Amended IN Senate June 21, 2019 Amended IN Assembly May 16, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 1202Introduced by Assembly Member ChauFebruary 21, 2019 An act to add Title 1.81.48 (commencing with Section 1798.99.80) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 1202, as amended, Chau. Privacy: data brokers.The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified. Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared. This bill would require data brokers to register with, and provide certain information to, the Attorney General. The bill would define a data broker as a business that knowingly collects and sells to 3rd parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. The bill would require the Attorney General to make the information provided by data brokers accessible on its internet website. The bill would make data brokers that fail to register subject to injunction and liability for civil penalties, fees, and costs in an action brought by the Attorney General, with any recovery to be deposited in the Consumer Privacy Fund, as specified. The bill would make statements of legislative findings and declarations and legislative intent.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. The Legislature finds and declares all of the following:(a) In 1972, California voters amended the California Constitution to include the right of privacy among the inalienable rights of all people. The amendment established a legal and enforceable right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.(b) Since California voters approved the right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, Shine the Light, and as of last year, the California Consumer Privacy Act of 2018, which gives Californians the ability to better control the personal information that is collected and sold about them.(c) While many different types of businesses collect data about consumers, a data broker is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship.(d) A data broker collects many hundreds or thousands of data points about consumers from multiple sources, including: internet browsing history, online purchases, public records, location data, loyalty programs, and subscription information. The data broker then analyzes the data to assess content and packages the data for sale to a third party.(e) Data brokers may provide information that can be beneficial to services that are offered in the modern economy, including credit reporting, background checks, government services, risk mitigation and fraud detection, banking, insurance, and ancestry research, as well as helping to make determinations about whether to provide these services.(f) While data brokers may offer benefits, they also create risks that are associated with the widespread aggregation and sale of data about consumers, including risks related to the inability of consumers to know and control information held and sold about them and risks arising from the unauthorized or harmful acquisition and use of consumer information.(g) There are important differences between data brokers and businesses with whom consumers have a direct relationship. Consumers who have a direct relationship with traditional and e-commerce businesses may have some level of knowledge about and control over the collection of data by those businesses, including: the choice to use the businesss products or services, the ability to review and consider data collection policies, the ability to opt out of certain data collection practices, the ability to identify and contact customer representatives, and the knowledge necessary to complain to law enforcement.(h) By contrast, consumers are generally not aware that data brokers possess their personal information, how to exercise their right to opt out, and whether they can have their information deleted, as provided by California law.(i) People desire privacy and more control over their information. California residents should be able to exercise control over their personal information and be certain that there are safeguards against misuse of their personal information. It is possible for businesses both to respect consumers privacy and provide a high level of transparency regarding their business practices.(j) Therefore, it is the intent of the Legislature to further Californians right to privacy by giving consumers an additional tool to help control the collection and sale of their personal information by requiring data brokers to register annually with the Attorney General and provide information about how consumers may opt out of the sale of their personal information. SEC. 2. Title 1.81.48 (commencing with Section 1798.99.80) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.48. Data Broker Registration1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.SEC. 3. It is the intent of the Legislature that this act shall not be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
Amended IN Senate June 21, 2019 Amended IN Assembly May 16, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 1202Introduced by Assembly Member ChauFebruary 21, 2019 An act to add Title 1.81.48 (commencing with Section 1798.99.80) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 1202, as amended, Chau. Privacy: data brokers.The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified. Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared. This bill would require data brokers to register with, and provide certain information to, the Attorney General. The bill would define a data broker as a business that knowingly collects and sells to 3rd parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. The bill would require the Attorney General to make the information provided by data brokers accessible on its internet website. The bill would make data brokers that fail to register subject to injunction and liability for civil penalties, fees, and costs in an action brought by the Attorney General, with any recovery to be deposited in the Consumer Privacy Fund, as specified. The bill would make statements of legislative findings and declarations and legislative intent.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO
Amended IN Senate June 21, 2019 Amended IN Assembly May 16, 2019
Amended IN Senate June 21, 2019
Amended IN Assembly May 16, 2019
CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION
Assembly Bill No. 1202
Introduced by Assembly Member ChauFebruary 21, 2019
Introduced by Assembly Member Chau
February 21, 2019
An act to add Title 1.81.48 (commencing with Section 1798.99.80) to Part 4 of Division 3 of the Civil Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
AB 1202, as amended, Chau. Privacy: data brokers.
The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified. Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared. This bill would require data brokers to register with, and provide certain information to, the Attorney General. The bill would define a data broker as a business that knowingly collects and sells to 3rd parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. The bill would require the Attorney General to make the information provided by data brokers accessible on its internet website. The bill would make data brokers that fail to register subject to injunction and liability for civil penalties, fees, and costs in an action brought by the Attorney General, with any recovery to be deposited in the Consumer Privacy Fund, as specified. The bill would make statements of legislative findings and declarations and legislative intent.
The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified. Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared.
This bill would require data brokers to register with, and provide certain information to, the Attorney General. The bill would define a data broker as a business that knowingly collects and sells to 3rd parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. The bill would require the Attorney General to make the information provided by data brokers accessible on its internet website. The bill would make data brokers that fail to register subject to injunction and liability for civil penalties, fees, and costs in an action brought by the Attorney General, with any recovery to be deposited in the Consumer Privacy Fund, as specified. The bill would make statements of legislative findings and declarations and legislative intent.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1. The Legislature finds and declares all of the following:(a) In 1972, California voters amended the California Constitution to include the right of privacy among the inalienable rights of all people. The amendment established a legal and enforceable right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.(b) Since California voters approved the right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, Shine the Light, and as of last year, the California Consumer Privacy Act of 2018, which gives Californians the ability to better control the personal information that is collected and sold about them.(c) While many different types of businesses collect data about consumers, a data broker is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship.(d) A data broker collects many hundreds or thousands of data points about consumers from multiple sources, including: internet browsing history, online purchases, public records, location data, loyalty programs, and subscription information. The data broker then analyzes the data to assess content and packages the data for sale to a third party.(e) Data brokers may provide information that can be beneficial to services that are offered in the modern economy, including credit reporting, background checks, government services, risk mitigation and fraud detection, banking, insurance, and ancestry research, as well as helping to make determinations about whether to provide these services.(f) While data brokers may offer benefits, they also create risks that are associated with the widespread aggregation and sale of data about consumers, including risks related to the inability of consumers to know and control information held and sold about them and risks arising from the unauthorized or harmful acquisition and use of consumer information.(g) There are important differences between data brokers and businesses with whom consumers have a direct relationship. Consumers who have a direct relationship with traditional and e-commerce businesses may have some level of knowledge about and control over the collection of data by those businesses, including: the choice to use the businesss products or services, the ability to review and consider data collection policies, the ability to opt out of certain data collection practices, the ability to identify and contact customer representatives, and the knowledge necessary to complain to law enforcement.(h) By contrast, consumers are generally not aware that data brokers possess their personal information, how to exercise their right to opt out, and whether they can have their information deleted, as provided by California law.(i) People desire privacy and more control over their information. California residents should be able to exercise control over their personal information and be certain that there are safeguards against misuse of their personal information. It is possible for businesses both to respect consumers privacy and provide a high level of transparency regarding their business practices.(j) Therefore, it is the intent of the Legislature to further Californians right to privacy by giving consumers an additional tool to help control the collection and sale of their personal information by requiring data brokers to register annually with the Attorney General and provide information about how consumers may opt out of the sale of their personal information. SEC. 2. Title 1.81.48 (commencing with Section 1798.99.80) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.48. Data Broker Registration1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.SEC. 3. It is the intent of the Legislature that this act shall not be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
SECTION 1. The Legislature finds and declares all of the following:(a) In 1972, California voters amended the California Constitution to include the right of privacy among the inalienable rights of all people. The amendment established a legal and enforceable right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.(b) Since California voters approved the right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, Shine the Light, and as of last year, the California Consumer Privacy Act of 2018, which gives Californians the ability to better control the personal information that is collected and sold about them.(c) While many different types of businesses collect data about consumers, a data broker is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship.(d) A data broker collects many hundreds or thousands of data points about consumers from multiple sources, including: internet browsing history, online purchases, public records, location data, loyalty programs, and subscription information. The data broker then analyzes the data to assess content and packages the data for sale to a third party.(e) Data brokers may provide information that can be beneficial to services that are offered in the modern economy, including credit reporting, background checks, government services, risk mitigation and fraud detection, banking, insurance, and ancestry research, as well as helping to make determinations about whether to provide these services.(f) While data brokers may offer benefits, they also create risks that are associated with the widespread aggregation and sale of data about consumers, including risks related to the inability of consumers to know and control information held and sold about them and risks arising from the unauthorized or harmful acquisition and use of consumer information.(g) There are important differences between data brokers and businesses with whom consumers have a direct relationship. Consumers who have a direct relationship with traditional and e-commerce businesses may have some level of knowledge about and control over the collection of data by those businesses, including: the choice to use the businesss products or services, the ability to review and consider data collection policies, the ability to opt out of certain data collection practices, the ability to identify and contact customer representatives, and the knowledge necessary to complain to law enforcement.(h) By contrast, consumers are generally not aware that data brokers possess their personal information, how to exercise their right to opt out, and whether they can have their information deleted, as provided by California law.(i) People desire privacy and more control over their information. California residents should be able to exercise control over their personal information and be certain that there are safeguards against misuse of their personal information. It is possible for businesses both to respect consumers privacy and provide a high level of transparency regarding their business practices.(j) Therefore, it is the intent of the Legislature to further Californians right to privacy by giving consumers an additional tool to help control the collection and sale of their personal information by requiring data brokers to register annually with the Attorney General and provide information about how consumers may opt out of the sale of their personal information.
SECTION 1. The Legislature finds and declares all of the following:(a) In 1972, California voters amended the California Constitution to include the right of privacy among the inalienable rights of all people. The amendment established a legal and enforceable right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.(b) Since California voters approved the right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, Shine the Light, and as of last year, the California Consumer Privacy Act of 2018, which gives Californians the ability to better control the personal information that is collected and sold about them.(c) While many different types of businesses collect data about consumers, a data broker is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship.(d) A data broker collects many hundreds or thousands of data points about consumers from multiple sources, including: internet browsing history, online purchases, public records, location data, loyalty programs, and subscription information. The data broker then analyzes the data to assess content and packages the data for sale to a third party.(e) Data brokers may provide information that can be beneficial to services that are offered in the modern economy, including credit reporting, background checks, government services, risk mitigation and fraud detection, banking, insurance, and ancestry research, as well as helping to make determinations about whether to provide these services.(f) While data brokers may offer benefits, they also create risks that are associated with the widespread aggregation and sale of data about consumers, including risks related to the inability of consumers to know and control information held and sold about them and risks arising from the unauthorized or harmful acquisition and use of consumer information.(g) There are important differences between data brokers and businesses with whom consumers have a direct relationship. Consumers who have a direct relationship with traditional and e-commerce businesses may have some level of knowledge about and control over the collection of data by those businesses, including: the choice to use the businesss products or services, the ability to review and consider data collection policies, the ability to opt out of certain data collection practices, the ability to identify and contact customer representatives, and the knowledge necessary to complain to law enforcement.(h) By contrast, consumers are generally not aware that data brokers possess their personal information, how to exercise their right to opt out, and whether they can have their information deleted, as provided by California law.(i) People desire privacy and more control over their information. California residents should be able to exercise control over their personal information and be certain that there are safeguards against misuse of their personal information. It is possible for businesses both to respect consumers privacy and provide a high level of transparency regarding their business practices.(j) Therefore, it is the intent of the Legislature to further Californians right to privacy by giving consumers an additional tool to help control the collection and sale of their personal information by requiring data brokers to register annually with the Attorney General and provide information about how consumers may opt out of the sale of their personal information.
SECTION 1. The Legislature finds and declares all of the following:
### SECTION 1.
(a) In 1972, California voters amended the California Constitution to include the right of privacy among the inalienable rights of all people. The amendment established a legal and enforceable right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information.
(b) Since California voters approved the right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, Shine the Light, and as of last year, the California Consumer Privacy Act of 2018, which gives Californians the ability to better control the personal information that is collected and sold about them.
(c) While many different types of businesses collect data about consumers, a data broker is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship.
(d) A data broker collects many hundreds or thousands of data points about consumers from multiple sources, including: internet browsing history, online purchases, public records, location data, loyalty programs, and subscription information. The data broker then analyzes the data to assess content and packages the data for sale to a third party.
(e) Data brokers may provide information that can be beneficial to services that are offered in the modern economy, including credit reporting, background checks, government services, risk mitigation and fraud detection, banking, insurance, and ancestry research, as well as helping to make determinations about whether to provide these services.
(f) While data brokers may offer benefits, they also create risks that are associated with the widespread aggregation and sale of data about consumers, including risks related to the inability of consumers to know and control information held and sold about them and risks arising from the unauthorized or harmful acquisition and use of consumer information.
(g) There are important differences between data brokers and businesses with whom consumers have a direct relationship. Consumers who have a direct relationship with traditional and e-commerce businesses may have some level of knowledge about and control over the collection of data by those businesses, including: the choice to use the businesss products or services, the ability to review and consider data collection policies, the ability to opt out of certain data collection practices, the ability to identify and contact customer representatives, and the knowledge necessary to complain to law enforcement.
(h) By contrast, consumers are generally not aware that data brokers possess their personal information, how to exercise their right to opt out, and whether they can have their information deleted, as provided by California law.
(i) People desire privacy and more control over their information. California residents should be able to exercise control over their personal information and be certain that there are safeguards against misuse of their personal information. It is possible for businesses both to respect consumers privacy and provide a high level of transparency regarding their business practices.
(j) Therefore, it is the intent of the Legislature to further Californians right to privacy by giving consumers an additional tool to help control the collection and sale of their personal information by requiring data brokers to register annually with the Attorney General and provide information about how consumers may opt out of the sale of their personal information.
SEC. 2. Title 1.81.48 (commencing with Section 1798.99.80) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.48. Data Broker Registration1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.
SEC. 2. Title 1.81.48 (commencing with Section 1798.99.80) is added to Part 4 of Division 3 of the Civil Code, to read:
### SEC. 2.
TITLE 1.81.48. Data Broker Registration1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.
TITLE 1.81.48. Data Broker Registration1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.
TITLE 1.81.48. Data Broker Registration
TITLE 1.81.48. Data Broker Registration
1798.99.80. For purposes of this title:(a) Business has the meaning provided in subdivision (c) of Section 1798.140. (b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.
1798.99.80. For purposes of this title:
(a) Business has the meaning provided in subdivision (c) of Section 1798.140.
(b) Data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data broker does not include any of the following:
(1) A consumer reporting agency subject to the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).
(2) A financial institution subject to the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.
(3) An entity subject to the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 1791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).
(c) Personal information has the meaning provided in subdivision (o) of Section 1798.140.
(d) Sale has the meaning provided in subdivision (t) of Section 1798.140.
(e) Third party has the meaning provided in subdivision (w) of Section 1798.140.
1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section. (2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act. (b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.(2) Provide the following information:(A) The name of the data broker and its primary physical, email, and internet website addresses.(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows: (A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.(B) An amount equal to the fees that were due during the period it failed to register. (C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.
1798.99.82. (a) (1)On or before January 31 following each year in which a business that meets the definition of data broker as provided in this title, the business shall register with the Attorney General pursuant to the requirements of this section.
(2)A data broker shall provide consumers the right to opt out of the sale of their personal information and any other rights afforded by the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)), consistent with that act.
(b) In registering with the Attorney General, as described in subdivision (a), a data broker shall do all of the following:
(1) Pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.
(2) Provide the following information:
(A) The name of the data broker and its primary physical, email, and internet website addresses.
(B) Any additional information or explanation the data broker chooses to provide concerning its data collection practices.
(c) (1) A data broker that fails to register as required by this section is subject to injunction and is liable for civil penalties, fees, and costs in an action brought in the name of the people of the State of California by the Attorney General as follows:
(A) A civil penalty of one hundred dollars ($100) for each day the data broker fails to register as required by this section.
(B) An amount equal to the fees that were due during the period it failed to register.
(C) Expenses incurred by the Attorney General in the investigation and prosecution of the action as the court deems appropriate.
(2) Any penalties, fees, and expenses recovered in an action prosecuted under this section shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the state courts and the Attorney General in connection with this title.
1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.
1798.99.84. The Attorney General shall create a page on its internet website where the information provided by data brokers under this title shall be accessible to the public.
SEC. 3. It is the intent of the Legislature that this act shall not be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
SEC. 3. It is the intent of the Legislature that this act shall not be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
SEC. 3. It is the intent of the Legislature that this act shall not be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
### SEC. 3.