Privacy & Identity Theft

OAKLAND — California Attorney General Rob Bonta filed a brief in defense of California’s law requiring companies to prioritize the online privacy, safety, and well-being of children over commercial interests. The brief seeks to block an effort by an online trade association representing companies such as Google, Meta, Amazon, Twitter, and TikTok challenging the California Age-Appropriate Design Code Act, a first-in-the-nation law aimed at safeguarding children online. The act requires that businesses that trade in consumers’ personal information and offer products, services, and features likely to be accessed by children proactively protect their young users’ information, and prohibits certain actions that involve the collection and use of that information.

“Businesses do not have a right to children’s data,” said Attorney General Bonta. “This is not about free speech: the companies challenging this law are doing so because they want to continue to make money from our kids’ online activity. In California, it is no longer business as usual when it comes to designing online services, products, and features that are accessed by kids – it’s time to elevate and protect children’s privacy and safety. The bottom line is: our children’s childhood experience should not be for sale, and we are defending the state stepping up to protect our children.”

The California Age-Appropriate Design Code Act was signed into law in 2022 and is modeled after the United Kingdom’s Age Appropriate Design Code, which similarly requires that websites likely to be accessed by children provide privacy protections by default. The Legislature unanimously passed the law, finding that more needs to be done to create a safer online space for children to learn, explore, and play. Despite businesses’ awareness that children use their services, businesses currently design their online services to include features that may be harmful to children, including manipulative techniques to prod them to spend hours on end online or provide personal information beyond what is expected or necessary. 

Attorney General Bonta's brief argues that the court should reject the companies’ efforts to block enforcement of the California Age-Appropriate Design Code Act, because:

• The law does not violate these companies’ first amendment rights, since the act does not regulate content, mandate government approval before businesses can act, or restrict what content businesses make accessible to consumers;
• The law is not preempted by federal law because it does not conflict with existing federal law; and 
• An injunction would inflict irreparable harm upon California by preventing enforcement of a statute enacted by representatives of the people, and in the public interest to advance the safety and protection of minors.

A copy of the brief filed today can be found here. 

 

Part of Multi-Pronged Effort to Improve Online Privacy and Increase Compliance with CalOPPA 

SAN FRANCISCO -- Today, Attorney General Kamala D. Harris announced the release of an online form to help consumers report websites, mobile applications, and other online services that are in violation of the California Online Privacy Protection Act (CalOPPA). A website or app operator may violate CalOPPA by failing to post privacy policies or posting incomplete or inadequate policies. This new form is one of several initiatives Attorney General Harris is undertaking to protect Californians’ privacy, especially in light of technological advances and the growth of the “internet of things.”  The form is available at https://oag.ca.gov/reportprivacy.

“In the information age, companies doing business in California must take every step possible to be transparent with consumers and protect their privacy,” said Attorney General Harris. “As the devices we use each day become increasingly connected and more Americans live their lives online, it’s critical that we implement robust safeguards on what information is shared online and how. By harnessing the power of technology and public-private partnerships, California can continue to lead the nation on privacy protections and adapt as innovations emerge.”

In 2011, the Future of Privacy Forum (FPF) conducted a study which found that many mobile apps were missing privacy policies, prompting the Attorney General to secure a first-of-its-kind agreement with the leading mobile application platforms, including Apple, Google Play and Amazon, to improve compliance; this agreement was later expanded to include Facebook. As a part of her continued commitment to privacy, Attorney General Harris directed her office to conduct a five-year review on mobile app compliance with CalOPPA and commissioned the FPF to conduct a new study of the top 100 mobile apps.  In addition, the Attorney General’s office is collaborating with computer scientists at Carnegie Mellon University to review apps in the Google Play store for compliance with the law and consulting with privacy experts, designers, and researchers to assess the effectiveness of CalOPPA and the “Do Not Track” legislation, which was sponsored by Attorney General Harris.  

A new FPF study, released in August 2016, found that the number of apps with privacy policies has risen substantially since the 2012 Mobile App Agreement—up from 30% to 80%; but the study also highlighted a notable and persistent gap, particularly in health and fitness apps, which often collect sensitive personal information but are less likely than other apps to have a privacy policy. The CMU research revealed that some mobile apps employ data practices that are not properly disclosed in their privacy policies, especially as they pertain to information sharing with third parties. This research indicates that while much progress has been made, more needs to be done to ensure companies are protecting consumers’ privacy and employing transparent practices. 

In response to the analysis of CalOPPA compliance, Attorney General Harris is today launching an online tool allows consumers to “crowdsource” privacy policy violations, exponentially increasing the California Department of Justice’s ability to identify and notify those in violation of CalOPPA.  To use the tool, consumers who have identified an operator that may not be in compliance can simply visit https://oag.ca.gov/reportprivacy to report the finding.    

The CalOPPA form is part of a multi-pronged approach to improve online privacy. The Attorney General’s office is also partnering with the Usable Privacy Policy Project at Carnegie Mellon University to develop a tool that will identify mobile apps that may be in violation of CalOPPA. The tool is designed to look for discrepancies between disclosures in a given privacy policy and the mobile app’s actual data collection and sharing practices (for example, a company might share personal information with third parties but doesn’t disclose that in its privacy policies).  This tool will help proactively identify and focus attention on policies that may require enforcement.

With the passage of CalOPPA in 2003, California became the first state in the nation to require commercial websites and online services to post privacy policies and the initiatives Attorney General Harris is leading will help strengthen California’s online privacy laws. Any operator in the world that collects personally identifiable information such as name, address, email address, phone number, or Social Security number from California consumers is required to comply. The privacy policy must include the categories of information collected, the types of the third parties with whom the operator may share that information, instructions regarding how the consumer can review and request changes to his or her information, and the effective date of the private policy. Assembly Bill 370, which Attorney General Harris sponsored, expanded this law in 2013 requiring privacy policies to include information on how the operator responds to ‘Do Not Track’ signals or similar mechanisms, as well as requiring privacy policies to state whether third parties can collect personally identifiable information about the site’s users. 

Attorney General Harris has a long track record of encouraging innovative and growth while protecting consumers’ privacy online. Earlier this week, she announced a new initiative—the California Cyber Crime Center—to help law enforcement fight crime in the digital era.  The center includes the California Department of Justice’s Privacy Enforcement and Protection Unit, which Attorney General Harris created in 2012. The Unit is responsible for enforcing state and federal privacy laws, providing Californians with information and strategies on how to protect their privacy, and encouraging businesses to follow best protection practices. Throughout her administration, the Attorney General has prosecuted and reached settlements with major corporations including Anthem Blue Cross, Citibank, Kaiser, Comcast, Houzz and Wells Fargo Bank for violating California’s privacy protection standards.  Attorney General Harris has also released numerous consumer alerts to help Californians, including alerts on how to adjust the location settings on your mobile phone and protect against identity theft, as well as consumer information sheets on a broad range of privacy issues.

Attorney General Harris is also strongly committed to data security, safeguarding consumers’ sensitive online information. In February, Attorney General Harris released a data breach report detailing the nature of reported breaches in the last four years, accompanied by recommendations for business and lawmakers including pointing to standards regarding “reasonable security” for protecting personally identifiable information. The office recently conducted a set of workshops for small businesses in conjunction with security experts from the Center for Internet Security.

SAN DIEGO - Attorney General Kamala D. Harris today announced that California has reached a $252,000 settlement with two privatized military housing contractors over the companies’ unlawful evictions of 18 military servicemembers and their families from private military housing complexes in San Diego and Orange Counties. 

Attorney General Harris argued that these evictions violated the California Military and Veterans Code, the Servicemembers Civil Relief Act, and other state debt collection laws which protect servicemembers who are sued while serving on active military duty and are therefore unable to appear and defend themselves in court.  These laws prevent the entry of a default judgment unless a lawyer has been appointed to represent the interests of the absent servicemember, and they prohibit the use of false statements to collect a debt.  In addition, the contractors allegedly violated California privacy laws by filing court documents that included unredacted Social Security numbers, birth dates, or other personal information of nearly 100 servicemembers and military family members.

The defendants, Lincoln Military Property Management LP and San Diego Family Housing LLC and their eviction law firm, Kimball, Tirey & St. John LLP, are required to pay $200,000 in civil penalties, as well as provide $52,000 in debt relief for the servicemembers harmed by their conduct and assist victims with restoring and repairing credit history.  The settlement also requires the defendants to provide privacy protections to victims, including identity theft repair and mitigation services for one year following notification.  In addition, any default judgment evicting a servicemember and his or her family that was unlawfully obtained will be dismissed.

“It is unconscionable that companies would prey upon and illegally evict servicemembers and their families from their homes,” said Attorney General Harris. “This agreement holds these contractors accountable for their unlawful conduct – including illegal evictions and privacy violations – and ensures that veterans’ rights under the law are protected.  I want to thank the Navy Region Legal Service Office (RLSO) Southwest of San Diego for helping us secure justice for the servicemembers harmed by these companies.”

The complaint, filed today in San Diego Superior Court, alleges that Lincoln routinely evicted tenants from its private military housing complexes while failing to file affidavits that accurately reflected the military status of the servicemembers.  The defendants also violated California privacy laws by disclosing the personal information of servicemembers, exposing at least 100 victims to a risk of identity theft.  

The United States Department of Justice is filing a parallel complaint in the U.S. District Court for the Southern District of California alleging violations of federal law.

This is Attorney General Harris’s second action against a company that violated the Servicemembers Civil Relief Act.  The first was against JP Morgan Chase, which violated the Act in obtaining default judgments against servicemembers on credit card debt.  The Attorney General also obtained a $1.1 billion judgment against Corinthian Colleges, which illegally used the official seals of the military services in advertisements to entice servicemembers and veterans to enroll in its programs. 

The Attorney General’s office has provided training and technical support to JAG legal assistance attorneys at military installations throughout California.  The Attorney General has also issued multiple consumer alerts to help members of the military protect themselves from fraud and scams.  Her most recent alert for servicemembers and veterans, issued in honor of Memorial Day, provides tips on how to avoid common scams including rental scams, pension scams, predatory auto sales and financing, and education rip-offs.

A copy of the complaint is attached to the online version of this news release at www.oag.ca.gov/news.

LOS ANGELES – On Saturday, April 30, Attorney General Kamala D. Harris, AARP CA, and the District Office of Councilman Curren Price will hold Shred Fest 2016, a Los Angeles event where consumers can learn about how to prevent identity theft by shredding personal documents and other sensitive records for free. 

Saturday’s event is part of an ongoing partnership between AARP and Attorney General Harris’s office to protect consumers from identity theft and fraud and is one of several Shred Fest 2016 events scheduled for communities nationwide.  Shred Fest is also part of Money Smart Week®, supported by AARP’s Fraud Watch Network and the AARP Foundation.

“We must be vigilant in prosecuting those who take advantage of seniors and work to educate all Californians on how to avoid the increasing risks of identity theft, fraud and scams,” said Attorney General Harris. “‘Shred Fest 2016’ will help seniors safely dispose of sensitive documents and learn key strategies to protect themselves against identity theft.”

Information about Los Angeles Shred Fest 2016:

Saturday, April 30, 2016
4301 S. Central Avenue, Los Angeles, CA  90011
Shredding service begins at 10 a.m. and will continue until 2 p.m.

“Financial fraud causes millions of dollars in losses each year,” said Councilman Curren Price. “With the tax-filing season behind us, we’re encouraging taxpayers to do a spring cleaning of their old financial documents and other records.” 

“Identity thieves routinely search through dumpsters and trash cans, looking to find confidential information.  Our Shred Fest 2016 event will allow consumers to discard this paperwork in a safe and secure manner,” said Nancy McPherson, AARP CA State Director.

To avoid having your sensitive information compromised, security experts recommend shredding of the following types of materials:

• Old documents: Papers that carry your Social Security number, birth date, signature, account numbers, passwords or PIN numbers.
• Banking: Canceled or unused checks.  Shred deposit slips and ATM and credit card receipts, once you receive your monthly statements.
• Credit Cards: Preapproved credit card applications and incentive/gift checks from credit card companies.
• Medical: unneeded medical bills.
• Investments: Investment account statements.
• Obsolete ID cards: Expired driver’s licenses, medical insurance cards and passports.

Last year, Attorney General Harris partnered with AARP to protect seniors from fraud and abuse in a collaboration that includes tele-town halls and webinars to educate seniors, their families and the general public about legal protections designed for people age 50 and over. Together with the AARP Fraud Watch Network, Attorney General Harris’s office has created and disseminated consumer and educational resources to protect seniors against scams and schemes.

More resources to protect against identity theft are available on the Attorney General’s website at: http://oag.ca.gov/idtheft.

LOS ANGELES - Attorney General Kamala D. Harris and five district attorneys today announced a $8,500,000 settlement with Wells Fargo Bank over privacy violations that included recording consumers’ phone calls without timely telling consumers they were being recorded, as required by California law. The investigation into Wells Fargo and the subsequent settlement were the result of the work of the Attorney General’s Office and the office of Los Angeles County District Attorney Jackie Lacey, along with the Consumer Protection Divisions of Alameda County District Attorney Nancy E. O’Malley, Riverside County District Attorney Michael Hestrin, San Diego County District Attorney Bonnie M. Dumanis and Ventura County District Attorney Gregory D. Totten.

As part of the settlement, which is in the form of a stipulated judgment, Wells Fargo will pay civil penalties totaling $7,616,000 and will reimburse the prosecutors' investigative costs of $384,000. In addition, Wells Fargo will contribute $500,000 to two statewide organizations dedicated to advancing consumer protection and privacy rights.  

“Protecting the privacy of California consumers is increasingly crucial as technology rapidly develops and becomes a bigger part of our lives,” said Attorney General Harris. “This settlement holds Wells Fargo accountable for violating the privacy of its customers by recording calls without providing adequate notification, and ensures that the bank makes the changes necessary to protect the privacy of its customers.”

The civil complaint, filed in Los Angeles Superior Court, alleged that Wells Fargo violated sections 632 and 632.7 of the California Penal Code by failing to timely and adequately disclose its automatic recording of phone calls with members of the public. California has some of strongest privacy laws in the country.  In California, each party to a confidential conversation must be advised at the outset if a call is being recorded, so that the individual can object or terminate the call if he or she does not wish to be recorded.

In addition, the settlement agreement states that Wells Fargo must comply with California's standards for recording confidential communications between the bank and its customers by making clear, conspicuous, and accurate disclosures.  Wells Fargo has also agreed to implement an internal compliance program to ensure that the policy changes are made. This is a significant step that is aligned with Attorney General Harris’ ongoing efforts to preserve California businesses’ ability to innovate while ensuring that consumers’ right to privacy is protected.

“Wells Fargo failed to recognize that Californians place a high value on privacy,” said Los Angeles County District Attorney Jackie Lacey. “Today’s settlement takes another step toward ensuring that consumers’ rights are protected.”  

“The collaboration of the District Attorney’s Offices and the Attorney General resulted in today’s settlement,” said Alameda County District Attorney Nancy E. O’Malley. “As information technology reaches ever further into the lives of our citizens, strict compliance with California’s privacy laws becomes ever more imperative to protect the rights of those individuals.”

“Preserving an individual’s right to privacy is among the greatest challenges we face in the Digital Age,” said San Diego County District Attorney Bonnie M. Dumanis. “This settlement underscores our office’s commitment to protecting San Diego County consumers from intrusions and privacy violations in the marketplace.”

Once Wells Fargo was notified by investigators of the alleged deficiencies in their recording disclosures, the bank and its counsel worked cooperatively to implement changes in the company’s policies nationwide, without admitting liability.

In October 2015, Attorney General Harris reached a similar settlement with Houzz Inc., an online platform for home remodeling and design, to resolve allegations that the company violated California privacy laws by recording incoming and outgoing telephone calls without notifying all parties on the call that they were being recorded. The settlement required Houzz to appoint an individual to serve in a Chief Privacy Officer capacity to oversee Houzz’s compliance with privacy laws, marking the first time such a provision has been included in a California DOJ settlement.  . 

Copies of the complaint and stipulated judgment are attached to the online version of this release at www.oag.ca.gov.

SAN FRANCISCO – Attorney General Kamala D. Harris today addressed the Stanford Cyber Initiative to release a comprehensive report detailing the nature of data breaches reported to her office over the past four years.  The report found that between 2012 and 2015, there were 657 data breaches, which compromised over 49 million records of Californians’ personal information.   The report is accompanied by recommendations from the Attorney General for organizations, businesses and lawmakers on how to protect against data breaches, and points to a specific set of actions that companies and organizations should start with to meet the state and federal mandates of reasonable security. Last year, 178 breaches placed 24 million records of Californians at risk.  This means that as many as three in five Californians may have been victims of a data breach in 2015 alone. “Government and the private sector have a shared responsibility to safeguard consumers from threats to their privacy, finances, and personal security,” said Attorney General Harris.  “California is leading the nation with measures to prevent data breaches, but we can do better.  This report clearly articulates basic steps that businesses and organizations must take to comply with the law, reduce data breaches, and better protect the public and our national security.” The report includes information on the most common types of data breached, explains what types of breaches different industry sectors were most susceptible to, and provides recommendations to reduce the frequency and impact of future breaches.

Types of Data Breached 

• Social Security numbers, payment card data, and medical information were the top three types of data breached over the past four years.

Industry Sectors 

• The retail sector has been the most vulnerable industry, accounting for 24% of breaches and 42% of records breached in the past four years.
• The financial sector accounts for the second largest share of breaches at 18%, and 26% of records breached. Social Security numbers are the most common data breached in this sector.
• The healthcare industry accounts for 16% of breaches, and continues to be particularly vulnerable to physical breaches.
• Small businesses represent 15% of all reported breaches.

Recommendations for Organizations

• Adopt the Center for Internet Security’s Critical Security Controls as the start of a comprehensive information security program, since not doing so would be indicative of a failure to provide reasonable security.
• Make multi-factor authentication available on consumer-facing online accounts that contain sensitive personal information.  This procedure provides greater protection than the username-and-password combination typically used for online shopping accounts, health care websites and patient portals, and web-based email accounts.
• Consistently use strong encryption to protect personal information on laptops and other portable devices, and consider using it for desktop computers.  This is particularly important for health care, which appears to be lagging behind other sectors in this area.
• Encourage individuals affected by a breach of Social Security numbers or driver’s license numbers to place a fraud alert on their credit files.  This measure is free, fast, and effective in preventing identity thieves from opening new credit accounts.

Recommendations for State Policy Makers

• Collaborate to harmonize state breach laws on key dimensions.  Such an effort could reduce the compliance burden for companies, while preserving innovation, maintaining consumer protections, and retaining jurisdictional expertise.

As data threats evolve, California must remain at the forefront of identifying and implementing creative and effective ways to fend off attackers.  In 2004, California passed its information security statute (AB 1950, Wiggins), which requires businesses that collect personal information to use “reasonable security practices and procedures.” In 2003, California became the first state to mandate data breach notification, requiring businesses and state agencies to inform consumers when a security breach compromises their personal information (AB 700, Simitian). As of 2012, any breach involving more than 500 Californians must be reported to the Attorney General’s Office (SB 24, Simitian).

Attorney General Harris has invested the best talent and resources of the California Department of Justice into the fight for cyber security.  In 2011, she created the eCrime Unit, which is tasked with investigating and prosecuting large-scale identity theft, technology crimes, and crimes that target electronic devices, networks, or intellectual property.  In 2012, Attorney General Harris established the Privacy Enforcement and Protection Unit to enforce and regulate state and federal laws regulating the collection, retention, disclosure, and destruction of personal information, as well as to educate organizations and consumers on privacy responsibilities and rights.

Furthermore, a number of recommendations from Attorney General Harris’s previous data breach reports have been enacted into law.  SB 46 (Corbett), which took effect in January 2014, added online account credentials to the list of personal data covered under SB 24 (Simitian).  In 2014, AB 1710 (Dickinson) was enacted, requiring the source of a breach of such data to offer identity theft prevention or mitigation services at no cost to the affected person and for no less than 12 months.  The law took effect in January 2015.  In 2015, SB 570 (Jackson) amended the breach law to require the use of a format for breach notices that makes them easier to understand. It took effect in January 2016.

View the full California Data Breach Report February 2016.

SAN FRANCISCO – California Attorney General Kamala D. Harris is commemorating international Data Privacy Day by reminding consumers of three easy steps to take to protect against identity theft in 2016. Attorney General Harris is also partnering with Facebook to share privacy tips for Facebook users, as part of her commitment to incorporating technology into government. The Attorney General’s Facebook video message can be found here: http://on.fb.me/dataprivacydaycalifornia. January 28, Data Privacy Day, is observed in the U.S., Canada and Europe as an opportunity to promote privacy awareness.

Identity theft is a privacy crime that cost individuals and businesses $16 billion in 2014,the last year for which information is available.[1] There were 12.7 million victims of identity theft in the U.S. – that is one victim every 2.5 seconds. Over 1.5 million victims were in California.

The following three Data Privacy Day tips are a good starting point for consumers to begin to protect themselves from identify theft.

1.     Order your credit reports (free).  

Consumers are highly encouraged to regularly monitor their credit files. Proactive credit monitoring can help consumers catch errors and quickly identify potential identity theft issues. Consumers are entitled by law to get a credit report from each of the three major credit bureaus every year, at no cost.

FREE annual credit reports can be ordered online at www.annualcreditreport.com or through the toll-free phone number:  (877) 322-8228. After receiving the reports, make sure to review them thoroughly for information that is not recognized and take action on anything suspicious. For more information, please visit: How to Order Your Free Credit Reports: Tips for Consumers.  All consumers are entitled to one free credit report every 12 months, from each credit reporting company, and should not have to input or share credit card information for these reports.

2.     Protect your electronics with strong passwords (free).

Smartphones and tablets contain a lot of personal information, such as banking, shopping, and location information in apps and emails. Consumers should make a habit of locking their devices just as they lock their homes and vehicles. Additionally, rather than using a 4-digit passcode which can be cracked in minutes, consumers should use a strong password that contains at least 8 characters, including letters, numbers and symbols. Consider using a phrase and substituting numbers and symbols for letters. For example, “how much wood would a woodchuck chuck?” might be Hmww1wcc? (Don’t use that one!)  

Many smartphones, including both Apple and Android phones, provide lock or passcode tools in the “Settings” feature of their devices. Device manufacturers today offer advanced technologies like fingerprint sensors and “lock patterns” that can make it very difficult to access a stolen device.

General screen lock information:

• iPhones and iPads (iOS)

New Apple products protect devices with a thumbprint or a numeric passcode, or a combination of both.

From home screen, select SETTINGS, then TOUCH ID & PASSCODE. On older products, select SETTINGS, then GENERAL, then PASSCODE.  Follow instructions and remember to set how quickly you want the device to lock (one minute, five minutes, etc.)

More on Apple locks: www.support.apple.com/en-us/HT204060 

• Android devices

Depending on your type of device, Android allows you to use a pattern unlock, a personal identification number (PIN), or an alpha-numeric password. Though the language varies in different Android devices, you can generally follow this path:

Select MENU on the home screen. Select SETTINGS, then SECURITY, then CHANGE SCREEN LOCK.

Check the version of your Android device: www.support.google.com/nexus/answer/4457705

More on Android locks: www.support.google.com/nexus/answer/2819522?hl=en

For more information on strong passwords, please visit:  Safe Password Practices - Refresh Here!

3.     Freeze your credit files ($30) – or place a fraud alert (free).

Consumers who believe they may be victims of identity theft should consider freezing their credit files. A credit freeze is the strongest consumer protection against serious types of identity theft that involve Social Security numbers. It prevents the opening of new accounts but does not affect existing credit accounts. Credit freezes remain on accounts until the account holder temporarily or permanently lifts the freeze.

To activate a credit freeze, consumers must contact each of the three credit bureaus. Once the credit bureaus have frozen the requested credit records, a potential thief cannot open a credit account, get a loan, or do certain other things in the account holder’s name. Consumers who need to open a new credit account during the freeze can “lift” the freeze in advance for a limited period of time by contacting the credit bureau (sometimes for a small fee).

Credit freezes are free to victims of identity theft who have a corresponding police report.  Otherwise, freezes cost $10 per credit bureau.  For consumers 65 and older, each freeze is $5. For more information, please visit: How to “Freeze” Your Credit Files

An alternative to a freeze is a fraud alert. Consumers who are in the market for new credit, insurance, or employment may find a credit freeze cumbersome as the freeze must be lifted every time a request is made for new credit. Instead, consumers looking for new credit may want to consider placing a fraud alert on their accounts. Fraud alerts offer a free, fast, and effective way to protect against a potential identity thief opening new credit accounts under an account holder’s identity. A fraud alert signals to credit grantors that requests for new credit accounts or credit extensions may be coming from an identity thief and it requires merchants to take extra steps to verify the identity of the applicant. To place a fraud alert, consumers only need to contact one of the three credit bureaus, which will result in all three placing the alert. A fraud alert lasts 90 days and can be renewed.

For more information on fraud alerts, visit: Breach Help: Consumer Tips from the Attorney General

ADDITIONAL INFORMATION

California Attorney General identity theft information:  www.oag.ca.gov/idtheft

California Attorney General privacy information:  www.oag.ca.gov/privacy

Data Privacy Day: https://www.staysafeonline.org/data-privacy-day/about.

[1] Javelin Strategy & Research, 2015 Identity Fraud Study, available at www.javelinstrategy.com.

SACRAMENTO - Attorney General Kamala D. Harris and Placer County District Attorney R. Scott Owens today announced the arraignment of Riley Bangerter, 36, of Roseville, on 11 charges of identity theft, in a case of cyber harassment. Bangerter pled not guilty when he was arraigned on January 11, 2016.

Bangerter was arrested on December 3, 2015, following an investigation by Attorney General Harris’ eCrime Unit, which found that he had superimposed images of his ex-wife onto pornographic images and posted them online, accompanied by her personal identifying information.

“Bangerter’s heinous actions sought to humiliate, belittle and destroy the personal and professional life of his victim,” said Attorney General Harris.  “This prosecution sends a clear message to all who dare to perpetrate the crimes of cyber harassment and cyber exploitation, that these cowardly acts will not be tolerated in California.  I thank the Placer County District Attorney’s office for their partnership and commitment to holding Bangerter accountable for these deplorable acts.”

Bangerter is charged with identity theft – violating Penal Code section 530.5, which prohibits the misuse of personal identifying information.  The case is being prosecuted by the Placer County District Attorney’s office.

During her tenure, Attorney General Harris has pioneered the prosecution of cyber exploitation cases, successfully securing criminal convictions and sentences for those who post intimate photos or videos online without the consent of the individual depicted. 

In 2011, Attorney General Harris created the eCrime Unit within the California Department of Justice to identify and prosecute identity theft crimes, cybercrimes and other crimes involving the use of technology.  In April 2015, Attorney General Harris announced that Kevin Bollaert was sentenced to eighteen years of incarceration (a sentence later revised to eight years in prison followed by ten years of mandatory supervision) for operating a cyber exploitation website, ugotposted.com.  The site allowed the anonymous, public posting of nude or explicit photographs without the subject’s permission and also included the subject’s full name, location, age and Facebook profile link.  Bollaert also extorted victims, charging them $250 to $350 to remove the content posted without their permission.

In June 2015, Attorney General Harris announced a three-year jail sentence for Casey Meyering, who operated a cyber exploitation website called WinByState.com and an associated site TakedownHammer, where he extorted victims seeking to have their images removed.  Charles Evens, who hacked into email accounts to steal intimate images and then sold the images to cyber exploitation website operator Hunter Moore, pleaded guilty to hacking in June 2015.

Attorney General Harris convened a Cyber Exploitation Task Force in February 2015, a public-private partnership comprised of 50 major technology companies (including Microsoft, Google, Facebook, Yahoo, and Twitter), victims’ advocates, and legislative and law enforcement leaders.  In October 2015, Attorney General Harris and the task force unveiled a  first-of-its-kind online resource hub with tools for victims, the technology industry, and law enforcement agencies.

In September 2015, Governor Jerry Brown signed into law two new measures Attorney General Harris sponsored to combat and prevent cyber exploitation.  Senate Bill 676 (Cannella, R-Ceres) enables law enforcement to destroy cyber exploitation images and AB 1310 (Gatto, D-Glendale) allows search warrants to be issued for crimes related to cyber exploitation and allows for the prosecution of cyber exploitation cases in the county where the victim resides or in the county where the images were posted.

SAN FRANCISCO - Attorney General Kamala D. Harris and Alameda County District Attorney Nancy E. O’Malley today announced a settlement with Comcast Cable Communications LLC (“Comcast”) to resolve allegations that Comcast both unlawfully disposed of hazardous waste and discarded records without first omitting or redacting private customer information. As part of the settlement, Comcast will pay a total of $25.95 million. 

“Comcast’s careless and unlawful hazardous waste disposal practices jeopardized the health and environmental well-being of California communities and exposed their customers to the threat of identity theft,” said Attorney General Harris. “This agreement holds Comcast accountable for breaking the law and puts strict measures in place to prevent them from putting Californians and our environment at risk in the future.”

“Today’s settlement represents a victory in California’s ongoing efforts to ensure that hazardous waste is disposed of in a safe, legal and environmentally sustainable manner,” states Alameda County DA Nancy E. O’Malley. “Not only will my office pursue all necessary legal action against entities that pollute our environment, but we will also use all legal means to ensure California’s consumers’ private information is protected.  My office will continue to work together with state and local agencies to investigate and prosecute violations against our environment.”

The civil enforcement action and proposed settlement against Comcast were filed today in Alameda County Superior Court by Attorney General Harris and District Attorney O’Malley. The settlement requires court approval before it becomes final.

Today’s announcement stems from a robust investigation by the offices of Attorney General Harris and District Attorney O’Malley, assisted by the Department of Toxic Substances Control and the California Highway Patrol. According to the investigation, since 2005, Comcast warehouse and dispatch facilities and customer service centers throughout the state unlawfully handled and disposed of various hazardous waste products, routinely and systematically sending these materials to local landfills that were not permitted to receive these items. The majority of the hazardous waste was electronic equipment such as remote controls, splitters, routers, modems, amplifiers, and power adapters. The investigation also uncovered that Comcast discarded documents containing sensitive customer information, including names, addresses and phone numbers, into the trash without shredding them or making them unreadable, potentially exposing the information to identity thieves.

If approved by the court, under the final judgment, Comcast must pay $19.85 million in civil penalties and costs. An additional $3 million will fund projects furthering environmental and consumer protection and enforcement in California. Comcast will also be providing CalRecycle with $2.25 million in airtime over a four-year period and $150,000 to develop and produce public service announcements that educate the public on the proper handling and disposal of hazardous waste they might generate, including electronics. Finally, Comcast will spend a minimum of $700,000 to enhance its environmental compliance and will be prohibited from violating these laws in the future, under the terms of a permanent injunction.

Upon notice of the investigation, Comcast agreed to cooperate and, at the request of the Attorney General and the Alameda County DA, took interim steps to improve its hazardous and universal waste management compliance programs. As part of the settlement, Comcast has committed to fund multiple measures over the next five years to enhance its environmental compliance. Comcast will also be required to hire an independent auditor to conduct three audits of its environmental and customer privacy compliance over the next five years. There are ten Comcast facilities in Alameda County and all ten facilities are subject to the terms of the settlement.

Last year, Attorney General Harris and District Attorney O’Malley reached a $23.8 million settlement with AT&T over similar hazardous waste disposal violations.

Copies of the civil enforcement action and proposed settlement are attached to the online version of this release at oag.ca.gov/news.

SAN FRANCISCO - Attorney General Kamala D. Harris today released guidance on location privacy on smartphones, tablets, and email as part of National Cyber Security Awareness Month, a campaign to promote a safer, more secure, and more trusted Internet.

The Attorney General’s new information sheet, Location, Location, Location: Tips on Controlling Mobile Tracking, comes at a time when nearly two-thirds of Americans own a smartphone. In fact, it’s been reported that the average consumer is never more than three feet away from his or her phone.[1]

Connected devices are convenient, but they also pose unique privacy challenges. Our smartphones and tablets are “always on” and “always on us,” broadcasting where we are, where we have been, and even where we are going. This is a concern for many of us, and for domestic violence and stalking victims, it can be dangerous.

Location, Location, Location explains how to use system settings on Android and iOS devices to manage GPS and other location tracking functions.  The new information sheet also explains how email location tracking works and offers step-by–step instructions for stopping it in Gmail, Outlook, and Yahoo Mail.

Location, Location, Location can be found with Getting Smart About Smartphones, Breach Help, and a library of easy-to-read privacy materials on the Attorney General’s website at www.oag.ca.gov/privacy/info-sheets. 

Resources

Location, Location, Location: Tips on Controlling Mobile Tracking: https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/cis-18.pdf?

Getting Smart About Smartphones: Tips for Consumers 

English: www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/smartphones_consumers.pdf

Spanish: www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/CIS_15a_smartphonesConsumer_sp.pdf

Getting Smart About Smartphones: Tips for Parents

English: www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/smartphones_parents.pdf

Spanish: www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/CIS_15b_smartphonesParents_sp.pdf

National Cyber Security Awareness Month: www.staysafeonline.org/ncsam/

[1] www.getelastic.com/the-end-of-bricks-and-mortar-retail-as-we-know-it/