the california database security breach notification act requires entities to give written notice to california residents, with exceptions. which situation does not provide a sufficient cause for an entity to avoid providing written notices?