If you collect personal data from California citizens, you are expected to secure it. The problem is the law