Legislation by Assemblymember Dave Jones (D – Sacramento ) requiring retailers and government to protect consumer information from costly and damaging security breaches was approved by the California State Assembly on a strong 58-2 bipartisan vote in the 80-member Assembly.

“This strong bipartisan vote shows that protecting sensitive consumer data is not a partisan issue, it’s a common sense issue,” Jones said.  “When your home computer has more protection than the payment network of some merchants you know that there’s a problem.  Data breaches such as the TJX breach put an alarming number of Californians at risk so we need to act now.  These breaches are easily avoidable if companies simply follow industry standards to keep only the data they really need and protect the data they retain.”

Jones’ Assembly Bill 779 would enhance consumer notices describing security breaches.  The bill also makes those responsible for security breaches pay for the costs of credit/debit card replacement and consumer notification.  Most importantly, AB 779 would require companies to follow key provisions of the Payment Card Industry (PCI) data security standards, which govern the retention and protection of personal consumer information.

In the most recent example of a security breach involving credit card information, TJX Companies, parent of TJ Maxx, Marshalls and other retailers, reported that information on 45.6 million credit and debit cards was accessed by hackers over 18 months, making it the largest security breach ever.  According to the Wall St. Journal, the breach occurred because TJX didn’t follow basic principles to protect their data.  Industry estimates indicate that the TJX data breach may cost between $4.5 - $8.6 billion dollars.

Jones’ bill is sponsored by the California Credit Union League and supported by consumer organizations and labor groups.  It is opposed by retailers, banks, high-tech companies and insurance companies.  AB 779 now moves on to the State Senate.