California Assembly Bill AB1442 Amended / Bill

 BILL NUMBER: AB 1442AMENDED BILL TEXT AMENDED IN ASSEMBLY MARCH 25, 2014 INTRODUCED BY Assembly Member Gatto JANUARY 6, 2014 An act to amend Sections 1798.3, 1798.14,  1798.17, 1798.18,   and  1798.19  , and 1798.53  of the Civil Code, relating to the Information Practices Act of 1977. LEGISLATIVE COUNSEL'S DIGEST AB 1442, as amended, Gatto. The Information Practices Act of 1977: local government. The Information Practices Act of 1977  prescribes requirements on state agencies for the maintenance of personal information, as defined, and restricts a state agency from disclosing personal information contained in its records, as specified. The act  requires each  state  agency to maintain in its records only personal information that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government.  The act makes a person who willfully requests or obtains a record from an agency under false pretenses or who intentionally discloses specific information under certain circumstances guilty of a misdemeanor. The act provides that an intentional violation of its provisions by an officer or employee of an agency constitutes cause for discipline, including termination of employment. The act also provides a civil action against an agency for specified failures under the act. The act prohibits an individual' s name and address from being distributed for commercial purposes, as specified, unless specifically authorized by law.   This bill would expand the definition of "agency" to include local governmental entities.   The   This  bill would  generally require an agency   expand that restriction on the maintenance of personal information to apply to a local agency, and would require a state or local agency  to destroy personal information  maintained in accordance with the act  when the  state or local  agency determines  the personal information   it  is no longer relevant and necessary to accomplish its purpose. The bill would establish special provisions for a Kindergarten and grades 1 to 12, inclusive, school district regarding  the notification of students, parents, and guardians if it   considers a program to gather or maintain student personal information in its records, restrictions on the gathering and maintenance of  information  gathered from social media, as defined, and the  destruction  and parental notification for   of  personal information  gathered from social media  on students maintained by the district. By expanding the duties of local  officials and expanding the definition of a crime,   officials,  this bill would impose a state-mandated local program.  The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.   This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason.   With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.   The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.   This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to these statutory provisions.  Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 1798.3 of the Civil Code is amended to read: 1798.3. As used in this chapter: (a)  The term "personal   "Personal  information" means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual. (b)  The term "agency"   "Agency"    means every state  or local  office, officer, department, division, bureau, board, commission, or other state  or local  agency, except that  the term agency   "agency   "  shall not include: (1) The California Legislature. (2) Any agency established under Article VI of the California Constitution. (3) The State Compensation Insurance Fund, except as to any records  which   that  contain personal information about the employees of the State Compensation Insurance Fund.  (4) A local agency, as defined in subdivision (a) of Section 6252 of the Government Code.  (c)  The term "disclose"   "Disclose"  means to disclose, release, transfer, disseminate, or otherwise communicate all or any part of any record orally, in writing, or by electronic or any other means to any person or entity. (d)  The term "individual"   "Individual"  means a natural person. (e)  The term "maintain"   "Maintain"  includes maintain, acquire, use, or disclose. (f)  The term "person"   "Person"    means any natural person, corporation, partnership, limited liability company, firm, or association. (g)  The term "record"   "Record"  means any file or grouping of information about an individual that is maintained by an agency by reference to an identifying particular such as the individual's name, photograph, finger or voiceprint, or a number or symbol assigned to the individual. (h)  The term "system   "System  of records" means one or more records, which pertain to one or more individuals, which is maintained by any agency, from which information is retrieved by the name of an individual or by some identifying number,  symbol   symbol,  or other identifying particular assigned to the individual. (i)  The term "governmental   "Governmental  entity," except as used in Section 1798.26, means any branch of the federal government or of the local government. (j)  The term "commercial   "Commercial    purpose" means any purpose which has financial gain as a major objective. It does not include the gathering or dissemination of newsworthy facts by a publisher or broadcaster. (k)  The term "regulatory   "Regulatory  agency" means the Department of Business Oversight, the Department of Insurance, the Bureau of Real Estate, and agencies of the United States or of any other state responsible for regulating financial institutions.  (l) "Social media" means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.  SEC. 2. Section 1798.14 of the Civil Code is amended to read: 1798.14. (a)  Nothwithstanding the exception established in paragraph (4) of subdivision (b) of Section 1798.3, as used in this section, "agency" includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.   (b)     (1)    Each agency shall maintain in its records only personal information that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution, statute, ordinance, or mandated by the federal government, and, except as provided in  subdivision (b),   subdivisions (c) and (d),  shall destroy the personal information when the agency determines the personal information is no longer relevant and necessary to accomplish that purpose.  (2) This subdivision does not apply to official records recorded in the office of a county recorder.   (c) A school district for kindergarten or grades 1 to 12, inclusive, that considers a program to gather or maintain in its records personal information on any student enrolled in the school district shall notify students, parents, and guardians and provide an opportunity for public comment prior to the adoption of such a program.   (b)   (d)  A school district for kindergarten or grades 1 to 12, inclusive, that gathers  and maintains   or maintains, or that contracts to gather or maintain  in its records personal information  gathered from social media  on a student enrolled in the school district  in  shall do the following:  (1) Gather or maintain only information that was made publicly accessible, not to include either:   (A) Information that was reposted or otherwise made available by another party without the express consent of the original author.   (B) Any secondary information, including, but not limited to, geolocation information, derived from content posted to social media, unless that secondary information itself intentionally was made publicly accessible.   (2) Provide students with access to any personal information about the student gathered or maintained by the district and obtained through social media, and the opportunity to correct or delete erroneous information or information gathered or maintained in violation of paragraph (1).   (1)   (3)  Destroy personal information  gathered from social media  maintained in its records within one year of a student turning 18 years of age, or within one year after the student is no longer enrolled in the school district, whichever is first.  (2)   (4)  Notify each parent or guardian of the student that personal information is being gathered  from social media  and that any information maintained in its records with regard to the student shall be destroyed in accordance with paragraph  (1).   (3).   (5) If the school district contracts with a third party to gather or maintain in the records of the third party personal information on a student enrolled in the school district, require the third party to hold all student personal information strictly confidential and prohibit it from using that information for its own purposes, selling the information, or sharing the information with any other entity unless required to do so by law.   SEC. 3.   Section 1798.17 of the Civil Code is amended to read: 1798.17. Each agency shall provide on or with any form used to collect personal information from individuals the notice specified in this section. When contact with the individual is of a regularly recurring nature, an initial notice followed by a periodic notice of not more than one-year intervals shall satisfy this requirement. This requirement is also satisfied by notification to individuals of the availability of the notice in annual tax-related pamphlets or booklets provided for them. The notice shall include all of the following: (a) The name of the agency and the division within the agency that is requesting the information. (b) The title, business address, and telephone number of the agency official who is responsible for the system of records and who shall, upon request, inform an individual regarding the location of his or her records and the categories of any persons who use the information in those records. (c) The authority, whether granted by statute, regulation, executive order, or ordinance that authorizes the maintenance of the information. (d) With respect to each item of information, whether submission of such information is mandatory or voluntary. (e) The consequences, if any, of not providing all or any part of the requested information. (f) The principal purpose or purposes within the agency for which the information is to be used. (g) Any known or foreseeable disclosures that may be made of the information pursuant to subdivision (e) or (f) of Section 1798.24. (h) The individual's right of access to records containing personal information that are maintained by the agency. This section does not apply to any enforcement document issued by an employee of a law enforcement agency in the performance of his or her duties wherein the violator is provided an exact copy of the document, or to accident reports whereby the parties of interest may obtain a copy of the report pursuant to Section 20012 of the Vehicle Code. The notice required by this section does not apply to agency requirements for an individual to provide his or her name, identifying number, photograph, address, or similar identifying information, if this information is used only for the purpose of identification and communication with the individual by the agency, except that requirements for an individual's social security number shall conform with the provisions of the federal Privacy Act of 1974 (Public Law 93-579).   SEC. 4.   Section 1798.18 of the Civil Code is amended to read: 1798.18. (a) Each agency shall maintain all records, to the maximum extent possible, with accuracy, relevance, timeliness, and completeness. (b) That standard need not be met except when those records are used to make any determination about the individual. When an agency transfers a record outside of state or local government, it shall correct, update, withhold, or delete any portion of the record that it knows or has reason to believe is inaccurate or untimely.   SEC. 5.   SEC. 3.  Section 1798.19 of the Civil Code is amended to read: 1798.19. Each agency, when it provides by contract for the operation or maintenance of records containing personal information to accomplish an agency function, shall cause, consistent with its authority,  the requirements of  this chapter to be applied to those records. For purposes of Article 10 (commencing with Section 1798.55), any contractor and any employee of the contractor, if the contract is agreed to on or after July 1, 1978, shall be considered to be an employee of an agency.  Except as provided in Section 1798.14, local government functions mandated by the state are not deemed agency functions within the meaning of this section.   SEC. 6.   Section 1798.53 of the Civil Code is amended to read: 1798.53. (a) Any person, other than an employee of the state or of a local government agency acting solely in his or her official capacity, who intentionally discloses information, not otherwise public, which they know or should reasonably know was obtained from personal information maintained by an agency or from "records" within a "system of records" (as these terms are defined in the federal Privacy Act of 1974 (5 U.S.C. Sec. 552a)) maintained by a federal government agency, shall be subject to a civil action, for invasion of privacy, by the individual to whom the information pertains. (b) In any successful action brought under this section, the complainant, in addition to any special or general damages awarded, shall be awarded a minimum of two thousand five hundred dollars ($2,500) in exemplary damages as well as attorney's fees and other litigation costs reasonably incurred in the suit. (c) The right, remedy, and cause of action set forth in this section shall be nonexclusive and is in addition to all other rights, remedies, and causes of action for invasion of privacy, inherent in Section 1 of Article I of the California Constitution.   SEC. 7.   No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution for certain costs that may be incurred by a local agency or school district because, in that regard, this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution. However, if the Commission on State Mandates determines that this act contains other costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.   SEC. 4.   If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.