3 ms·
That's a requirement in general for CA. https://www.oag.ca.gov/privacy/databreach/reporting https://www.oag.ca.gov/privacy/databreach/reporting If there is a
by dv_dt 8y ago
That's a requirement in general for CA.
https://www.oag.ca.gov/privacy/databreach/reporting https://www.oag.ca.gov/privacy/databreach/reporting
If there is a reasonable belief that data was exposed, all of the exposed CA residents need to be notified, and if > 500, the Atty General of CA needs to additionally be notified.
- russell_h 8y agoIs there a required timeframe for doing so?
- tptacek 8y agoAgain, that's breaches, not vulnerabilities. Literally every company has vulnerabilities.
- dv_dt 8y agoAgreed! Apologies, as I think my use of the term "exposed" left that ambiguous. I should have used the original term "acquired". The first line from the link says the following: > California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. With links to more specifics in the CA Civil code.