California law requires notification in "the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system."

This sounds like something well, well beyond that. So as far as I'm concerned, the new CEO seems like nearly as much of as scofflaw as the old.

[1] http://leginfo.legislature.ca.gov/faces/codes_displaySection...