Slashdot Mirror
Dear Sir: Your Credit Card Number Has Been Owned
An anonymous reader submits: "California has become the first state in the nation to require companies victimized by malicious computer attacks to disclose what might have been compromised to their customers. Dubbed the Security Breach Information Act, companies whose systems are cracked and have credit card, bank account, and/or other significant customer data stolen are required to report the intrusion either by email, snail mail, a notice on their website, or by notification to the news media. Law takes effect Tuesday, July 1 (tomorrow)."
Slashdot was compromised back a few years ago. The maintainers were very quick to notify everyone and recommend changing passwords immediately. If only other businesses were as forthcoming!
And there weren't any credit card numbers involved!
Helping with organizational effectiveness is our job.
When I first started using Credit cards 3 years ago, I never used it on the internet for 6 months, fearing the consequenses of a theft. But, one fine day, my statement showed charges from some cruise/vacation website and some discounts program I never heard of before for $200!! I got mad and called the credit card company and it took them 2 months to fix it. Then, I decided, what the heck, let's use'em on internet since the numbers will be stolen anyway. :(
New year Resolution: Don't change sig this year
interesting idea, except that a CA senator introduced a similar bill for national basis last week. (RTFA) Second paragraph happens to also mention that it dont matter where a company is physically located, they just have to have customers in CA.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
I just got home a few hours ago from a seminar where I heard a Real Lawyer discussing this exact question.
If you advertise in a California paper and sell to a California resident, that's governed by California law even if your corporate home is in another state.
If you have a branch in California, same deal. You're considered to be doing business *in* California, as opposed to across state lines.
There are a lot of complicated rules about what consitutes "doing business in" a state, rules which evolved back in the meatspace era.
Remember all those "void where prohibited" disclaimers? Those were short for "If your state doesn't allow this, I'm not offering it there, so I'm not soliciting business from anyone in your state".
All legal errors in the above are my fault. If you get in trouble because you got your legal education from Slashdot, that's your fault.