Exam CIPP-US topic 1 question 128 discussion

California AB2828: organizations are required to trigger breach notification for disclosures of encrypted data is they have reason to believe encryption keys may have been compromised along w the data.

The CCPA provides consumers with special remedies for data breaches, including statutory damages of between $100 and $750 per incident, actual damages, or other remedies the court deems appropriate. To be entitled to these remedies, the breach must consist of (1) “an unauthorized access and exfiltration, theft, or disclosure” of the consumer’s personal information resulting from (2) the business’s failure to “implement and maintain reasonable security procedures and practices.” “CREDIT CARD INFORMATION and the ENCRYPTION KEYS were among the information taken”. – its breach. although the at rest is encrypted… These remedies “do not apply” to personal information that has been “ ENCRYPTED OR REDACTED.” These remedies also only apply to a certain subset of the most sensitive personal information under the CCPA (such as Social Security number) and are not available for all categories of personal information.

California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. (California Civil Code s. 1798.29(a) [agency] and California Civ. Code s. 1798.82(a) [person or business].) https://oag.ca.gov/privacy/databreach/reporting