California Bill AB 259 seeks to amend Section 1798.29 of the Civil Code (relating to information privacy). The bill applies specifically to "agencies" and would require that agencies that are the source of a data breach involving "a person's social security number, driver's license number, or California identification card number" to "offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information[.]"

As used in the Information Practices Act of 1977 to which this bill would apply, "agency" is defined as:

 (b) The term "agency" means every state office, officer, department, division, bureau, board, commission, or other state agency, except that the term agency shall not include:
   (1) The California Legislature.
   (2) Any agency established under Article VI of the California Constitution.
   (3) The State Compensation Insurance Fund, except as to any records which contain personal information about the employees of the State Compensation Insurance Fund.
   (4) A local agency, as defined in subdivision (a) of Section 6252 of the Government Code.

2. Geolocation Legislation

(f) For purposes of this section, "reasonable security procedures and practices" as they pertain to the storage and transmission of personal information  shall require, at a minimum, the security of that information to the degree that any reasonably prudent business would provide. All of the following shall also apply: 
  
   (1) At a minimum, the business shall:     

(A) Identify reasonably foreseeable internal and external risks to the privacy and security of personal information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of the information. 

(B) Establish, implement, and maintain safeguards reasonably designed to ensure the security of the personal information,including, but not limited to, protecting against unauthorized loss, misuse, alteration, destruction, access to, or use of the information.

(C) Regularly assess the sufficiency of any safeguards in place to control reasonably foreseeable internal and external risks, and evaluate and adjust those safeguards in light of the assessment.

(D) Evaluate and adjust any material changes in the operations or business arrangements of the business, or any other circumstances, that create a material impact on the privacy or security of personal information under control of the business. 

   (2) The reasonableness of the security procedures and practices shall be determined in light of all of the following:

(A) The degree of the privacy risk associated with the personal information under the business's control.

(B) The foreseeability of threats to the security of the information. 

(C) The existence of widely accepted practices in administrative, technical, and physical safeguards for protecting personal information. 

(D) The cost of implementing and regularly reviewing the safeguards.