| 1 | 1 | | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 950Introduced by Assembly Member LevineFebruary 20, 2019 An act to add Sections 1798.91.01 and 1798.91.02 to the Civil Code, relating to consumers. LEGISLATIVE COUNSEL'S DIGESTAB 950, as introduced, Levine. Consumer privacy protection.Existing law prohibits a business from requesting medical information directly from an individual regardless of whether the information pertains to the individual, and using, sharing, or otherwise disclosing that information for direct marketing purposes unless certain requirements are met, including that it disclose that it is obtaining the information to market or advertise products, goods, or services to the individual and that it obtain consent for the information to be used or shared for that purpose, as specified. This bill would require a business that conducts business in California, and that collects a California residents consumer data, to disclose to the consumer the monetary value to the business of their consumer data by posting the average monetary value to the business of a consumers data, including that information in its privacy policy posted on its internet website, and also including in its privacy policy disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide, as specified. The bill would also require a business that conducts business in California, that collects a California residents consumer data, and that sells that data, to disclose to the consumer the average price it is paid for a consumers data and to disclose to the consumer the actual price it was paid for a consumers data upon receipt of a verifiable request for that information from the consumer.This bill would also establish the Consumer Data Privacy Commission comprised of members of academia, civil society, and industry to provide guidance to the Legislature regarding appropriate metrics and methodology for determining the value of consumer data. The bill would require the commission to report its findings to the Legislature on or before January 1, 2021.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Section 1798.91.01 is added to the Civil Code, immediately following Section 1798.91, to read:1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140.SEC. 2. Section 1798.91.02 is added to the Civil Code, immediately following Section 1798.91.01, to read:1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 2 | 2 | | |
|---|
| 3 | 3 | | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 950Introduced by Assembly Member LevineFebruary 20, 2019 An act to add Sections 1798.91.01 and 1798.91.02 to the Civil Code, relating to consumers. LEGISLATIVE COUNSEL'S DIGESTAB 950, as introduced, Levine. Consumer privacy protection.Existing law prohibits a business from requesting medical information directly from an individual regardless of whether the information pertains to the individual, and using, sharing, or otherwise disclosing that information for direct marketing purposes unless certain requirements are met, including that it disclose that it is obtaining the information to market or advertise products, goods, or services to the individual and that it obtain consent for the information to be used or shared for that purpose, as specified. This bill would require a business that conducts business in California, and that collects a California residents consumer data, to disclose to the consumer the monetary value to the business of their consumer data by posting the average monetary value to the business of a consumers data, including that information in its privacy policy posted on its internet website, and also including in its privacy policy disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide, as specified. The bill would also require a business that conducts business in California, that collects a California residents consumer data, and that sells that data, to disclose to the consumer the average price it is paid for a consumers data and to disclose to the consumer the actual price it was paid for a consumers data upon receipt of a verifiable request for that information from the consumer.This bill would also establish the Consumer Data Privacy Commission comprised of members of academia, civil society, and industry to provide guidance to the Legislature regarding appropriate metrics and methodology for determining the value of consumer data. The bill would require the commission to report its findings to the Legislature on or before January 1, 2021.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | |
|---|
| 6 | 6 | | |
|---|
| 7 | 7 | | |
|---|
| 8 | 8 | | |
|---|
| 9 | 9 | | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION |
|---|
| 10 | 10 | | |
|---|
| 11 | 11 | | Assembly Bill No. 950 |
|---|
| 12 | 12 | | |
|---|
| 13 | 13 | | Introduced by Assembly Member LevineFebruary 20, 2019 |
|---|
| 14 | 14 | | |
|---|
| 15 | 15 | | Introduced by Assembly Member Levine |
|---|
| 16 | 16 | | February 20, 2019 |
|---|
| 17 | 17 | | |
|---|
| 18 | 18 | | An act to add Sections 1798.91.01 and 1798.91.02 to the Civil Code, relating to consumers. |
|---|
| 19 | 19 | | |
|---|
| 20 | 20 | | LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 21 | 21 | | |
|---|
| 22 | 22 | | ## LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 23 | 23 | | |
|---|
| 24 | 24 | | AB 950, as introduced, Levine. Consumer privacy protection. |
|---|
| 25 | 25 | | |
|---|
| 26 | 26 | | Existing law prohibits a business from requesting medical information directly from an individual regardless of whether the information pertains to the individual, and using, sharing, or otherwise disclosing that information for direct marketing purposes unless certain requirements are met, including that it disclose that it is obtaining the information to market or advertise products, goods, or services to the individual and that it obtain consent for the information to be used or shared for that purpose, as specified. This bill would require a business that conducts business in California, and that collects a California residents consumer data, to disclose to the consumer the monetary value to the business of their consumer data by posting the average monetary value to the business of a consumers data, including that information in its privacy policy posted on its internet website, and also including in its privacy policy disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide, as specified. The bill would also require a business that conducts business in California, that collects a California residents consumer data, and that sells that data, to disclose to the consumer the average price it is paid for a consumers data and to disclose to the consumer the actual price it was paid for a consumers data upon receipt of a verifiable request for that information from the consumer.This bill would also establish the Consumer Data Privacy Commission comprised of members of academia, civil society, and industry to provide guidance to the Legislature regarding appropriate metrics and methodology for determining the value of consumer data. The bill would require the commission to report its findings to the Legislature on or before January 1, 2021. |
|---|
| 27 | 27 | | |
|---|
| 28 | 28 | | Existing law prohibits a business from requesting medical information directly from an individual regardless of whether the information pertains to the individual, and using, sharing, or otherwise disclosing that information for direct marketing purposes unless certain requirements are met, including that it disclose that it is obtaining the information to market or advertise products, goods, or services to the individual and that it obtain consent for the information to be used or shared for that purpose, as specified. |
|---|
| 29 | 29 | | |
|---|
| 30 | 30 | | This bill would require a business that conducts business in California, and that collects a California residents consumer data, to disclose to the consumer the monetary value to the business of their consumer data by posting the average monetary value to the business of a consumers data, including that information in its privacy policy posted on its internet website, and also including in its privacy policy disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide, as specified. The bill would also require a business that conducts business in California, that collects a California residents consumer data, and that sells that data, to disclose to the consumer the average price it is paid for a consumers data and to disclose to the consumer the actual price it was paid for a consumers data upon receipt of a verifiable request for that information from the consumer. |
|---|
| 31 | 31 | | |
|---|
| 32 | 32 | | This bill would also establish the Consumer Data Privacy Commission comprised of members of academia, civil society, and industry to provide guidance to the Legislature regarding appropriate metrics and methodology for determining the value of consumer data. The bill would require the commission to report its findings to the Legislature on or before January 1, 2021. |
|---|
| 33 | 33 | | |
|---|
| 34 | 34 | | ## Digest Key |
|---|
| 35 | 35 | | |
|---|
| 36 | 36 | | ## Bill Text |
|---|
| 37 | 37 | | |
|---|
| 38 | 38 | | The people of the State of California do enact as follows:SECTION 1. Section 1798.91.01 is added to the Civil Code, immediately following Section 1798.91, to read:1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140.SEC. 2. Section 1798.91.02 is added to the Civil Code, immediately following Section 1798.91.01, to read:1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 39 | 39 | | |
|---|
| 40 | 40 | | The people of the State of California do enact as follows: |
|---|
| 41 | 41 | | |
|---|
| 42 | 42 | | ## The people of the State of California do enact as follows: |
|---|
| 43 | 43 | | |
|---|
| 44 | 44 | | SECTION 1. Section 1798.91.01 is added to the Civil Code, immediately following Section 1798.91, to read:1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140. |
|---|
| 45 | 45 | | |
|---|
| 46 | 46 | | SECTION 1. Section 1798.91.01 is added to the Civil Code, immediately following Section 1798.91, to read: |
|---|
| 47 | 47 | | |
|---|
| 48 | 48 | | ### SECTION 1. |
|---|
| 49 | 49 | | |
|---|
| 50 | 50 | | 1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140. |
|---|
| 51 | 51 | | |
|---|
| 52 | 52 | | 1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140. |
|---|
| 53 | 53 | | |
|---|
| 54 | 54 | | 1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following:(1) Posting on its internet website the average monetary value to the business of a consumers data.(2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change.(3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140.(b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data.(2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer.(c) For purposes of this section, business has the same meaning as in Section 1798.140. |
|---|
| 55 | 55 | | |
|---|
| 56 | 56 | | |
|---|
| 57 | 57 | | |
|---|
| 58 | 58 | | 1798.91.01. (a) A business that conducts business in California, that collects a California residents consumer data, shall disclose to the consumer the monetary value to the business of their consumer data by doing all of the following: |
|---|
| 59 | 59 | | |
|---|
| 60 | 60 | | (1) Posting on its internet website the average monetary value to the business of a consumers data. |
|---|
| 61 | 61 | | |
|---|
| 62 | 62 | | (2) Including in its privacy policy posted on its internet website in a section entitled The Value of Your Data the average monetary value to the business of a consumers data. This value shall be updated at least every 90 days and whenever the business terms of service or privacy policy change. |
|---|
| 63 | 63 | | |
|---|
| 64 | 64 | | (3) Including in its privacy policy posted on its internet website, disclosure of any use of a consumers data that is not directly or exclusively related to the service that the consumer has contracted the business to provide. The business shall identify specific types or fields of personal information taken from the consumer data by reference to the categories set forth in subdivision (o) of Section 1798.140. |
|---|
| 65 | 65 | | |
|---|
| 66 | 66 | | (b) (1) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the average price it is paid for a consumers data. |
|---|
| 67 | 67 | | |
|---|
| 68 | 68 | | (2) A business that conducts business in California, that collects a California residents consumer data, that sells that data, shall disclose to the consumer the actual price it was paid for the consumers data upon receipt of a verifiable request for that information from the consumer. |
|---|
| 69 | 69 | | |
|---|
| 70 | 70 | | (c) For purposes of this section, business has the same meaning as in Section 1798.140. |
|---|
| 71 | 71 | | |
|---|
| 72 | 72 | | SEC. 2. Section 1798.91.02 is added to the Civil Code, immediately following Section 1798.91.01, to read:1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 73 | 73 | | |
|---|
| 74 | 74 | | SEC. 2. Section 1798.91.02 is added to the Civil Code, immediately following Section 1798.91.01, to read: |
|---|
| 75 | 75 | | |
|---|
| 76 | 76 | | ### SEC. 2. |
|---|
| 77 | 77 | | |
|---|
| 78 | 78 | | 1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 79 | 79 | | |
|---|
| 80 | 80 | | 1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 81 | 81 | | |
|---|
| 82 | 82 | | 1798.91.02. (a) The Consumer Data Privacy Commission is hereby established.(b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data.(c) The commission shall be comprised of members of academia, civil society, and industry. (d) The commission shall report its findings to the Legislature by January 1, 2021.(e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code.(2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|
| 83 | 83 | | |
|---|
| 84 | 84 | | |
|---|
| 85 | 85 | | |
|---|
| 86 | 86 | | 1798.91.02. (a) The Consumer Data Privacy Commission is hereby established. |
|---|
| 87 | 87 | | |
|---|
| 88 | 88 | | (b) The commission shall provide guidance to the Legislature regarding appropriate metrics and methodology for determining the monetary value of consumer data. |
|---|
| 89 | 89 | | |
|---|
| 90 | 90 | | (c) The commission shall be comprised of members of academia, civil society, and industry. |
|---|
| 91 | 91 | | |
|---|
| 92 | 92 | | (d) The commission shall report its findings to the Legislature by January 1, 2021. |
|---|
| 93 | 93 | | |
|---|
| 94 | 94 | | (e) (1) The requirement to submit a report imposed under subdivision (d) is inoperative on January 1, 2025, pursuant to Section 10231.5 of the Government Code. |
|---|
| 95 | 95 | | |
|---|
| 96 | 96 | | (2) A report to be submitted pursuant to subdivision (d) shall be submitted in compliance with Section 9795 of the Government Code. |
|---|