1. There is no generally applicable data security principle under federal law.
2. The Sarbanes-Oxley Act requires all business entities to adopt and report on a data security policy.
3. The Sarbanes-Oxley Act specifies the procedures to be followed by public companies in securing their financial data.
4. Failure to implement an effective data security policy could result in jail time for a public company's chief financial officer.
5. The Sarbanes-Oxley Act imposes an ongoing monitoring requirement on many corporate officers involved in financial reporting.
6. There are no protections under the federal law for personal information on children that is gathered on the Internet.
7. California is the only state that has legislation specifically covering data security for personal information.
8. California's law requiring reasonable security practices with respect to personal information applies whether the data is maintained in computerized or other form.
9. California's law requiring notification to residents of any unauthorized access to their personal information applies regardless of whether the data is maintained in computerized or other form.
10. The personal information protected by California law is any type of information that could be used to identify an individual.
11. California's law requiring notification to residents of any unauthorized access to their personal information applies to businesses located in any state.
12. California's law requiring notification to residents of any unauthorized access to their personal information applies to employee information.
13. California law sets a variety of specific guidelines for implementing data security measures.
14. A business that no longer intends to keep personal information about some of its customers is required by California law to destroy the relevant records.
15. California law requires that a company receiving personal information about California residents from one of its business partners must adopt the same security measures as the disclosing company.
16. California's law requiring notification to residents of any breach of data security applies only if their personal information is ultimately used for identity theft.
17. California's law requiring notification to residents of any breach of data security requires notification by means of highly public "substitute notice" if the company lacks sufficient direct contact information.
18. California's law requiring notification to residents of any breach of data security would not be triggered by a company's loss of a computer hard drive containing only encrypted personal information.
19. A company's own website privacy policy can give rise to liability for breaches of data security.
20. Under certain circumstances, a company could be found negligent for failing to prevent a security breach caused by careless employees.