# Standards and Regulatory References — California Breach Notification

## Primary Legislation

### Cal. Civ. Code §1798.82 — Breach Notification
- §1798.82(a): Notification obligation when personal information is acquired by unauthorized person.
- §1798.82(c): Law enforcement delay provision.
- §1798.82(d): Content and format requirements for notification.
- §1798.82(f): AG notification for 500+ California residents.
- §1798.82(g): Substitute notice provisions.
- §1798.82(j): Cost/volume thresholds for substitute notice.

### Cal. Civ. Code §1798.81.5 — Personal Information Definition
- §1798.81.5(d): Defines "personal information" triggering notification (name + specified data elements).
- Includes financial, health, biometric, credential, genetic, and government identifier categories.

### Cal. Civ. Code §1798.150 — CCPA/CPRA Private Right of Action
- Provides statutory damages for data breaches involving nonencrypted and nonredacted personal information.
- $100 to $750 per consumer per incident, or actual damages.
- 30-day cure notice required before suit.

### Cal. Civ. Code §1785.11.2 — Security Freeze
- Right of California consumers to place, temporarily lift, or remove a security freeze.
- Must be referenced in breach notification if SSN is involved.

## California AG Guidance

### California Data Breach Report (Published Annually)
- The California AG publishes an annual report analyzing data breach notifications received.
- 2023 Report: Recommended specific formatting for breach letters (five required headings), 10-point minimum font size, and plain-language writing standards.
- Recommended offering identity theft prevention services for breaches involving SSN or financial data.

### AG Recommended Practices
- Notify affected Californians "as quickly as possible" — delays measured in weeks, not months.
- Use the five standard headings in notification letters.
- Provide actionable, specific guidance to consumers (not generic advice).
- Include toll-free number staffed by knowledgeable agents.

## Enforcement Precedents

- **Hanna Andersson (2020)**: $400,000 settlement. AG cited delayed notification and inadequate security.
- **DoorDash (2020)**: AG investigation; 4.9 million affected. Scrutiny of notification timing and content.
- **CafePress (2022)**: FTC action with California AG coordination. Breach affecting 23 million users.
- **Blackbaud (2023)**: Multi-state AG settlement (California led). $49.5 million for breach affecting nonprofits.
- **T-Mobile (2022)**: $350 million national settlement; California AG monitored state-specific compliance.

## Federal Interaction

- California breach notification law is NOT preempted by HIPAA for health data (HIPAA sets a floor, not a ceiling for state laws).
- California breach notification law is NOT preempted by GLBA for financial data.
- The California law may apply in addition to GDPR for California residents who are also EU data subjects.