Evan Schuman's StorefrontBacktalk

California Governor Arnold Schwarzenegger is a man of surprises, be it as a bodybuilder turned successful movie star or as a staunch Republican winning election as the governor of reliably Democratic California. This month, though, he delivered his latest surprise in the form of a veto of a key data breach bill, a bill that had already had its critics withdraw all of their opposition.

Schwarzenegger’s veto (which allegedly prompted the bill to look at the governor and bellow, “I’ll be back”) is not the first time he’s tackled data breach legislation; he has already forced earlier versions to be diluted.

The new bill, SB-20, would have required retailers to provide more details about a breach, including the type of personal information exposed, a description of the incident and exactly when it took place. It also required merchants to submit a copy of the notification letter to the California Attorney General’s office if more than 500 California residents are affected in a single incident.

The strange part of the veto is that all of the official opposition to the bill—from the California Chamber of Commerce, the California Bankers Association, the Association of California Insurance Companies and State Farm Insurance (and about eight others)—was withdrawn on August 26 because the groups got together and said they “were satisfied with the amended bill, which eliminated a single provision that would have required breached firms to provide victims with an estimated number of total people affected by the incident,” according to a story in SC Magazine.

The California law is critical, because so many other states tend to model this kind of legislation on what the nation’s most populous states do.

Schwarzenegger’s October 11 veto message said that the existing legislation is good, and that this bill doesn’t actually improve it.

“California’s landmark law on data breach notification has had many beneficial results. Informing individuals whose personal information was compromised in a breach of what their risks are and what they can do to protect themselves is an important consumer protection benefit,” his veto message said. “This bill is unnecessary, however, because there is no evidence that there is a problem with the information provided to consumers. Moreover, there is no additional consumer benefit gained by requiring the Attorney General to become a repository of breach notices when this measure does not require the Attorney General to do anything with the notices. Since this measure would place additional unnecessary mandates on businesses without a corresponding consumer benefit, I am unable to sign this bill.”

The notification terminator makes a fair point, albeit a very limited one. “There is no evidence that there is a problem with the information provided to consumers.” True, but what evidence could possibly exist? How can you prove a negative? The better question to ask would be: “Is it likely that forcing retailers to provide this information would directly—or even indirectly—make consumers safer?”

As a practical matter, there is likely no direct benefit to consumers knowing this information, insofar as it’s not likely to make it easier for them to fix whatever damages they sustain in terms of time spent.

But will it have a significant indirect benefit? There’s a good case for why it would be beneficial. Will this requirement make it more unpleasant for retailers that suffer breaches? Will it make it easier for consumers and shareholders to file successful lawsuits against those retailers? Will the forced revealing of these details make such incidents more embarrassing for retailers? The answer is “yes” to all three questions.

You then need to ask the ultimate question: Will it make it sufficiently less pleasant that retailers will be inclined to invest more time, money and other resources to boost security and, therefore, make such breaches less likely? That’s the real question here; and the one the governor sidestepped. Honestly, I’m not sure of the answer. The cost to truly improving is so high that these relatively minor additional hardships won’t likely make a difference. But under the rationale of “if it even makes such breaches one-half of one percent less likely, it’s worth it,” I think it might be worth making into law.

As for the notification letter, that’s a definite deterrent, because it places all such incidents in one central public place. In short, anything that makes it easier to find out about these breaches will make such breaches less likely. How much less likely? Ahhhh, there’s the California story.