Hacker News Reader

Comment by CaliforniaKarl | Hacker News Reader

Does US federal or California law mandate that breach notifications be sent by postal mail? If not, then I wouldn’t be surprised if Comcast sends any/all notifications to people’s Comcast email addresses. That’ll be a good way to bury the notification, since I doubt many people check or forward their Comcast email.

View on HN

Actual legal text on CA data breach law from the following link. Notification requirements are near the bottom, starting with the section labeled "(j) For purposes of this section, “notice” may be provided by one of the following methods:"

https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

Email notice is an option if meeting the restrictions listed in the Federal law linked below. I think the relevant part is section (c), with the major restriction being "affirmative consent."

https://www.law.cornell.edu/uscode/text/15/7001

Alternatively if the breach affects over half a million people, they can send notifications by email, but also have to plaster their homepage and send "Notification to major statewide media." The homepage banner would only affect people who pay electronically but not by autopay. There are ways to minimize the effect of news broadcast, e.g. send the press release at 4 o'clock on a Friday when no one watches the news.

So, it's not quite as easy as you think but Comcast does have options to minimize the impact of notification.

To be fair, I dont read physical mail from Comcast either. I'm constantly flooded with junkmail from them.

Reply on news.ycombinator.com