Compliance: The California Security Breach Notification Act (SB 1386)

Overview

The California Security Breach Notification Act states that any business or agency that uses a computer to store confidential personal information about a California resident must immediately notify that individual upon discovering any breach to the computer system upon which this information is stored. Failure to notify the individual(s) could subject the business/agency to civil damages and lawsuits. The statute became effective July 01, 2003. While lawsuits can be sufficiently damaging to a company's bottom line and reputation by themselves, failing to deal with the risks associated with SB 1386 could trigger violations of the Sarbanes-Oxley Act, which has serious consequences for violators.