PRO+ Premium Content/Information Security magazine

Whether or not you view the passage of California's SB 1386 data privacy law in 2003 as a watershed moment in the information security world, few can argue that its enactment significantly changed the infosec playing field. Although federal legislation had covered certain industry verticals (e.g., GLBA and HIPAA/HITECH), most activity involving broadly applicable privacy and information security laws has occurred at the state level. SB 1386 initiated much of this activity. Over time, a definite trend has emerged: reactive state laws dealing with cybercrime have given way to proactive laws requiring affirmative steps to secure information systems. Reactive state data privacy laws Flashback: SB 1386 Ten years ago in Information Security magazine, Randy Sabett examined how to achieve compliance with the then-new California SB 1386 privacy law. Early state data privacy laws criminalized various activities that today would collectively be referred to as “hacking.”  These reactive laws focus primarily on the hacker—an elusive entity ...