California’s data-breach notification law, enacted in 2002 and effective July 1, 2003, created the model for requiring organizations to notify people when unauthorized parties acquired—or were reasonably believed to have acquired—unencrypted personal information. By August 2021, all 50 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands had adopted notification rules, but the requirements differed on harm thresholds, reporting deadlines, covered information, penalties, and whether authorities or credit agencies had to be notified. The resulting system left companies facing a costly patchwork while victims received inconsistent protections.
The consequences became visible during the October 2017 Equifax breach, which exposed the personal information of almost 146 million people and helped intensify demands for stronger disclosure and security obligations. Despite federal proposals beginning in 2003 and President Barack Obama’s 2015 Personal Data Notification & Protection Act proposal—including a proposed 30-day notification standard—Congress had not enacted a general federal law as of August 2021. The source identifies no single executive responsible for the policy failure; scholars instead attribute congressional deadlock partly to states’ rights, while critics argue the fragmented regime produces inadequate security incentives and leaves victims uncompensated.
