BILL NUMBER: SB 1365 AMENDED
BILL TEXT
AMENDED IN SENATE MAY 8, 2000
AMENDED IN SENATE MAY 1, 2000
AMENDED IN SENATE APRIL 13, 2000
INTRODUCED BY Senator Murray
JANUARY 19, 2000
An act to add Title 1.81A (commencing with Section 1798.200) to
Part 4 of Division 3 of the Civil Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
SB 1365, as amended, Murray. Personal information: collection
and disclosure.
(1) Existing law, the Public Records Act, governs public access to
records maintained by state and local public agencies, as specified.
Existing law, the Information Practices Act of 1977, requires a
state agency, among other things, to maintain in its records only
that personal information, as defined, which is relevant and
necessary to its governmental purpose; to maintain its sources of
information; to maintain accurate, relevant, and complete records; to
disclose personal information only under specified circumstances; to
maintain records regarding the disclosure of personal information
and to allow individuals access to those records pertaining to them,
except as specified, to provide for the amendment of those records.
The act also establishes civil remedies for its enforcement.
Existing law also prohibits bookkeeping services from disclosing
records containing personal information or information regarding a
business entity without express written consent, and prohibits video
rental services from disclosing personal information without express
written consent, except as specified; and provides for civil actions
to enforce these provisions.
Existing law also regulates the activities of consumer credit
reporting agencies, users of consumer credit reports, and furnishers
of consumer credit information, and establishes civil remedies for
enforcement.
Existing law also makes the unauthorized use of personal
identifying information to obtain credit, goods, services, or medical
information in the name of another person a crime, punishable as
specified.
This bill would enact various provisions regarding the protection
of privacy; define various terms; make violations of specified
provisions of the bill a misdemeanor or a felony, punishable as
specified; prohibit disclosure of personal information for marketing
purposes upon receipt of specified notice from an individual, except
as specified, and require specified disclosures to victims of
identity theft; prohibit waiver of the rights created by the bill,
except as specified; provide a cause of action for violation of the
bill and provide for civil enforcement of its provisions; and provide
that the provisions of the bill are severable.
The bill would impose a state-mandated local program by creating a
new crime.
(2) The California Constitution requires the state to reimburse
local agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that no reimbursement is required by this
act for a specified reason.
Vote: majority. Appropriation: no. Fiscal committee: yes.
State-mandated local program: yes.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Title 1.81A (commencing with Section 1798.200) is added
to Part 4 of Division 3 of the Civil Code, to read:
TITLE 1.81A PRIVACY PROTECTION
1798.200. (a) "Personal information" means any data or
information pertaining to a person that could be used to violate
Section 530.5 of the Penal Code or this title. It includes a social
security number or any information describing or setting forth a
person's income, assets, liabilities, purchases, leases, or rentals
of goods, services, or real property if such information was
disclosed, is disclosed, or is intended to be disclosed, with any
identifying information, such as name, address, phone number, date of
birth, or age.
(b) "Victim" or "victim of identity theft" means any natural
person who is a California resident, who files a materially complete
police report with a law enforcement agency claiming a violation of
Section 530.5 of the Penal Code.
(c) "Direct marketing purposes" means the purchase, sale, lease,
exchange, or rental of personal information for anything of value
where the individual, firm, partnership, corporation, or association
disclosing to third parties the personal information in its
possession, custody, or control knows or reasonably should know that
such personal information will be used for marketing or advertisement
of products, goods, or services directly to consumers, through, but
not limited to, the United States mails, over the telephone, or
through electronic mail.
"Direct marketing purposes" does not include any of the following:
(1) Disclosures to bona fide tax exempt charitable or religious
organizations of such personal information required to solicit
charitable contributions.
(2) Disclosures required to raise funds from and communicate with
individuals regarding issues of politics and government.
(3) Disclosures of public record information obtained from a
governmental agency or derived from a public record, as defined in
Section 6252 of the Government Code.
(d) "Disclose" means the act of an individual, firm, partnership,
corporation, or association of disclosing, releasing, selling,
leasing, exchanging, or renting for anything of value personal
information about a victim of identity theft in its possession,
custody, or control to a different individual, firm, partnership,
corporation, or association, or any third party, for direct marketing
purposes. "Disclose" does not include any of the following:
(1) The exchange of information preempted by paragraph (2) of
subdivision (b) of Section 1681t of Title 15 of the United States
Code.
(2) Personal information provided to a third party pursuant to
contracts or arrangements pertaining solely to any of the following:
(A) The storage, management, or organization of personal
information, where the personal information is not disclosed to third
parties.
(B) The creation or distribution of marketing or advertising
materials for products or services to be offered by an individual,
firm, partnership, corporation, or association to its current
customers or members.
(C) Completing a transaction not otherwise in violation of law
between the individual, firm, partnership, corporation, association,
or government agency in the lawful possession, custody, or control of
the personal information and its current members or customers, or a
transaction involving a new member or customer where the new member
or customer has initiated the transaction.
(3) Disclosures by an individual, firm, partnership, corporation,
or association of payment history or other information pertaining to
transactions or experiences between it and an individual, together
with identifying information, to a consumer reporting agency where
those transactions or experiences, together with identifying
information, is then defined as a consumer report in subdivision (d)
of Section 1681a of Title 15 of the United States Code and such use
is limited by the federal Fair Credit Reporting Act.
(e) "Third party or parties" means an individual, firm,
partnership, corporation, or association that either is not owned
(i.e. more than 50 percent of ownership) or not controlled by the
individual, firm, partnership, corporation, or association that has
duties and obligations that arise under this title, has a chief
executive officer or corporate president that differs from the chief
executive officer or corporate president of the individual, firm,
partnership, corporation, or association that has duties and
obligations that arise under this title; or is a separate legal
entity from the individual, firm, partnership, corporation, or
association that has duties and obligations that arise under this
title. "Third parties," when applied to government agencies, means
any agency that is funded by its own appropriation distinct from an
agency that has duties and obligations that arise under this title,
or which has statutory or other legally imposed duties that differ
from an agency that has duties and obligations that arise under this
title.
1798.205. (a) Upon the receipt of a written notice from a victim
of identity theft that he or she is a victim, receipt of a copy of a
police report filed by the victim pursuant to Section 530.5 of the
Penal Code, and a written request from the victim, no individual,
firm, partnership, corporation, or association shall disclose
personal information about the victim in its possession, custody or
control to third parties for direct marketing purposes. The
individual, firm, partnership, corporation, or association that
receives such correspondence from a victim shall in writing within 30
days from the receipt of such correspondence confirm the receipt of
such correspondence, its compliance or the steps it is taking to
ensure compliance, and an explanation in plain language in at least
twelve-point, boldfaced type of the victim's rights under subdivision
(c).
(b) A victim who has previously provided the notice, the copy of a
police report and the request specified under subdivision (a) may
thereafter consent to disclosures of personal information about the
victim to third parties for direct marketing purposes. However,
consent may be obtained only through a letter to the victim
consisting solely of the request for consent, where the letter
clearly and conspicuously, in at least twelve-point, boldfaced type,
informs the victim that he or she has the right to refuse to consent
and that in writing without any cost or
penalty whatsoever , except as provided by subdivision (c) of
Section 1798.207, and that the individual, firm,
partnership, corporation, or association sending the request for
consent may not lawfully condition the sale of any product or service
or anything of value upon the victim consenting to such
disclosures. A victim may in writing revoke consent at any time in
the victim's sole discretion without any cost or penalty whatsoever.
consenting to such disclosures.
(c) Upon the receipt of a written notice from a victim of identity
theft that he or she is a victim, a copy of a police report filed by
the victim pursuant to Section 530.5 of the Penal Code, and a
written request from the victim, not more than twice a year
thereafter, every individual, firm, partnership, corporation, or
association, or any of them, that intends to, has within the previous
12 months, or is disclosing personal information to third parties
for direct marketing purposes, shall provide all the following
information in its possession, custody, or control to the victim free
of charge:
(1) In writing, the source from whom or which the information was
purchased or otherwise obtained or, if the source cannot be
reconstructed from currently available data, a list of the likely
sources of the personal information that has been disclosed during
the 12-month period prior to receiving the victim's request, is being
disclosed, or is to be disclosed to third parties for direct
marketing purposes (including the source's name and address). For
the purposes of this paragraph, source or sources shall include
public record sources, notwithstanding subdivision (c) of Section
1798.202.
(2) True and correct copies of the personal information about the
victim that was, is, or will be disclosed to third parties for direct
marketing purposes in the possession, custody or control of the
individual, firm, partnership, corporation, association or government
agency at the time the victim's request is received. The
individual, firm, partnership, corporation, association, or
government agency that receives such a request from a victim shall
within 30 days from the receipt of such correspondence confirm both
the receipt of such a request and its compliance in writing.
(3) An explanation in plain language in at least 12-point,
boldfaced type of the victim's rights (A) under subdivisions (a) and
(b) of this section; and (B) under paragraph (5) of subdivision (a)
of Section 1681g of Title 15 of the United States Code to obtain a
list of all entities to whom consumer reporting agencies have
disclosed prescreened consumer reports during the preceding year.
(d) Upon receipt of the request and information from a victim
required by subdivision (a), a consumer credit reporting agency as
defined under subdivision (d) of Section 1785.3, shall notify the
victim of his or her rights under this subdivision and comply with
its obligations under the federal Fair Credit Reporting Act,
including disclosing to a victim all recipients within the previous
12 months of personal information used for making direct marketing
firm offers of credit.
(e) Every individual, firm, partnership, corporation, or
association that intends to, has, or does disclose personal
information to third parties for direct marketing purposes shall
complete development and implementation of reasonable procedures to
ensure compliance with this section and reasonable steps to help
confirm the identity of the victim submitting the police report.
(f) The duties and obligations required by subdivisions (a), (c),
and (e) shall commence no later than November 8, 2001.
1798.207. (a) Except as provided in subdivision (c), no
individual, firm, partnership, corporation, or association shall
condition the sale of goods, services, or other things of value on
the condition that a victim consent to the disclosure of personal
information to third parties for direct marketing purposes, or waive
any provision of, right conferred by, or obligation imposed by this
title. Any waiver of the provisions, rights, or obligations of this
title, the right to seek enforcement of or damages under this title
in a court of law, or any agreement to convey a property interest in
personal information in a manner that would conflict with the
provisions of this title, is against a fundamental public policy of
this state, will result in public harm to all Californians, and is
unenforceable and void.
(b) Where a victim requests an individual, firm, partnership,
corporation, association or government agency that provides a
subscription or membership arrangement under which the victim has
given prior express request or consent to the disclosure of personal
information to third parties for direct marketing purposes in
exchange for special subscription or membership benefits, such as
free Internet service, to cease disclosing his or her personal
information to third parties for direct marketing purposes pursuant
to this title, the individual, firm, partnership, corporation,
association or government agency may terminate the arrangement.
Every such termination shall be effectuated by a notice to the victim
where such notice shall inform the victim of his or her rights under
subdivision (b) of Section 1798.205.
1798.208. (a) An individual, other than the victim of identity
theft as defined pursuant to subdivision (b) of Section 1798.202 and
his or her minor children, who willfully and intentionally discloses
personal information about that victim of identity theft is, upon
conviction therefor, guilty of a felony or misdemeanor, punishable by
imprisonment in the state prison for two or three years, or in a
county jail not to exceed one year, or by a fine not exceeding
twenty-five thousand dollars ($25,000), or by both the fine and
imprisonment.
(b) Any person may seek enforcement of this title and obtain
equitable remedies in a court of law. Only persons harmed by a
violation of this title may seek damages in a court of law for any
violation thereof. A prevailing plaintiff in either case shall be
awarded his or her reasonable attorneys' fees by the court. Any
defendant in any action brought under this title may assert as a
complete defense that the conduct giving rise to the action was
willfully and purposefully obtained, used, or disclosed by a person
or persons who are not employed by or agents of the defendant, or was
willfully and purposely obtained, used, or disclosed by a person or
persons who are employees or agents of the defendant, in a manner
that violates the defendant's terms or conditions or other
contractual obligations for the use of personal information. The
rights and remedies in this title are cumulative of each other and
any otherwise provided by law.
1798.209. The provisions of this title are severable. If any
provision of this title is declared unlawful, such invalidity shall
not affect the other provisions of this title. It is further the
intent of the Legislature that this title be construed to provide the
broadest protections for victims and consumers possible in light of
federal law and that a court may therefore interpret the provisions
of this title to serve this intent.
SEC. 2. No reimbursement is required by this act pursuant to
Section 6 of Article XIIIB of the California Constitution because the
only costs that may be incurred by a local agency or school district
will be incurred because this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the Government
Code, or changes the definition of a crime within the meaning of
Section 6 of Article XIIIB of the California Constitution.