California Disclosure Law Has National Reach
from the what-goes-in-California-goes-everywhere dept
Here's an interesting discussion concerning the new California anti-identity theft legislation that requires companies to admit when there was a security breach. It seems that this California law will impact any business with customers in California - meaning, just about any online business. This could bring up some more internet jurisdiction questions (as if we need some more). The article also points out what they call the "ROT13 loophole", which basically says that you don't have disclose a security breach if "encryption" is used - but gives no indication how strong the encryption needs to be. It would be fun to see companies implementing incredibly weak (useless) encryption for their databases, not to satisfy any justifiable business need, but to protect them from having to disclose any security breaches.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
