California Governor Delivers Surprise Data Breach Law Veto

Written by Evan Schuman
October 20th, 2009

California Governor Arnold Schwarzenegger is a man of surprises, be it as a bodybuilder turned successful movie star or as a staunch Republican winning election as the governor of reliably Democratic California. This month, though, he delivered his latest surprise in the form of a veto of a key data breach bill, a bill that had already had its critics withdraw all of their opposition.

Schwarzenegger’s veto (which allegedly prompted the bill to look at the governor and bellow, “I’ll be back”) is not the first time he’s tackled data breach legislation; he has already forced earlier versions to be diluted.

The new bill, SB-20, would have required retailers to provide more details about a breach, including the type of personal information exposed, a description of the incident and exactly when it took place. It also required merchants to submit a copy of the notification letter to the California Attorney General’s office if more than 500 California residents are affected in a single incident.

The strange part of the veto is that all of the official opposition to the bill—from the California Chamber of Commerce, the California Bankers Association, the Association of California Insurance Companies and State Farm Insurance (and about eight others)—was withdrawn on August 26 because the groups got together and said they “were satisfied with the amended bill, which eliminated a single provision that would have required breached firms to provide victims with an estimated number of total people affected by the incident,” according to a story in SC Magazine.

The California law is critical, because so many other states tend to model this kind of legislation on what the nation’s most populous states do.

Schwarzenegger’s October 11 veto message said that the existing legislation is good, and that this bill doesn’t actually improve it.

“California’s landmark law on data breach notification has had many beneficial results. Informing individuals whose personal information was compromised in a breach of what their risks are and what they can do to protect themselves is an important consumer protection benefit,” his veto message said. “This bill is unnecessary, however, because there is no evidence that there is a problem with the information provided to consumers. Moreover, there is no additional consumer benefit gained by requiring the Attorney General to become a repository of breach notices when this measure does not require the Attorney General to do anything with the notices. Since this measure would place additional unnecessary mandates on businesses without a corresponding consumer benefit, I am unable to sign this bill.”

The notification terminator makes a fair point, albeit a very limited one. “There is no evidence that there is a problem with the information provided to consumers.” True, but what evidence could possibly exist? How can you prove a negative? The better question to ask would be: “Is it likely that forcing retailers to provide this information would directly—or even indirectly—make consumers safer?”

As a practical matter, there is likely no direct benefit to consumers knowing this information, insofar as it’s not likely to make it easier for them to fix whatever damages they sustain in terms of time spent.

But will it have a significant indirect benefit? There’s a good case for why it would be beneficial. Will this requirement make it more unpleasant for retailers that suffer breaches? Will it make it easier for consumers and shareholders to file successful lawsuits against those retailers? Will the forced revealing of these details make such incidents more embarrassing for retailers? The answer is “yes” to all three questions.

You then need to ask the ultimate question: Will it make it sufficiently less pleasant that retailers will be inclined to invest more time, money and other resources to boost security and, therefore, make such breaches less likely? That’s the real question here; and the one the governor sidestepped. Honestly, I’m not sure of the answer. The cost to truly improving is so high that these relatively minor additional hardships won’t likely make a difference. But under the rationale of “if it even makes such breaches one-half of one percent less likely, it’s worth it,” I think it might be worth making into law.

As for the notification letter, that’s a definite deterrent, because it places all such incidents in one central public place. In short, anything that makes it easier to find out about these breaches will make such breaches less likely. How much less likely? Ahhhh, there’s the California story.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.