CA
California Assembly Bill AB288

California 2019-2020 Regular Session

California Assembly Bill AB288 Compare Versions

OldNewDifferences
1-Amended IN Assembly March 19, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 288Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)January 28, 2019 An act to add Title 1.81.24 (commencing with Section 1798.90.7) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 288, as amended, Cunningham. Consumer privacy: social media companies. The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, networking service, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. to prohibit the service from selling that information to, or exchanging that information with, a third party in the future, subject to specified exceptions. The bill would require a social media company to honor such a request within a commercially reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.1798.90.7.(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
1+CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 288Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)January 28, 2019 An act to add Title 1.81.24 (commencing with Section 1798.90.7) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 288, as introduced, Cunningham. Consumer privacy: social media companies. The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. The bill would require a social media company to honor such a request within a reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
22
3- Amended IN Assembly March 19, 2019 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 288Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)January 28, 2019 An act to add Title 1.81.24 (commencing with Section 1798.90.7) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 288, as amended, Cunningham. Consumer privacy: social media companies. The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, networking service, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. to prohibit the service from selling that information to, or exchanging that information with, a third party in the future, subject to specified exceptions. The bill would require a social media company to honor such a request within a commercially reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO
3+ CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 288Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)January 28, 2019 An act to add Title 1.81.24 (commencing with Section 1798.90.7) to Part 4 of Division 3 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 288, as introduced, Cunningham. Consumer privacy: social media companies. The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. The bill would require a social media company to honor such a request within a reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO
44
5- Amended IN Assembly March 19, 2019
65
7-Amended IN Assembly March 19, 2019
6+
7+
88
99 CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION
1010
1111 Assembly Bill No. 288
1212
1313 Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)January 28, 2019
1414
1515 Introduced by Assembly Member Cunningham(Coauthors: Assembly Members Chen, Gallagher, Lackey, and Mayes)
1616 January 28, 2019
1717
1818 An act to add Title 1.81.24 (commencing with Section 1798.90.7) to Part 4 of Division 3 of the Civil Code, relating to privacy.
1919
2020 LEGISLATIVE COUNSEL'S DIGEST
2121
2222 ## LEGISLATIVE COUNSEL'S DIGEST
2323
24-AB 288, as amended, Cunningham. Consumer privacy: social media companies.
24+AB 288, as introduced, Cunningham. Consumer privacy: social media companies.
2525
26-The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, networking service, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. to prohibit the service from selling that information to, or exchanging that information with, a third party in the future, subject to specified exceptions. The bill would require a social media company to honor such a request within a commercially reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.
26+The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted. This bill would require a social media company, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. The bill would require a social media company to honor such a request within a reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.
2727
2828 The California Constitution provides for a right of privacy. Existing law prescribes a variety of consumer privacy protections, including those arising from particular business transactions. The California Consumer Privacy Act of 2018, operative January 1, 2020, grants consumers various rights with regard to personal information collected by a business, as defined, including the right to know what is collected and the right to have that information deleted.
2929
30-This bill would require a social media company, networking service, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. to prohibit the service from selling that information to, or exchanging that information with, a third party in the future, subject to specified exceptions. The bill would require a social media company to honor such a request within a commercially reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.
30+This bill would require a social media company, as defined, to provide users that close their accounts the option to have the users personally identifiable information permanently removed from the companys database and records and excluded from sale. The bill would require a social media company to honor such a request within a reasonable time. The bill would authorize specified relief for a consumer for a violation of these provisions.
3131
3232 ## Digest Key
3333
3434 ## Bill Text
3535
36-The people of the State of California do enact as follows:SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.1798.90.7.(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
36+The people of the State of California do enact as follows:SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
3737
3838 The people of the State of California do enact as follows:
3939
4040 ## The people of the State of California do enact as follows:
4141
42-SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.1798.90.7.(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
42+SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. Social Media Privacy1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
4343
4444 SECTION 1. Title 1.81.24 (commencing with Section 1798.90.7) is added to Part 4 of Division 3 of the Civil Code, to read:
4545
4646 ### SECTION 1.
4747
48-TITLE 1.81.24. Social Media Privacy1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.1798.90.7.(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
48+TITLE 1.81.24. Social Media Privacy1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
4949
50-TITLE 1.81.24. Social Media Privacy1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.1798.90.7.(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
50+TITLE 1.81.24. Social Media Privacy1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
5151
5252 TITLE 1.81.24. Social Media Privacy
5353
5454 TITLE 1.81.24. Social Media Privacy
5555
56-1798.90.7. For the purposes of this title:(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).(b) Social networking service means an internet platform that does all of the following:(1) Offers users an account hosted on the platform that requires a unique identifier and password.(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.(c) Social networking service does not mean any of the following:(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.
56+1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.
5757
5858
5959
60-1798.90.7. For the purposes of this title:
60+1798.90.7. (a) For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.
6161
62-(a) Personally identifiable information does not include medical information governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5).
62+(b) When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.
6363
64-(b) Social networking service means an internet platform that does all of the following:
65-
66-(1) Offers users an account hosted on the platform that requires a unique identifier and password.
67-
68-(2) Allows users, through their account, to establish interpersonal connections with other user accounts on the platform.
69-
70-(3) Allows users, through their account, to transmit electronic content between and among some or all of the user accounts to which they are interconnected. For purposes of this paragraph, electronic content includes, but is not limited to, videos, photographs, and messages.
71-
72-(c) Social networking service does not mean any of the following:
73-
74-(1) A media organization as defined by Section 1602 of Title 2 of the United States Code, as it read on April 1, 2019.
75-
76-(2) A telecommunications carrier as defined in Section 153 of Title 47 of the United States Code, as it read on April 1, 2019.
77-
78-(3) An institution regulated under the federal Gramm-Leach-Bliley Act (Public Law 106-102), as it read on April 1, 2019.
79-
80-(4) An electronic place, including but not limited to, a store, internet website, or catalog where a seller sells or offers for sale tangible personal property, software applications, or taxable services for delivery in this state regardless of whether the tangible personal property, seller, or marketplace has a physical presence in the state.
81-
82-(5) A retailer engaged in business in this state, as defined by subdivision (c) of Section 6203 of the Revenue and Taxation Code.
83-
84-(6) An entity exempt from taxation under Section 501(c)(3) of the Internal Revenue Code.
85-
86-(7) A provider of health care governed by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in paragraph (1) of subdivision (a) of this section.
87-
88-1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.(3) To debug to identify and repair errors that impair existing intended functionality.(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.
64+1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
8965
9066
9167
92-1798.90.75. (a) When a user of a social networking service deactivates or deletes the users account, the service shall provide the user the option of having the users personally identifiable information permanently removed from any database controlled by the service, from the services records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future.
93-
94-(b) A social networking service shall comply with a request made pursuant to subdivision (a) within a commercially reasonable time period.
95-
96-(c) A social networking service shall not be required to comply with a request made pursuant to subdivision (a) if it is necessary for the business or service provider to maintain the consumers personal information for any of the following reasons:
97-
98-(1) To complete the transaction for which the personal information was collected or provided a good or service requested by the consumer.
99-
100-(2) To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.
101-
102-(3) To debug to identify and repair errors that impair existing intended functionality.
103-
104-(4) To comply with the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).
105-
106-(5) To engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the business deletion of the information is likely to render impossible or seriously impair the achievement of that research, if the research is conducted pursuant to the consumers informed consent.
107-
108-
109-
110-(a)For the purposes of this title, social media company means a company who provides electronic services or accounts, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or locations.
111-
112-
113-
114-(b)When a user of the services of a social media company decides to close the users account, the company shall provide the user the option of having the users personally identifiable information permanently removed from the companys database and records and excluded from sale. If the user elects to have the users personally identifiable information permanently removed and excluded from sale, the social media shall do so. The social media company shall honor that request within a reasonable time.
115-
116-
117-
118-1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.(2) In the case of a willful violation:(A) Actual damages, as set forth in paragraph (1).(B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.(C) Any other relief that the court deems proper.(b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.(c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.(d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.(e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.(f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.
119-
120-
121-
122-1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company networking service may bring an action in a court of appropriate jurisdiction against that company service to recover the following:
68+1798.90.8. (a) Any consumer who suffers damages as a result of a violation of this title by any social media company may bring an action in a court of appropriate jurisdiction against that company to recover the following:
12369
12470 (1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys fees and, when applicable, pain and suffering.
12571
12672 (2) In the case of a willful violation:
12773
12874 (A) Actual damages, as set forth in paragraph (1).
12975
13076 (B) Punitive damages of not less than one hundred dollars ($100) nor more than ten thousand dollars ($10,000) for each violation as the court deems proper.
13177
13278 (C) Any other relief that the court deems proper.
13379
13480 (b) Injunctive relief shall be available to any consumer aggrieved by a violation or a threatened violation of this title whether or not the consumer seeks any other remedy.
13581
13682 (c) Any person who willfully violates any requirement imposed under this title may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.
13783
13884 (d) The prevailing plaintiffs in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys fees.
13985
14086 (e) If a plaintiff only seeks and obtains injunctive relief to compel compliance with this title, court costs and attorneys fees shall be awarded pursuant to Section 1021.5 of the Code of Civil Procedure.
14187
14288 (f) Nothing in this section is intended to affect remedies available under Section 128.5 of the Code of Civil Procedure.