Law / United States / 
California
Customer Records Act, Reasonable Security Procedures
Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527)
In force since .
A security baseline statutes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
What it requires
- This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a Health Insurance Portability and Accountability Act (HIPAA) covered entity as to HIPAA-regulated activity, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
- Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, genetic data, or a username or email address paired with a password or security question that unlocks an online account.
- A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Civil Code 1798.81.5 names no dedicated regulator. Civil Code 1798.84(b), within the same title, gives an injured customer a civil action for damages.
Settledness
The Attorney General's February 2016 California Data Breach Report discusses this duty and states that it is for informational purposes and should not be construed as legal advice or as policy of the State of California.
- As of
- Open questions
- Does the Attorney General's 2016 statement that failing to implement all the applicable CIS Critical Security Controls "constitutes a lack of reasonable security" fix the meaning of "reasonable security procedures and practices appropriate to the nature of the information" in Civil Code section 1798.81.5(b), or can a business meet that standard with a different framework?
- Which third parties are "not subject to subdivision (b)" within Civil Code section 1798.81.5(c), given that subdivision (b) already reaches a business that "maintains" personal information it does not own or license?
What it reaches
Obligation class
Security
Applicability criteria
Business is defined in Civil Code section 1798.80(a) and personal information in section 1798.81.5(d)(1); subdivision (e) lists the entities and businesses to which the section does not apply.
- As of
- Combinator
- All of
- Criteria
- A business that owns, licenses, or maintains personal information about a California resident
What this law does
A business that owns, licenses, or maintains personal information about a California resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure; where the business instead discloses that information to a nonaffiliated third party by contract, it must require the same standard of the third party by contract.
Covered personal information reaches a California resident's name paired with a Social Security, driver's license, state identification, passport, military identification, or tax identification number, a financial account or payment card number together with its access code, medical information, health insurance information, unique biometric data used to authenticate a specific individual, genetic data, or a username or email address paired with a password or security question that would permit access to an online account.
The duty exempts a health care provider, health plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a Health Insurance Portability and Accountability Act (HIPAA) covered entity as to HIPAA-regulated medical privacy and security rules, an entity receiving Vehicle Code confidentiality-protected information, and a business already subject to state or federal law that provides greater protection to personal information on the same subject, which is deemed compliant instead.
Civil Code section 1798.84(b), within the same Customer Records title, gives a customer injured by a violation of this duty a civil action to recover damages, with no statutory cap of its own. The $500 to $3,000 per-violation civil penalty that section 1798.84(c) provides is reserved, by its own terms, for a violation of section 1798.83's Shine the Light disclosure duty rather than a violation of this section.
Where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a further and separate remedy, already researched as this jurisdiction's privacy row.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .