Amended IN Assembly June 20, 2022 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Senate Bill No. 1172Introduced by Senator PanFebruary 17, 2022 An act to add Section 1798.101 to the Civil Code, Chapter 22.2.7 (commencing with Section 22588) to Division 8 of the Business and Professions Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTSB 1172, as amended, Pan. California Privacy Rights Act of 2020: business: proctoring services. Student Test Taker Privacy Protection Act.Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. The CCPA prohibits a business from collecting additional categories of personal information or using personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice. The CCPA provides that the obligations it imposes on businesses do not apply to information that is deidentified or aggregated. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified.This bill would prohibit a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services. services and in other specified circumstances. The bill would authorize a consumer to bring a civil action against a business for violating that provision.The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YESNO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1.Section 1798.101 is added to the Civil Code, to read:1798.101.(a)Notwithstanding subdivision (a) of Section 1798.100 and paragraph (6) of subdivision (a) of Section 1798.145, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b)A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1)Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2)Injunctive or declaratory relief.(3)Reasonable attorney fees and costs, including expert witness fees.SECTION 1. Chapter 22.2.7 (commencing with Section 22588) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.7. Student Test Taker Privacy Protection Act22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.SEC. 2. The Legislature finds and declares that the section added to the Civil chapter added to the Business and Professions Code by this act furthers the purpose and intent of the California Privacy Rights Act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.
Amended IN Assembly June 20, 2022 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Senate Bill No. 1172Introduced by Senator PanFebruary 17, 2022 An act to add Section 1798.101 to the Civil Code, Chapter 22.2.7 (commencing with Section 22588) to Division 8 of the Business and Professions Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTSB 1172, as amended, Pan. California Privacy Rights Act of 2020: business: proctoring services. Student Test Taker Privacy Protection Act.Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. The CCPA prohibits a business from collecting additional categories of personal information or using personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice. The CCPA provides that the obligations it imposes on businesses do not apply to information that is deidentified or aggregated. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified.This bill would prohibit a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services. services and in other specified circumstances. The bill would authorize a consumer to bring a civil action against a business for violating that provision.The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YESNO Local Program: NO
Amended IN Assembly June 20, 2022
Amended IN Assembly June 20, 2022
CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION
Senate Bill
No. 1172
Introduced by Senator PanFebruary 17, 2022
Introduced by Senator Pan
February 17, 2022
An act to add Section 1798.101 to the Civil Code, Chapter 22.2.7 (commencing with Section 22588) to Division 8 of the Business and Professions Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
SB 1172, as amended, Pan. California Privacy Rights Act of 2020: business: proctoring services. Student Test Taker Privacy Protection Act.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. The CCPA prohibits a business from collecting additional categories of personal information or using personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice. The CCPA provides that the obligations it imposes on businesses do not apply to information that is deidentified or aggregated. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified.This bill would prohibit a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services. services and in other specified circumstances. The bill would authorize a consumer to bring a civil action against a business for violating that provision.The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. The CCPA prohibits a business from collecting additional categories of personal information or using personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice. The CCPA provides that the obligations it imposes on businesses do not apply to information that is deidentified or aggregated. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified.
This bill would prohibit a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services. services and in other specified circumstances. The bill would authorize a consumer to bring a civil action against a business for violating that provision.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1.Section 1798.101 is added to the Civil Code, to read:1798.101.(a)Notwithstanding subdivision (a) of Section 1798.100 and paragraph (6) of subdivision (a) of Section 1798.145, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b)A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1)Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2)Injunctive or declaratory relief.(3)Reasonable attorney fees and costs, including expert witness fees.SECTION 1. Chapter 22.2.7 (commencing with Section 22588) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.7. Student Test Taker Privacy Protection Act22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.SEC. 2. The Legislature finds and declares that the section added to the Civil chapter added to the Business and Professions Code by this act furthers the purpose and intent of the California Privacy Rights Act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
(a)Notwithstanding subdivision (a) of Section 1798.100 and paragraph (6) of subdivision (a) of Section 1798.145, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.
(b)A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:
(1)Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.
(2)Injunctive or declaratory relief.
(3)Reasonable attorney fees and costs, including expert witness fees.
SECTION 1. Chapter 22.2.7 (commencing with Section 22588) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.2.7. Student Test Taker Privacy Protection Act22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.
SECTION 1. Chapter 22.2.7 (commencing with Section 22588) is added to Division 8 of the Business and Professions Code, to read:
### SECTION 1.
CHAPTER 22.2.7. Student Test Taker Privacy Protection Act22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.
CHAPTER 22.2.7. Student Test Taker Privacy Protection Act22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.
CHAPTER 22.2.7. Student Test Taker Privacy Protection Act
CHAPTER 22.2.7. Student Test Taker Privacy Protection Act
22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.(2) Injunctive or declaratory relief.(3) Reasonable attorney fees and costs, including expert witness fees.(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:(1) To comply with federal, state, or local law.(2) To comply with a court order or subpoena.(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.(6) To exercise or defend a legal claim.(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.
22588. (a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide that service.
(b) A consumer whose personal information is collected, used, retained, or disclosed in violation of this section may bring a civil action against that business and may recover all of the following:
(1) Liquidated damages of one thousand dollars ($1,000) per consumer per incident or actual damages, whichever is greater.
(2) Injunctive or declaratory relief.
(3) Reasonable attorney fees and costs, including expert witness fees.
(c) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:
(1) To comply with federal, state, or local law.
(2) To comply with a court order or subpoena.
(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.
(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumers personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumers personal information.
(B) A business that has received direction from a law enforcement agency not to delete a consumers personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumers personal information for any purpose except in response to a court order or subpoena.
(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.
(5) To cooperate with a government agency request for emergency access to a consumers personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:
(A) The request is approved by a high-ranking agency officer for emergency access to a consumers personal information.
(B) The request is based on the agencys good faith determination that it has a lawful basis to access the information on a nonemergency basis.
(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.
(6) To exercise or defend a legal claim.
(d) For purposes of this section, personal information has the same meaning as in Section 1798.140 of the Civil Code.
SEC. 2. The Legislature finds and declares that the section added to the Civil chapter added to the Business and Professions Code by this act furthers the purpose and intent of the California Privacy Rights Act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.
SEC. 2. The Legislature finds and declares that the section added to the Civil chapter added to the Business and Professions Code by this act furthers the purpose and intent of the California Privacy Rights Act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.
SEC. 2. The Legislature finds and declares that the section added to the Civil chapter added to the Business and Professions Code by this act furthers the purpose and intent of the California Privacy Rights Act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.
### SEC. 2.