California - Breach Notification

This playbook helps an analyst determine if the breached data meets the criteria for breach notification according to California law, and, if necessary, follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. **Source:** http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.

US - Breach Notification · 32 tasks · 7 inputs · 8 outputs

Inputs

  • ContactName — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • ContactEmailAddress — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • ContactTelNumber — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • CompanyName —
  • CompanyAddress — In case of a breach, the company details to display in the breach report.
  • CompanyCity — In case of a breach, the company details to display in the breach report.
  • CompanyCountry — In case of a breach, the company details to display in the breach report.

Outputs

  • PIICompromised — Set a flag indicating that PII has been compromised.
  • HealthInsuranceBreached — Set a flag indicating that the breach contains PII of health insurance information.
  • MedicalInformationBreached — Set a flag indicating that the breach contains PII of medical information.
  • FinancialInformationBreached — Set a flag indicating that the breach contains PII of financial information.
  • AccountInformationBreached — Set a flag indicating that the breach contains PII of account information.
  • UniqueIdentificationNumberBreached — Set a flag indicating that the breach contains PII of unique identification number.
  • UniqueBiometricDataBreached — Set a flag indicating that the breach contains PII of unique biometric data.
  • Analyst review.Answers.1 — Explain, in your words, the incident origin, what you have checked, and any information related to this incident.

Commands used

send-mail setIncident

Flowchart

yes No Yes yes No Yes No Yes Less than 500 More than 500 Start Start Notify DPO of suspected data breach Notify DPO of suspected d... DPO confirmed the breach DPO confirmed the breach Breach documentation process Breach documentation process Generate breach report - GenerateInvestigationSummaryReport Generate breach report GenerateInvestigationSummaryR... Done Done Upload and submit the report to California attorney general Upload and submit the rep... DPO updates report DPO updates report Get new report from DPO Get new report from DPO Contact authorities Contact authorities Send report for DPO approval - send-mail Send report for DPO approval send-mail Get DPO Approval for the report Get DPO Approval for the ... Is PII compromised? Is PII compromised? PII Breach Notification required PII Breach Notification r... No breach has occurred No breach has occurred Analyst review Analyst review Does breach contain California resident information? Does breach contain Calif... Notify management with the severity of data breach Notify management with th... Does law enforcement require delaying breach notification? Does law enforcement requ... Wait to hear back from law enforcement Wait to hear back from la... Checks number of affected data subjects Checks number of affected... Update incident with DPO answers - setIncident Update incident with DPO ... setIncident breach does not contain California resident breach does not contain C... Set PII compromised flag - Set Set PII compromised flag Set Set PII wasn't compromised flag - Set Set PII wasn't compromise... Set Updates DPO notification status to in progress - setIncident Updates DPO notification ... setIncident Updates DPO notification status to done - setIncident Updates DPO notification ... setIncident Updates management notification status to in progress - setIncident Updates management notifi... setIncident Updates management notification status to done - setIncident Updates management notifi... setIncident Updates Attorney General notification status to in progress - setIncident Updates Attorney General ... setIncident Updates Attorney General notification status to done - setIncident Updates Attorney General ... setIncident Set breached not confirmation flag - setIncident Set breached not confirma... setIncident