that more than half of surveyed healthcare providers had experienced a privacy breach, and that many were out of compliance with federal privacy laws. In response, I introduced a bill this year that – among other things – would simply require businesses and state agencies that maintain medical information to notify a patient if her information is subject to a breach. AB 1298 is a simple concept: my health information is among the most sensitive information about me, and if it falls prey to a data breach, I should know about it.

I’m happy to report that Governor Schwarzenegger agreed with this piece of common sense, and signed AB 1298 into law last weekend as well.

Unfortunately, my highest profile privacy bill, AB 779, was vetoed by the Governor on October 13th. AB 779 would have required retailers and government to better protect their customers’ personal information that far too often is left open for hackers and ID thieves to pilfer as part of massive data breaches. In addition to avoiding future data breaches the bill would have better informed consumers after a breach takes place and made retailers and government partially responsible for the financial costs of data breaches. This space had previously written about AB 779 as it was moving through the Legislature.

Our unique coalition of supporters, which included law enforcement, credit unions, consumer groups and organized labor, made a compelling case for these common sense policy changes. That’s why the bill passed the State Assembly by a vote of 73-0 and passed the State Senate by a vote of 30-6.

However, the story behind the AB 779 veto is a simple one. Special business interests won over the public interest. Despite our broad coalition and overwhelming bipartisan support, numerous business interests, led by the California Retailers Association, the California Bankers Association, and the California Chamber of Commerce all urged a veto. So despite evidence showing 1) that only 40% of the nation’s largest retail chains are following current private data security rules, 2) that credit card fraud linked to data breaches is at an all-time high and 3) that the American Bankers Association and other state banking associations have either strenuously criticized retailer security or sued following major data breaches, the Governor acted as if the marketplace was working swimmingly and vetoed my bill. I’m obviously disappointed but remain unbowed, as I know that in the long run we will emerge victorious on this issue.

So there’s more work ahead, but that’s to be expected. There’s no end in sight to the growing number of ways to sell, store, and transmit consumers’ personal information – and as long as that’s the case privacy advocates must be vigilant. I would urge all those with an identity theft story of their own to contact my office at 916-319-2009 or assemblymember.jones@assembly.ca.gov and join the fight for consumer protections.

We took a couple big steps this year. Let’s continue the march forward.

Assemblymember Dave Jones (D-Sacramento) is the Chair of the Assembly Judiciary Committee. He formerly served on the Sacramento City Council. He can be reached at www.assembly.ca.gov/jones.