Governor Jerry Brown of California has signed into law AB 1710, which strengthens the state’s existing data breach notification law. Three major changes are made by AB 1710: (1) that any offer to provide identity prevention and mitigation services to an individual receiving a breach notification must be for a period of not less than 12 months and at no cost to the individual; (2) expansion of the requirement of businesses that “own or license” personal information of California residents to implement appropriate and reasonable security procedures and practices to apply also to businesses that “maintain” personal information, such as service providers ; and (3) a prohibition on the  sale, offer for sale or advertising for sale of Social Security numbers of California residents.

Assembly Bill No. 1710