Reasonable security

California requires covered businesses holding residents' personal information to maintain security appropriate to it.