SB 34: Automated license plate recognition systems: use of data.
- Session Year: 2015-2016
- House: Senate
- Latest Version Date: 2015-10-06
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, maintaining reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information, as specified. The bill would impose similar requirements on an ALPR end-user, as defined.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access and require that ALPR information only be used for authorized purposes.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
The bill would require a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, maintaining reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information, as specified. The bill would impose similar requirements on an ALPR end-user, as defined.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access and require that ALPR information only be used for authorized purposes.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
The bill would require a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, maintaining reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information, as specified. The bill would impose similar requirements on an ALPR end-user, as defined.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access and require that ALPR information only be used for authorized purposes.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
The bill would require a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
This bill would incorporate additional changes to Section 1798.29 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
This bill also would incorporate additional changes to Section 1798.82 of the Civil Code proposed by SB 570 and AB 964 that would become operative if this bill and one or both of those bills are enacted and this bill is enacted last.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, maintaining reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information, as specified. The bill would impose similar requirements on an ALPR end-user, as defined.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access. access and require that ALPR information only be used for authorized purposes.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
The bill would require a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, ensuring that the information the ALPR operator collects is protected with certain safeguards, and implementing and maintaining specified reasonable security procedures and practices to protect ALPR information and implementing a usage and privacy policy with respect to that information. information, as specified. The bill would impose similar requirements on an ALPR end-user, as defined.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access.
This bill would also require an ALPR end-user, as defined, to implement and maintain a specified usage and privacy policy.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. the harm.
The bill would require a public agency agency, as defined, that considers implementing a program to gather information through the use of operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements implementing the program. The bill would also prohibit a public agency from selling, sharing, or transferring ALPR information, except to another public agency, as specified.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, ensuring that the information the ALPR operator collects is protected with certain safeguards, and implementing and maintaining specified security procedures and a usage and privacy policy with respect to that information.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access.
This bill would also require an ALPR end-user, as defined, to implement and maintain a specified usage and privacy policy.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.
The bill would require a public agency that considers implementing a program to gather information through the use of an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements the program.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
(1)Existing law authorizes the Department of the California Highway Patrol to retain license plate data captured by license plate recognition (LPR) technology, also referred to as an automated license plate recognition (ALPR) system, for not more than 60 days unless the data is being used as evidence or for the investigation of felonies. Existing law prohibits the department from selling the data or from making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer.
Existing law authorizes the department to use LPR data for the purpose of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense, and requires the department to monitor the internal use of the data to prevent unauthorized use and to submit to the Legislature, as a part of the annual automobile theft report, information on the departments LPR practices and usage.
This bill would impose specified requirements on an ALPR operator as defined, including, among others, ensuring that the information the ALPR operator collects is protected with certain safeguards, and implementing and maintaining specified security procedures and a usage and privacy policy with respect to that information.
The bill would require an ALPR operator that accesses or provides access to ALPR information to maintain a specified record of that access.
This bill would also require an ALPR end-user, as defined, to implement and maintain a specified usage and privacy policy.
The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.
The bill would require a public agency that considers implementing a program to gather information through the use of an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements the program.
(2)Existing law requires any agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law defines personal information for these purposes to include an individuals first name and last name, or first initial and last name, in combination with one or more designated data elements relating to, among other things, social security numbers, drivers license numbers, financial accounts, and medical information.
This bill would include information or data collected through the use or operation of an automated license plate recognition system, when that information is not encrypted and is used in combination with an individuals name, in the definition of personal information discussed above.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses an ALPR system, but does not include any of the following:
(1)A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2)A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(3)A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f)Public agency means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using the ALPR system and collecting ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:
(a)Maintain a record of that access. At a minimum, the record shall include all of the following:
(1)The date and time the information is accessed.
(2)The license plate number or other data elements used to query the ALPR system.
(3)The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(4)The purpose for accessing the information.
(b)Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.
1798.90.53.An ALPR end-user shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for accessing and using ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation:
(a)A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.
(b)A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.
SEC. 4.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 5.(a)Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b)Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c)Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses an ALPR system, but does not include any of the following:
(1)A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2)A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(3)A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f)Public agency means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using the ALPR system and collecting ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:
(a)Maintain a record of that access. At a minimum, the record shall include all of the following:
(1)The date and time the information is accessed.
(2)The license plate number or other data elements used to query the ALPR system.
(3)The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(4)The purpose for accessing the information.
(b)Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.
1798.90.53.An ALPR end-user shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for accessing and using ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation:
(a)A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.
(b)A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.
SEC. 4.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 5.(a)Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b)Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c)Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.1.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.2.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 1.3.Section 1798.29 of the Civil Code is amended to read:1798.29.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (i), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (i), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the agencys Internet Web site page, if the agency maintains one. For purposes of this subparagraph, conspicuous posting on the agencys Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.1.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 2.3.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language. language, shall be titled Notice of Data Breach, and shall present the information described in paragraph (2) under the following headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Additional information may be provided as a supplement to the notice.
(A)The format of the notice shall be designed to call attention to the nature and significance of the information it contains.
(B)The title and headings in the notice shall be clearly and conspicuously displayed.
(C)The text of the notice and any other notice provided pursuant to this section shall be no smaller than 10-point type.
(D)For a written notice described in paragraph (1) of subdivision (j), use of the model security breach notification form prescribed below or use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
[NAME OF INSTITUTION / LOGO] Date: [insert date] | ||
NOTICE OF DATA BREACH | ||
What Happened? | ||
What Information Was Involved? | ||
What We Are Doing. | ||
What You Can Do. | ||
Other Important Information. [insert other important information] | ||
For More Information. | Call [telephone number] or go to [Internet Web site] | |
(E)For an electronic notice described in paragraph (2) of subdivision (j), use of the headings described in this paragraph with the information described in paragraph (2), written in plain language, shall be deemed to be in compliance with this subdivision.
(2)The security breach notification described in paragraph (1) shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, months along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(4)For purposes of this section, encrypted means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting posting, for a minimum of 30 days, of the notice on the Internet Web site page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the persons or businesss Internet Web site means providing a link to the notice on the home page or first significant page after entering the Internet Web site that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.
(C)Notification to major statewide media.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in this subdivision or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses an ALPR system, but does not include any of the following:
(1)A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2)A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(3)A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f)Public agency means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using the ALPR system and collecting ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:
(a)Maintain a record of that access. At a minimum, the record shall include all of the following:
(1)The date and time the information is accessed.
(2)The license plate number or other data elements used to query the ALPR system.
(3)The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(4)The purpose for accessing the information.
(b)Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.
1798.90.53.An ALPR end-user shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for accessing and using ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation:
(a)A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.
(b)A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.
SEC. 4.(a)Section 1.1 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 1, 1.2, and 1.3 of this bill shall not become operative.
(b)Section 1.2 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.29 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 1, 1.1, and 1.3 of this bill shall not become operative.
(c)Section 1.3 of this bill incorporates amendments to Section 1798.29 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.29 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 1, 1.1, and 1.2 of this bill shall not become operative.
SEC. 5.(a)Section 2.1 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Senate Bill 570. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Assembly Bill 964 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Senate Bill 570, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative.
(b)Section 2.2 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by both this bill and Assembly Bill 964. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2016, (2) each bill amends Section 1798.82 of the Civil Code, (3) Senate Bill 570 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after Assembly Bill 964, in which case Sections 2, 2.1, and 2.3 of this bill shall not become operative.
(c)Section 2.3 of this bill incorporates amendments to Section 1798.82 of the Civil Code proposed by this bill, Senate Bill 570, and Assembly Bill 964. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2016, (2) all three bills amend Section 1798.82 of the Civil Code, and (3) this bill is enacted after Senate Bill 570 and Assembly Bill 964, in which case Sections 2, 2.1, and 2.2 of this bill shall not become operative.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses an ALPR system, but does not include any of the following:
(1)A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2)A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if both of the following apply:
(A)The person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(B)The person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information.
(3)A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code, if the person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information. Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f)Public agency means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using the ALPR system and collecting ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall maintain do both of the following:
(a)Maintain a record of that access. At a minimum, the record shall include all of the following:
(a)
(1)The date and time the information is accessed.
(b)
(2)The license plate number or other data elements used to query the ALPR system.
(c)
(3)The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(d)
(4)The purpose for accessing the information.
(b)Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.
1798.90.53.An ALPR end-user shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for accessing and using ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(E)The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation:
(a)A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.
(b)A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses an ALPR information, system, but does not include a any of the following:
(1)A transportation agency when subject to Section 31490 of the Streets and Highways Code.
(2)A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if both of the following apply:
(A)The person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.
(B)The person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information.
(3)A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code, if the person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, or that stores or maintains ALPR information, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a system searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person includes a law enforcement agency, government agency, private entity, or individual. means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
(f)Public agency means and includes every state agency and every local agency. the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)(1)Ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
(2)Implement and maintain
(a)Maintain reasonable security procedures and practices in order practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement and maintain a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using the ALPR systems system and collecting ALPR information.
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR systems, system, or to collect ALPR information, and to access ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the use of ALPR systems system will be monitored to ensure the security of the information and compliance with all applicable privacy laws and a process for periodic system audits, including audits of the access log required by Section 1798.90.52. laws.
(D)A description of reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
(E)A description of how the ALPR operator will comply with the security procedures and practices implemented and maintained pursuant to subdivision (a).
(F)The length of time ALPR information will be stored or retained.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(G)
(E)The title of the official custodian, or owner, of the ALPR information and which employees and independent contractors have the responsibility and accountability for implementing subdivision (a) and this subdivision. system responsible for implementing this section.
(H)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
(F)A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.
(G)The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall maintain a record of that access. At a minimum, the record shall include all of the following:
(a)The date and time the information is accessed.
(b)The license plate number or other data elements used to query the ALPR database or system.
(c)The name username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(d)The purpose for accessing the information.
1798.90.53.An ALPR end-user shall do all of the following:
(a)Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. (a)An ALPR end-user shall implement and maintain
(b)(1)Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(b)
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(1)
(A)The authorized purposes for accessing and using ALPR information.
(2)
(B)A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(3)
(C)A description of how the access and use of ALPR information system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.
(4)The length of time ALPR information will be retained by the ALPR end-user and the process the ALPR end-user will utilize to determine if and when to destroy the retained ALPR information.
(D)The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
(5)
(E)The title of the official custodian, or owner, of the ALPR information. information responsible for implementing this section.
(6)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
(7)
(F)A description of how the end-user will implement reasonable security measures to secure that will be used to ensure the accuracy of ALPR information from unauthorized access, destruction, use, modification, or disclosure. and correct data errors.
(8)Which employees and independent contractors have the responsibility and accountability for implementing subdivision (a) and this subdivision.
(G)The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. the harm.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation, a regulation:
(a)A public agency that considers implementing a program to gather information through the use of operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements implementing the program.
(b)A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting services shall not be considered the sale, sharing, or transferring of ALPR information.
TextPage 14.(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses ALPR information, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, or that stores or maintains ALPR information, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person includes a law enforcement agency, government agency, private entity, or individual.
(f)Public agency means and includes every state agency and every local agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)(1)Ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
(2)Implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement and maintain a usage and privacy policy in order to ensure that the collection collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using ALPR systems and collecting ALPR information.
(B)A description of the employees and independent contractors who are authorized to use ALPR systems, to collect ALPR information, and to access ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the use of ALPR systems will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits, including audits of the access log required by Section 1798.90.52.
(D)A description of reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
(E)A description of how the ALPR operator will comply with the security procedures and practices implemented and maintained pursuant to subdivision (b). (a).
(F)The length of time ALPR information will be stored or retained.
(G)The official custodian, or owner, of ALPR information and which employees and independent contractors have the responsibility and accountability for implementing subdivision (b) (a) and this subdivision.
(H)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall maintain a record of that access. At a minimum, the record shall include all of the following:
(a)The date and time the information is accessed.
(b)The license plate number or other data elements used to query the ALPR database or system.
(c)The person who accesses the information.
(c)The name of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.
(d)The purpose for accessing the information.
1798.90.53.(a)An ALPR end-user shall implement and maintain a usage and privacy policy in order to ensure that the access and use access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(b)The usage and privacy policy shall, at a minimum, include all of the following:
(1)The authorized purposes for accessing and using ALPR information.
(2)A description of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(3)A description of how the access and use of ALPR information will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits.
(4)The length of time ALPR information will be retained by the ALPR end-user and the process the ALPR end-user will utilize to determine if and when to destroy the retained ALPR information.
(5)The official custodian custodian, or owner, of ALPR information.
(6)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
(7)A description of how the end-user will implement reasonable security measures to secure ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(8)Which employees and independent contractors have the responsibility and accountability for implementing subdivision (a) and this subdivision.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation, a public agency that considers implementing a program to gather information through the use of an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements the program.
(a)Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)Any agency that maintains computerized data that includes personal information that the agency does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d)Any agency that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting agency subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number or a drivers license or California identification card number.
(3)At the discretion of the agency, the security breach notification may also include any of the following:
(A)Information about what the agency has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for an online account, and no other personal information defined in paragraph (1) of subdivision (g), the agency may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the agency and all other online accounts for which the person uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (g) for login credentials of an email account furnished by the agency, the agency shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (i) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the agency knows the resident customarily accesses the account.
(e)Any agency that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(f)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(g)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(h)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(i)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the agency has an email address for the subject persons.
(B)Conspicuous posting of the notice on the agencys Internet Web site page, if the agency maintains one.
(C)Notification to major statewide media and the Office of Information Security within the Department of Technology.
(j)Notwithstanding subdivision (i), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part shall be deemed to be in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(k)Notwithstanding the exception specified in paragraph (4) of subdivision (b) of Section 1798.3, for purposes of this section, agency includes a local agency, as defined in subdivision (a) of Section 6252 of the Government Code.
SEC. 2.Section 1798.82 of the Civil Code is amended to read:1798.82.(a)A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b)A person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c)The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made promptly after the law enforcement agency determines that it will not compromise the investigation.
(d)A person or business that is required to issue a security breach notification pursuant to this section shall meet all of the following requirements:
(1)The security breach notification shall be written in plain language.
(2)The security breach notification shall include, at a minimum, the following information:
(A)The name and contact information of the reporting person or business subject to this section.
(B)A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.
(C)If the information is possible to determine at the time the notice is provided, then any of the following: (i) the date of the breach, (ii) the estimated date of the breach, or (iii) the date range within which the breach occurred. The notification shall also include the date of the notice.
(D)Whether notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.
(E)A general description of the breach incident, if that information is possible to determine at the time the notice is provided.
(F)The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed a social security number or a drivers license or California identification card number.
(G)If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, if any, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information defined in subparagraphs (A) and (B) of paragraph (1) of subdivision (h).
(3)At the discretion of the person or business, the security breach notification may also include any of the following:
(A)Information about what the person or business has done to protect individuals whose information has been breached.
(B)Advice on steps that the person whose information has been breached may take to protect himself or herself.
(4)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for an online account, and no other personal information defined in paragraph (1) of subdivision (h), the person or business may comply with this section by providing the security breach notification in electronic or other form that directs the person whose personal information has been breached promptly to change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same user name or email address and password or security question or answer.
(5)In the case of a breach of the security of the system involving personal information defined in paragraph (2) of subdivision (h) for login credentials of an email account furnished by the person or business, the person or business shall not comply with this section by providing the security breach notification to that email address, but may, instead, comply with this section by providing notice by another method described in subdivision (j) or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.
(e)A covered entity under the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d et seq.) will be deemed to have complied with the notice requirements in subdivision (d) if it has complied completely with Section 13402(f) of the federal Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). However, nothing in this subdivision shall be construed to exempt a covered entity from any other provision of this section.
(f)A person or business that is required to issue a security breach notification pursuant to this section to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. A single sample copy of a security breach notification shall not be deemed to be within subdivision (f) of Section 6254 of the Government Code.
(g)For purposes of this section, breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure.
(h)For purposes of this section, personal information means either of the following:
(1)An individuals first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A)Social security number.
(B)Drivers license number or California identification card number.
(C)Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individuals financial account.
(D)Medical information.
(E)Health insurance information.
(F)Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
(2)A user name or email address, in combination with a password or security question and answer that would permit access to an online account.
(i)(1)For purposes of this section, personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(2)For purposes of this section, medical information means any information regarding an individuals medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
(3)For purposes of this section, health insurance information means an individuals health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individuals application and claims history, including any appeals records.
(j)For purposes of this section, notice may be provided by one of the following methods:
(1)Written notice.
(2)Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code.
(3)Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:
(A)Email notice when the person or business has an email address for the subject persons.
(B)Conspicuous posting of the notice on the Internet Web site page of the person or business, if the person or business maintains one.
(C)Notification to major statewide media.
(k)Notwithstanding subdivision (j), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system.
SEC. 3.Title 1.81.23 (commencing with Section 1798.90.5) is added to Part 4 of Division 3 of the Civil Code, to read:1.81.23.COLLECTION OF LICENSE PLATE INFORMATION1798.90.5.The following definitions shall apply for purposes of this title:
(a)Automated license plate recognition end-user or ALPR end-user means a person that accesses or uses ALPR information, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(b)Automated license plate recognition information, or ALPR information means information or data collected through the use of an ALPR system.
(c)Automated license plate recognition operator or ALPR operator means a person that operates an ALPR system, or that stores or maintains ALPR information, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
(d)Automated license plate recognition system or ALPR system means a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
(e)Person includes a law enforcement agency, government agency, private entity, or individual.
(f)Public agency means and includes every state agency and every local agency.
1798.90.51.An ALPR operator shall do all of the following:
(a)(1)Ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
(2)Implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
(b)(1)Implement and maintain a usage and privacy policy in order to ensure that the collection of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(2)The usage and privacy policy shall, at a minimum, include all of the following:
(A)The authorized purposes for using ALPR systems and collecting ALPR information.
(B)A description of the employees and independent contractors who are authorized to use ALPR systems, to collect ALPR information, and to access ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(C)A description of how the use of ALPR systems will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits, including audits of the access log required by Section 1798.90.52.
(D)A description of reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
(E)A description of how the ALPR operator will comply with the security procedures and practices implemented and maintained pursuant to subdivision (b).
(F)The length of time ALPR information will be stored or retained.
(G)The official custodian, or owner, of ALPR information and which employees and independent contractors have the responsibility and accountability for implementing subdivision (b) and this subdivision.
(H)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
1798.90.52.If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall maintain a record of that access. At a minimum, the record shall include all of the following:
(a)The date and time the information is accessed.
(b)The license plate number or other data elements used to query the ALPR database or system.
(c)The person who accesses the information.
(d)The purpose for accessing the information.
1798.90.53.(a)An ALPR end-user shall implement and maintain a usage and privacy policy in order to ensure that the access and use of ALPR information is consistent with respect for individuals privacy and civil liberties. The usage and privacy policy shall be available in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.
(b)The usage and privacy policy shall, at a minimum, include all of the following:
(1)The authorized purposes for accessing and using ALPR information.
(2)A description of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.
(3)A description of how the access and use of ALPR information will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits.
(4)The length of time ALPR information will be retained by the ALPR end-user and the process the ALPR end-user will utilize to determine if and when to destroy the retained ALPR information.
(5)The official custodian of ALPR information.
(6)The purpose of, and process for, sharing or disseminating ALPR information with other persons.
(7)A description of how the end-user will implement reasonable security measures to secure ALPR information from unauthorized access, destruction, use, modification, or disclosure.
1798.90.54.(a)In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.
(b)The court may award a combination of any one or more of the following:
(1)Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).
(2)Punitive damages upon proof of willful or reckless disregard of the law.
(3)Reasonable attorneys fees and other litigation costs reasonably incurred.
(4)Other preliminary and equitable relief as the court determines to be appropriate.
1798.90.55.Notwithstanding any other law or regulation, a public agency that considers implementing a program to gather information through the use of an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements the program.
|
Date
|
Status
|
|---|---|
| Sep 3, 2015 | In Senate. Concurrence in Assembly amendments pending. |
| Jul 2, 2015 | (Corrected July 9). |
| Jul 2, 2015 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on P. & C.P. |
| Jul 9, 2015 | From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 11. Noes 0.) (July 7). |
| Jul 13, 2015 | Read second time and amended. Re-referred to Com. on APPR. |
| Aug 19, 2015 | From committee: Do pass. (Ayes 14. Noes 3.) (August 19). |
| Aug 20, 2015 | Read second time. Ordered to third reading. |
| Sep 1, 2015 | Ordered to third reading. |
| Sep 1, 2015 | Read third time and amended. |
| Jun 23, 2015 | From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 13. Noes 1.) (June 22). Re-referred to Com. on P. & C.P. |
| Sep 3, 2015 | Read third time. Passed. Ordered to the Senate. |
| Sep 3, 2015 | Read third time. Passed. (Ayes 71. Noes 5. Page 2843.) Ordered to the Senate. |
| Sep 4, 2015 | Assembly amendments concurred in. (Ayes 25. Noes 11. Page 2494.) Ordered to engrossing and enrolling. |
| Sep 4, 2015 | Assembly amendments concurred in. (Ayes 25. Noes 11.) Ordered to engrossing and enrolling. |
| Sep 10, 2015 | Enrolled and presented to the Governor at 3:30 p.m. |
| Oct 6, 2015 | Approved by the Governor. |
| Oct 6, 2015 | Chaptered by Secretary of State. Chapter 532, Statutes of 2015. |
| Dec 1, 2014 | Introduced. Read first time. To Com. on RLS. for assignment. To print. |
| May 22, 2015 | Referred to Coms. on TRANS. and P. & C.P. |
| May 7, 2015 | Read third time. Passed. (Ayes 25. Noes 12.) Ordered to the Assembly. |
| May 7, 2015 | Read third time. Passed. (Ayes 25. Noes 12. Page 930.) Ordered to the Assembly. |
| May 7, 2015 | In Assembly. Read first time. Held at Desk. |
| May 5, 2015 | Read second time. Ordered to third reading. |
| May 4, 2015 | From committee: Do pass. (Ayes 5. Noes 2.) (May 4). |
| May 4, 2015 | From committee: Do pass. (Ayes 5. Noes 2. Page 884.) (May 4). |
| Apr 24, 2015 | Set for hearing May 4. |
| Apr 22, 2015 | Read second time and amended. Re-referred to Com. on APPR. |
| Apr 21, 2015 | From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 4. Noes 2. Page 619.) (April 14). |
| Apr 9, 2015 | Set for hearing April 14. |
| Apr 8, 2015 | From committee: Do pass and re-refer to Com. on JUD. (Ayes 8. Noes 2. Page 526.) (April 7). Re-referred to Com. on JUD. |
| Mar 10, 2015 | Set for hearing April 7. |
| Jan 15, 2015 | Referred to Coms. on T. & H. and JUD. |
| Dec 2, 2014 | From printer. May be acted upon on or after January 1. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 4, 2015 | Unfinished Business SB34 Hill Concurrence | Senate Floor |
Passed |
|
| Sep 3, 2015 | SB 34 Hill Senate Third Reading By GATTO | Assembly Floor |
Passed |
|
| Aug 19, 2015 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Jul 7, 2015 | Do pass as amended and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| Jun 22, 2015 | Do pass and be re-referred to the Committee on [Privacy and Consumer Protection] | Assembly Standing Committee on Transportation |
Passed |
|
| May 7, 2015 | Senate 3rd Reading SB34 Hill | Senate Floor |
Passed |
|
| May 4, 2015 | Do pass | Senate Standing Committee on Appropriations |
Passed |
|
| Apr 14, 2015 | Do pass as amended, but first amend, and re-refer to the Committee on [Appropriations] | Senate Standing Committee on Judiciary |
Passed |
|
| Apr 7, 2015 | Do pass, but first be re-referred to the Committee on [Judiciary] | Senate Standing Committee on Transportation and Housing |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| Bay Area Civil Liberties Coalition | ** Support | Sep 3, 2015 |
| California Civil Liberties Advocacy | ** Support | Jul 7, 2015 |
| California Civil Liberties Council | ** Support | Sep 3, 2015 |
| California Credit Union League | * Indeterminate | Jul 7, 2015 |
| Citizens for Criminal Justice Reform California | ** Support | Jul 7, 2015 |
| Civil Liberties Coalition | * Support | Apr 7, 2015 |
| Conference of California Bar Associations | ** Support | Sep 3, 2015 |
| Media Alliance | ** Support | Sep 3, 2015 |
| NA | * Indeterminate | Jul 7, 2015 |
| Small Business California | ** Support | Sep 3, 2015 |
SB 34
Page 6
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
UNFINISHED BUSINESS
Bill No: SB 34
Amended: 9/1/15
SENATE TRANS. & HOUSING COMMITTEE: 8-2, 4/7/15
AYES: Beall, Allen, Galgiani, Leyva, McGuire, Mendoza, Roth, Wieckowski
NOES: Bates, Gaines
NO VOTE RECORDED: Cannella
SENATE JUDICIARY COMMITTEE: 4-2, 4/14/15
AYES: Jackson, Leno, Monning, Wieckowski
NOES: Vidak, Anderson
NO VOTE RECORDED: Hertzberg
SENATE APPROPRIATIONS COMMITTEE: 5-2, 5/4/15
AYES: Lara, Beall, Hill, Leyva, Mendoza
NOES: Bates, Nielsen
SENATE FLOOR: 25-12, 5/7/15
AYES: Allen, Beall, Block, Cannella, De León, Galgiani, Hall, Hancock, Hernandez, Hertzberg, Hill, Hueso, Jackson, Lara, Leno, Leyva, McGuire, Mendoza, Mitchell, Monning, Pan, Pavley, Roth, Wieckowski, Wolk
NOES: Anderson, Bates, Berryhill, Gaines, Huff, Moorlach, Morrell, Nguyen, Nielsen, Runner, Stone, Vidak
NO VOTE RECORDED: Fuller, Liu
ASSEMBLY FLOOR: 71-5, 9/3/15 - See last page for vote
SUBJECT: Automated license plate recognition systems: use of data
DIGEST: This bill establishes regulations on the privacy and usage of automatic license plate recognition (ALPR) data and expands the meaning of “personal information” to include information or data collected through the use or operation of an ALPR system.
Assembly Amendments impose privacy protection requirements on entities that use ALPR information, as defined; prohibit public agencies from selling or sharing ALPR information, except to another public agency, as specified; and require operators of ALPR systems to use that information only for authorized purposes.
Existing law:
1) Places regulations on agencies, persons, or businesses that own, license, or maintain computerized data that includes personal information. These regulations include disclosing a breach of security.
2) Prohibits a transportation agency from selling or providing personally identifiable information of any person who subscribes to an electronic toll or electronic transit fare collection system or who uses a toll bridge, toll lane, or toll highway that employs an electronic toll collection system. Agencies covered by this regulation are the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system and any transit operator participating in that system, or any entity under contract with the above-mentioned entities.
3) Requires that transportation agencies employing an electronic toll or transit fare collection system establish a privacy policy for the collection and use of personally identifiable information and provide users with a copy of the privacy policy. Transportation agencies include the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system, and any transit operator participating in that system, or any entity under contract with the above-mentioned entities.
4) Establishes limits on the length of time that transportation agencies may keep personal information. All information may be kept only as long as necessary to perform account functions. All other information must be discarded within 4½ years after the conclusion of the billing cycle.
This bill:
1) Defines an ALPR system as a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
2) Requires that data collected through the use or operation of an ALPR system be considered as personal information subject to existing law pertaining to agencies, persons, or businesses that conduct business in California, and that own or license computerized data including personal information.
3) Defines an ALPR end-user as a person that accesses or uses ALPR information and an ALPR operator as a person that operates an ALPR system, or that maintains ALPR information, with the exception of transportation agencies; persons already subject to state and federal code regarding protection of nonpublic personal information; and a person, other than a law enforcement agency, to whom information may be disclosed as a permissible use under federal code regarding prohibition on release and use of certain personal information from state motor vehicle records. A person may include any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.
4) Requires that ALPR operators ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
5) Requires that ALPR operators and end users implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
6) Requires that ALPR operators and end users implement and maintain a usage and privacy policy in order to ensure that the collection, access, and use of ALPR information is consistent with respect for individuals’ privacy and civil liberties.
7) Requires ALPR operators that access or provide access to ALPR information to maintain a record of that access. The record must include the date and time of access, the license plate number which was queried, the person who accesses the information, and the purpose of accessing the information.
8) Allows an individual who has been harmed by a violation of this title to bring a civil action against a person who knowingly caused the violation. The court can award damages which are stipulated in this bill.
9) Requires a public agency that operates or intends to operate an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the agency before it implements the program of ALPR use.
Comments
Purpose. The author states that this bill is necessary to institute reasonable usage and privacy standards for the operation of ALPR systems, which do not exist for the majority of local agencies that have approved the use of ALPR technology, according to the American Civil Liberties Union (ACLU). Additionally, this bill requires an opportunity for public input on the usage and standards of ALPR technologies, something the author contends few local agencies allow. The author states that the main focus of this bill is to put in place regulations for businesses and agencies which currently do not have any policies regarding the use of ALPR data, unlike transportation agencies which are already regulated by existing law.
ALPR background and history. ALPR systems automatically scan any license plate within range. Some ALPR systems can scan 2,000 plates in a minute. When used by law enforcement, each scanned license plate is checked against crime databases. If a “hit” occurs — for example, a stolen vehicle, AMBER alert, or an arrest warrant — the ALPR technology alerts the law enforcement officer. While some suggest this technology is useful for modern policing, others raise concerns over an invasion of peoples’ civil liberties. Whether or not a hit occurs, all license plate scans are sent to large regional databases that aggregate ALPR data from various law enforcement agencies. The ACLU reports that an estimated 1% of ALPR data results in a hit and the other 99% of data has no relation to criminal activity. Databases maintained for northern California law enforcement agencies, San Diego law enforcement agencies, and private companies (such as insurance companies, collections agencies, and private investigators) contain 100 million, 49 million, and more than 1 billion license plate scans, respectively. Some argue that this information has the potential to be involved in large-scale security breach issues.
The use of ALPR technology is growing. The ACLU estimates that nationally, 75% of law enforcement currently uses ALPRs, 85% plan to expand their use, and within the next five years at least 25% of all police vehicles will be equipped with the technology.
Privacy concerns. The collection of a license plate number, location, and time stamp over multiple time points can identify not only a person’s exact whereabouts but also their pattern of movement. Unlike other types of personal information that are covered by existing law, civilians are not always aware when their ALPR data is being collected. One does not even need to be driving to be subject to ALPR technology: A car parked on the side of the road can be scanned by an ALPR system.
This bill will put in place minimal privacy protections by requiring the establishment of privacy and usage protection policies for ALPR operators and end users. This bill does not prevent the authorized sharing of data, but if data is shared, it must be justified and recorded.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
According to the Assembly Appropriations Committee:
The state’s Data Breach Protection Law requires a public agency or California business that owns or licenses computerized data containing personal information to disclose a breach of the system’s security or data to any California resident whose unencrypted personal information was acquired by an unauthorized person. If the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, the agency or business can use one of several alternative methods of notification, including posting a notice on the entity’s website.
The California Highway Patrol (CHP) could incur unknown but likely minor costs to provide notifications in the event of a data breach. Because the department’s ALPR system contains several million plates at any one time, it would likely use the less costly alternative means of notification. Other provisions of this bill are consistent with existing requirements placed on the CHP’s use of ALPR.
Potentially significant, but non-reimbursable costs to comply with this bill’s requirements for those local law enforcement agencies that elect to operate ALPR systems. Similar to the CHP, local agencies could also incur notification-related costs in the event of a data breach of their ALPR systems.
Bay Area Civil Liberties Coalition
California Civil Liberties Council
Conference of California Bar Associations
Media Alliance
Small Business California
None received
ASSEMBLY FLOOR: 71-5, 9/3/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mayes, McCarty, Medina, Mullin, Nazarian, O'Donnell, Olsen, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Waldron, Weber, Wilk, Williams, Wood, Atkins
NOES: Grove, Jones, Mathis, Obernolte, Wagner
NO VOTE RECORDED: Beth Gaines, Gallagher, Melendez, Patterson
Prepared by: Randy Chinn / T. & H. / (916) 651-4121
9/3/15 18:02:01
**** END ****
SB 34
Page 4
SENATE THIRD READING
SB 34
(Hill)
As Amended September 1, 2015
Majority vote
SENATE VOTE: 25-12
Committee |
Votes |
Ayes |
Noes |
Transportation |
13-1 |
Frazier, Achadjian, Bloom, Campos, Chu, Daly, Dodd, Eduardo Garcia, Gomez, Linder, Medina, Nazarian, O'Donnell |
Melendez |
Privacy |
11-0 |
Gatto, Wilk, Baker, Calderon, Chang, Chau, Cooper, Dababneh, Dahle, Gordon, Low |
|
Appropriations |
14-3 |
Gomez, Bloom, Bonta, Calderon, Chang, Daly, Eggman, Eduardo Garcia, Holden, Quirk, Rendon, Wagner, Weber, Wood |
Bigelow, Gallagher, Jones |
SUMMARY: Imposes a variety of security, privacy, and public hearing requirements on the use of automated license plate recognition (ALPR) systems, as well as a private right of action and provisions for remedies. Specifically, this bill:
Requires that data collected through the use or operation of an ALPR system be treated as personal information for purposes of existing data breach notification laws applying to agencies, persons, or businesses that conduct business in California and own or license computerized data including personal information.
Requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information from unauthorized access, destruction, use, modification, or disclosure.
Requires an ALPR operator and ALPR end-user to implement and maintain a usage and privacy policy, as specified, which shall be available in writing to the public, and conspicuously posted on the operator or end-user's website if one exists.
Requires the ALPR operator usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for using the ALPR system and collecting ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to use the ALPR system or collect and access ALPR information.
A description of how the use of how the ALPR system will be monitored for compliance with privacy laws.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR system responsible for implementing the policy.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
Requires ALPR operators to maintain a record of access to ALPR information, including the date and time of access, the license plate number which was queried, the username of the person who accessed the information, and the purpose for accessing the information.
Requires the ALPR end-user's usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for accessing and using ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to access and use ALPR information.
A description of how the use of ALPR systems will be monitored to ensure the security of the information accessed or used, and compliance with privacy laws and the process for periodic system audits, as specified.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
Allows an individual who has been harmed by a violation of these requirements to bring a civil action against a person who knowingly caused the violation.
Authorizes a court to award any or all of the following remedies:
Actual damages, but not less than liquidated damages in the amount of $2,500;
Punitive damages upon proof of willful or reckless disregard of the law;
Reasonable attorney's fees and other litigation costs reasonably incurred; and,
Other preliminary and equitable relief as the court determines to be appropriate.
Requires that a public agency that operates or intends to operate an ALPR system to provide an opportunity for public comment at a public meeting of the agency's governing body before implementing the program.
Prohibits a public agency from selling, sharing or transferring ALPR information, except to another public agency and only as permitted by law, although data hosting services are exempted.
Defines the terms "automated license plate recognition end-user," "automated license plate recognition information," "automated license plate recognition operator," "automated license plate recognition system," "person," and "public agency."
Double-joints this bill with AB 964 (Chau) and SB 570 (Jackson) of the current legislative session, to avoid chaptering out conflicts.
FISCAL EFFECT: According to the Assembly Appropriations Committee:
The state's Data Breach Protection Law requires a public agency or California business that owns or licenses computerized data containing personal information to disclose a breach of the system's security or data to any California resident whose unencrypted personal information was acquired by an unauthorized person. If the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, the agency or business can use one of several alternative methods of notification, including posting a notice on the entity’s website.
The California Highway Patrol (CHP) could incur unknown, but likely minor costs to provide notifications in the event of a data breach. Because the department's ALPR system contains several million plates at any one time, it would likely use the less costly alternative means of notification. Other provisions of this bill are consistent with existing requirements placed on the CHP's use of ALPR.
Potentially significant, but non-reimbursable costs to comply with this bill's requirements for those local law enforcement agencies that elect to operate ALPR systems. Similar to the CHP, local agencies could also incur notification-related costs in the event of a data breach of their ALPR systems.
COMMENTS: ALPR is a common public safety enforcement method that utilizes optical character recognition to read vehicle license plates. ALPR systems typically use infrared lighting and a variety of algorithms to take a picture of a license plate, identify any text, and determine the proper letter/number sequence on the plate. This technology also allows an ALPR camera to capture license plate images at any time of the day or night. Once a license plate is scanned, in most cases, the license plate sequence is then checked against a variety of databases to determine if the vehicle is stolen, has outstanding tickets, or whether the registered owner possesses outstanding arrest warrants. If a "hit" occurs, the ALPR system alerts the appropriate law enforcement entity. While many law enforcement and local government entities utilize ALPR technology, ALPR hardware and systems are generally developed and managed by non-governmental entities.
Aside from the California Highway Patrol and local transportation agencies, existing law is silent on how government agencies and businesses manage and protect the data gathered by ALPR systems. The author introduced this bill to institute a number of usage and privacy standards for the operation of ALPR systems within the state. Additionally, the author notes that this bill also provides an opportunity for public input on the usage and standards of ALPR system that are used by government entities, something the author contends most government entities do not practice.
With the use of ALPR technology by government agencies and private industry becoming commonplace, states are now discussing how to best use and manage the data collected through these systems. According to the National Conference of State Legislators (NCSL), 18 states have introduced legislation attempting to establish or revise standards and privacy requirements related to ALPR systems. Additionally, nine states have enacted laws in some form that address the use and management of data collected through ALPR systems.
This bill aims to establish a minimal set of privacy standards for personal data collected by a person or entity using ALPR technology.
Please see the policy committee analysis for a full discussion of this bill.
Analysis Prepared by: Manny Leon / TRANS. / (916) 319-2093 FN: 0001857
SB 34
Page 4
SENATE THIRD READING
SB 34
(Hill)
As Amended July 13, 2015
Majority vote
SENATE VOTE: 25-12
Committee |
Votes |
Ayes |
Noes |
Transportation |
13-1 |
Frazier, Achadjian, Bloom, Campos, Chu, Daly, Dodd, Eduardo Garcia, Gomez, Linder, Medina, Nazarian, O'Donnell |
Melendez |
Privacy |
11-0 |
Gatto, Wilk, Baker, Calderon, Chang, Chau, Cooper, Dababneh, Dahle, Gordon, Low |
|
Appropriations |
14-3 |
Gomez, Bloom, Bonta, Calderon, Chang, Daly, Eggman, Eduardo Garcia, Holden, Quirk, Rendon, Wagner, Weber, Wood |
Bigelow, Gallagher, Jones |
SUMMARY: Imposes a variety of security, privacy, and public hearing requirements on the use of automated license plate recognition (ALPR) systems, as well as a private right of action and provisions for remedies. Specifically, this bill:
Requires that data collected through the use or operation of an ALPR system be treated as personal information for purposes of existing data breach notification laws applying to agencies, persons, or businesses that conduct business in California and own or license computerized data including personal information.
Requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information from unauthorized access, destruction, use, modification, or disclosure.
Requires an ALPR operator and ALPR end-user to implement and maintain a usage and privacy policy, as specified, which shall be available in writing to the public, and conspicuously posted on the operator or end-user's website if one exists.
Requires the ALPR operator usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for using the ALPR system and collecting ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to use the ALPR system or collect and access ALPR information.
A description of how the use of how the ALPR system will be monitored for compliance with privacy laws.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR system responsible for implementing the policy.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
Requires ALPR operators to maintain a record of access to ALPR information, including the date and time of access, the license plate number which was queried, the username of the person who accessed the information, and the purpose for accessing the information.
Requires the ALPR end-user's usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for accessing and using ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to access and use ALPR information.
A description of how the use of ALPR systems will be monitored to ensure the security of the information accessed or used, and compliance with privacy laws and the process for periodic system audits, as specified.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
Allows an individual who has been harmed by a violation of these requirements to bring a civil action against a person who knowingly caused the violation.
Authorizes a court to award any or all of the following remedies:
Actual damages, but not less than liquidated damages in the amount of $2,500;
Punitive damages upon proof of willful or reckless disregard of the law;
Reasonable attorney's fees and other litigation costs reasonably incurred; and,
Other preliminary and equitable relief as the court determines to be appropriate.
Requires that a public agency that operates or intends to operate an ALPR system to provide an opportunity for public comment at a public meeting of the agency's governing body before implementing the program.
Prohibits a public agency from selling, sharing or transferring ALPR information, except to another public agency and only as permitted by law, although data hosting services are exempted.
Defines the terms "automated license plate recognition end-user," "automated license plate recognition information," "automated license plate recognition operator," "automated license plate recognition system," "person," and "public agency."
FISCAL EFFECT: According to the Assembly Appropriations Committee:
The state's Data Breach Protection Law requires a public agency or California business that owns or licenses computerized data containing personal information to disclose a breach of the system's security or data to any California resident whose unencrypted personal information was acquired by an unauthorized person. If the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, the agency or business can use one of several alternative methods of notification, including posting a notice on the entity’s website.
The California Highway Patrol (CHP) could incur unknown, but likely minor costs to provide notifications in the event of a data breach. Because the department's ALPR system contains several million plates at any one time, it would likely use the less costly alternative means of notification. Other provisions of this bill are consistent with existing requirements placed on the CHP's use of ALPR.
Potentially significant, but nonreimbursable costs to comply with this bill's requirements for those local law enforcement agencies that elect to operate ALPR systems. Similar to the CHP, local agencies could also incur notification-related costs in the event of a data breach of their ALPR systems.
COMMENTS: ALPR is a common public safety enforcement method that utilizes optical character recognition to read vehicle license plates. ALPR systems typically use infrared lighting and a variety of algorithms to take a picture of a license plate, identify any text, and determine the proper letter/number sequence on the plate. This technology also allows an ALPR camera to capture license plate images at any time of the day or night. Once a license plate is scanned, in most cases, the license plate sequence is then checked against a variety of databases to determine if the vehicle is stolen, has outstanding tickets, or whether the registered owner possesses outstanding arrest warrants. If a "hit" occurs, the ALPR system alerts the appropriate law enforcement entity. While many law enforcement and local government entities utilize ALPR technology, ALPR hardware and systems are generally developed and managed by non-governmental entities.
Aside from the California Highway Patrol and local transportation agencies, existing law is silent on how government agencies and businesses manage and protect the data gathered by ALPR systems. The author introduced this bill to institute a number of usage and privacy standards for the operation of ALPR systems within the state. Additionally, the author notes that this bill also provides an opportunity for public input on the usage and standards of ALPR system that are used by government entities, something the author contends most government entities do not practice.
With the use of ALPR technology by government agencies and private industry becoming commonplace, states are now discussing how to best use and manage the data collected through these systems. According to the National Conference of State Legislators (NCSL), 18 states have introduced legislation attempting to establish or revise standards and privacy requirements related to ALPR systems. Additionally, nine states have enacted laws in some form that address the use and management of data collected through ALPR systems.
This bill aims to establish a minimal set of privacy standards for personal data collected by a person or entity using ALPR technology.
Please see the policy committee analysis for a full discussion of this bill.
Analysis Prepared by: Manny Leon / TRANS. / (916) 319-2093 FN: 0001432
Date of Hearing: August 19, 2015
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Jimmy Gomez, Chair
SB 34
(Hill) – As Amended July 13, 2015
Policy Committee: |
Transportation |
Vote: |
13 - 1 |
|
Privacy and Consumer Protection |
|
11 - 0 |
|
|
|
|
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill imposes security, privacy and public hearing requirements on the use of automated license plate recognition (ALPR) systems by public or private entities, and provides for a private right of action, and associated remedies, for violations of the requirements. Specifically, this bill:
Requires that data collected through the use or operation of an ALPR system be treated as personal information for purposes of the state's existing data breach notification laws applying to public agencies, persons, or businesses.
Requires an ALPR operator and an ALPR end-user to implement and maintain usage and privacy policies, as specified, to be available in writing to the public, and conspicuously posted on an operator or end-user's website.
Requires ALPR operators to maintain a record of access to ALPR information, including the date and time of access, the license plate number which was queried, the username of the person who accessed the information, and the purpose for accessing the information.
Allows an individual harmed by a violation of these requirements to bring a civil action against a person who knowingly caused the violation, and authorizes the court to award specified remedies.
Requires a public agency operating or intending to operate an ALPR system to provide an opportunity for public comment at a public meeting of the agency's governing body before implementing the program.
Prohibits a public agency from selling, sharing or transferring ALPR information, except to another public agency and only as permitted by law, although data hosting services are exempted.
FISCAL EFFECT:
The state's Data Breach Protection Law requires a public agency or California business that owns or licenses computerized data containing personal information to disclose a breach of the system's security or data to any California resident whose unencrypted personal information was acquired by an unauthorized person. If the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, the agency or business can use one of several alternative methods of notification, including posting a notice on the entity’s website.
The CHP could incur unknown, but likely minor costs to provide notifications in the event of a data breach. Because the department's ALPR system contains several million plates at any one time, it would likely use the less costly alternative means of notification. Other provisions of the bill are consistent with existing requirements placed on the CHP's use of ALPR.
Potentially significant, but nonreimbursable costs to comply with the bill's requirements for those local law enforcement agencies that elect to operate ALPR systems. Similar to the CHP, local agencies could also incur notification-related costs in the event of a data breach of their ALPR systems.
COMMENTS:
Purpose. According to the author, "While at least seven other states have already passed laws to regulate automatic license plate reader (ALPR) systems, current California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol (CHP) and transportation agencies, current California law doesn’t require any privacy safeguards or establish any protocols for the use of ALPR systems."
A 2014 report by the American Civil Liberties Union of Northern California (ACLU) found that, of 60 cities and 58 counties surveyed, a total of 57 combined had ALPR systems - but only 16 of those jurisdictions had a public policy governing their use, and only eight had hearings with public input before deploying the systems.
Background. An ALPR system is one or more mobile or fixed cameras combined with computer algorithms that can read and convert images of automobile registration plates and the characters they contain into computer-readable data showing the license plate itself, as well as the time, date and place of the picture. ALPR systems can also provide a "contextual" photo of the car itself, making information about car make and model, distinguishing features, state of registration, and driver and passage potentially available as well.
It is important to note that while ALPR does not identify a specific person by itself and is not considered "personally identifiable information", it can be linked to an identifiable person through a registration database, like that operated by the DMV.
ALPR systems operate by automatically scanning any license plate within range. Some ALPR systems can scan up to 2,000 license plates per minute. In the private sector, ALPR systems are used to monitor parking facilities and assist repossession companies in identifying vehicles, and even gated communities use ALPRs to monitor and regulate access.
When used by law enforcement, each scanned license plate is checked against a variety of databases, such as the federal AMBER Alert for missing children, or the National Crime Information Center, which aggregates 21 different databases tracking categories such as stolen property, sex offenders, immigration violators, gang affiliates, and known violent persons. If one of the license plates photographed by the system gets a hit based on a match with one of the databases or some other 'hot list', the ALPR system can alert the law enforcement officer in real time so she or he can take action.
ALPR Restrictions on CHP. A 2011 transportation budget trailer bill restricted the use of ALPR technology by the CHP by only authorizing the department to retain data captured by ALPR systems for 60 days, except where the data is being used for felony investigations or as evidence. The CHP is also prohibited from selling the data for any purpose or making the data available to an agency or person other than law enforcement agencies or officers. The data may only be used by law enforcement agencies for purposes of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense. The CHP is required to monitor the internal use of ALPR data to prevent unauthorized use, and to regularly report to the Legislature on its ALPR practices and uses.
Prior Legislation. SB 893 (Hill), of 2014, which was similar to this bill, failed passage on the Senate Floor.
Analysis Prepared by: Chuck Nicol / APPR. / (916) 319-2081
SB 34
Page 8
Date of Hearing: July 7, 2015
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Mike Gatto, Chair
SB 34
(Hill) – As Amended July 2, 2015
SENATE VOTE: 25-12
SUBJECT: Automated license plate recognition systems: use of data.
SUMMARY: Imposes a variety of security, privacy and public hearing requirements on the use of automated license plate recognition (ALPR) systems, as well as a private right of action and provisions for remedies. Specifically, this bill:
Requires that data collected through the use or operation of an ALPR system be treated as personal information for purposes of existing data breach notification laws applying to agencies, persons, or businesses that conduct business in California and own or license computerized data including personal information.
Requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information from unauthorized access, destruction, use, modification, or disclosure.
Requires an ALPR operator and ALPR end-user to implement and maintain a usage and privacy policy, as specified, which shall be available in writing to the public, and conspicuously posted on the operator or end-user's website if one exists.
Requires the ALPR operator usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for using the ALPR system and collecting ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to use the ALPR system or collect and access ALPR information.
A description of how the use of how the ALPR system will be monitored for compliance with privacy laws.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR system responsible for implementing the policy.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.
Requires ALPR operators to maintain a record of access to ALPR information, including the date and time of access, the license plate number which was queried, the username of the person who accessed the information, and the purpose for accessing the information.
Requires the ALPR end-user's usage and privacy policy to include, at a minimum, all of the following:
The authorized purposes for accessing and using ALPR information.
A description of the job title or other designation of the employees and independent contractors, and their training requirements, who are authorized to access and use ALPR information.
A description of how the use of ALPR systems will be monitored to ensure the security of the information accessed or used, and compliance with privacy laws and the process for periodic system audits, as specified.
The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.
The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.
A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors.
The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.
Allows an individual who has been harmed by a violation of these requirements to bring a civil action against a person who knowingly caused the violation.
Authorizes a court to award any or all of the following remedies:
Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500);
Punitive damages upon proof of willful or reckless disregard of the law;
Reasonable attorney’s fees and other litigation costs reasonably incurred; and,
Other preliminary and equitable relief as the court determines to be appropriate.
Requires that a public agency that operates or intends to operate an ALPR system to provide an opportunity for public comment at a public meeting of the agency's governing body before implementing the program.
Prohibits a public agency from selling, sharing or transferring ALPR information, except to another public agency and only as permitted by law, although data hosting services are exempted.
Defines the terms "automated license plate recognition end-user," "automated license plate recognition information," "automated license plate recognition operator," "automated license plate recognition system," "person," and "public agency."
EXISTING LAW:
Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)
Permits the California Highway Patrol (CHP) to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Vehicle Code (VC) Section 2413(b)
Prohibits the CHP from selling ALPR data for any purpose and making it available to an agency that is not a law enforcement agency or an individual who is not a law enforcement officer. The data may be used by a law enforcement agency only for purposes of locating vehicles or persons when either is reasonably suspected of being involved in the commission of a public offense. (VC 2413(c))
Requires the CHP to monitor internal use of the ALPR data to prevent unauthorized use. (VC 2413(d))
Requires the CHP to report to the Legislature its ALPR practices and usage, including the number of ALPR data disclosures, a record of the agencies to which data was disclosed and for what purpose, and any changes in policy that affect privacy concerns. (VC 2413(e))
Requires, pursuant to the Data Breach Protection Law, a public agency, or a person or business conducting business in California, that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system or data following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civil Code (CC) Section 1798.29; CC 1798.82)
FISCAL EFFECT: According to the Senate Appropriations Committee:
Potentially significant local law enforcement agency costs to comply with the provisions of this measure, to the extent those entities wish to operate ALPR systems. As the use or access of ALPR systems is not a mandated activity, the implementation of additional security, privacy, and access protocols and procedures are estimated to be non-reimbursable by the state.
Potential periodic minor to significant costs to public (State/Local) and private ALPR operators, to issue data breach notifications. Private entities and public agencies are already subject to data breach notification law, so costs would be dependent on the frequency and size of data breaches specific to unencrypted ALPR data, and the process of notification utilized by each agency.
COMMENTS:
Purpose of this bill. This bill is intended to bring greater transparency to the use of ALPR systems by requiring operators and end-users, as defined, to adopt an ALPR usage and privacy policy, and also requiring public agencies to hold a public hearing before utilizing an ALPR system. This bill is author-sponsored.
Author's statement. According to the author, "While at least seven other states have already passed laws to regulate automatic license plate reader (ALPR) systems, current California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol (CHP) and transportation agencies, current California law doesn’t require any privacy safeguards or establish any protocols for the use of ALPR systems."
"Not only has the law failed to keep up with the quick adoption of ALPR, but the entities using ALPR have also been slow in crafting their own internal policies. For example, according to the International Association of Chiefs of Police, only 48% of police agencies across the country have developed policies that govern ALPR use and privacy."
Automated License Plate Reader technology. An ALPR system is one or more mobile or fixed cameras combined with computer algorithms that can read and convert images of automobile registration plates and the characters they contain into computer-readable data showing the license plate itself, as well as the time, date and place of the picture. ALPR systems can also provide a "contextual" photo of the car itself, making information about car make and model, distinguishing features, state of registration, and driver and passage potentially available as well.
It is important to note that while ALPR does not identify a specific person by itself and is not considered "personally identifiable information", it can be linked to an identifiable person through a registration database, like that operated by the Department of Motor Vehicles.
ALPR systems operate by automatically scanning any license
plate within range. Some ALPR systems can scan up to 2,000 license
plates per minute. In the private sector, ALPR systems are used to
monitor parking facilities and assist repossession companies in
identifying vehicles, and even gated communities use ALPRs to monitor
and regulate access.
When used by law enforcement, each scanned license plate is
checked against a variety of databases, such as the federal AMBER
Alert for missing children, or the National Crime Information Center,
which aggregates 21 different databases tracking categories such as
stolen property, sex offenders, immigration violators, gang
affiliates, and known violent persons. If one of the license plates
photographed by the system gets a hit based on a match with one of
the databases or some other 'hot list', the ALPR system can alert the
law enforcement officer in real time so she or he can take action.
According to a May 16, 2014, article in the Los Angeles Times
entitled "Use
of license plate photo databases is raising privacy concerns",
the ALPR business is booming: "The
industry is growing rapidly. A 2010 study showed a third of large
police departments using plate readers. In 2012, the most recent data
available, a survey found more than 70% of the nation's police
departments had the scanners."
A
2014 report by the American Civil Liberties Union of Northern
California (ACLU) found that, of 60 cities and 58 counties surveyed,
a total of 57 combined had ALPR systems - but only 16 of those
jurisdictions had a public policy governing their use, and only eight
had hearings with public input before deploying the systems. And
while the ACLU estimates known public spending on ALPR systems to be
nearly $15 million, it maintains that "[t]he
resulting data is almost certainly just the tip of the iceberg,
especially since surveillance technology acquired through outside
resources (such as federal government grants, police foundations or
surveillance vendors) may sidestep some or all of the normal local
decision-making process."
According to the
National Conference on State Legislatures, ALPR
bills have been introduced or are pending in at least
17 other states in 2015.
Law enforcement use of ALPR systems. ALPR systems can be used to serve four specific public safety goals: (a) crime analysis; (b) alert law enforcement officials that a license plate number on a "hot list" is nearby; (c) monitor the movements of vehicles operated by individuals with travel restrictions; and (d) identify criminal conduct that was otherwise unnoticed. Hot lists may be compiled by the local law enforcement agency utilizing the ALPR system or by other state or federal government agencies. The purpose of these lists is to signal a law enforcement official that a vehicle displaying a license plate number that is included on a hot list is near an ALPR camera.
The databases built and maintained for law enforcement use are large and growing. According to the author, "A database that is maintained on behalf of various northern California law enforcement agencies reportedly has over 100 million unique license plate scans. A database maintained on behalf of San Diego law enforcement agencies reportedly has well over 49 million license plate scans. A company that maintains an ALPR database for private companies, such as insurance companies, collections agencies, and private investigators, has over 1 billion license plate scans."
The provision of these systems and
related database services are also big business. The LA Times
article made mention of one of the most well-known companies in this
space, Livermore-based Vigilant Solutions. "Vigilant
in particular has seen its appeal among law enforcement officers grow
because it can offer police departments access to a trove of more
than 2 billion scans, maintained by an affiliated company, Digital
Recognition Network. That database is fed by cameras attached to
vehicles driven by repossession agents roving the nation's roadways.
The two companies have 160 employees. Vigilant reports having more
than 3,500 law enforcement clients that
either use the company's cameras or
access its data. Digital Recognition Network has more than 250
customers. A Vigilant representative estimated that the entire
industry brings in as much as $500 million a year."
Existing ALPR restrictions on law enforcement. A 2011 transportation budget trailer bill restricted the use of ALPR technology by the California Highway Patrol (CHP). Pursuant to AB 115 (Committee on Budget), Chapter 38, Statutes of 2011, the CHP is only authorized to retain data captured by ALPR systems for 60 days, except where the data is being used for felony investigations or as evidence. The CHP is also prohibited from selling the data for any purpose or making the data available to an agency or person other than law enforcement agencies or officers. The data may only be used by law enforcement agencies for purposes of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense. The CHP is required to monitor the internal use of ALPR data to prevent unauthorized use, and to regularly report to the Legislature on its ALPR practices and uses.
Privacy concerns related to the use of ALPR systems. According to a 2009 report by the International Association of Chiefs of Police, "LPR systems have the potential to reveal to the government individuals’ driving habits. As LPR systems become more widespread, and as law enforcement agencies improve their information sharing capabilities, the potential to monitor where and when a particular vehicle has traveled is enhanced. Recording driving habits could implicate First Amendment concerns."
"Specifically, LPR systems have the ability to record vehicles’ attendance at locations or events that, although lawful and public, may be considered private. For example, mobile LPR units could read and collect the license plate numbers of vehicles parked at addiction counseling meetings, doctors’ offices, health clinics, or even staging areas for political protests.
"Several prominent privacy groups view information concerning individuals’ locations as inherently prone to abuses, including expanding data uses beyond the original purposes of collection, sharing data with third parties beyond reasonable expectations, and heightening individuals’ vulnerability to crime."
The ACLU's July 2013 report "You Are Being Tracked" puts the concern more bluntly: "Automatic license plate readers have the potential to create permanent records of virtually everywhere any of us has driven, radically transforming the consequences of leaving home to pursue private life, and opening up many opportunities for abuse. The tracking of people’s location constitutes a significant invasion of privacy, which can reveal many things about their lives, such as what friends, doctors, protests, political events, or churches a person may visit. In our society, it is a core principle that the government does not invade people’s privacy and collect information about citizens’ innocent activities just in case they do something wrong. Clear regulations must be put in place to keep the government from tracking our movements on a massive scale."
Proposed Committee amendments. According to the California Bankers Association, the current language contained in the definition of an ALPR end-user was intended to exempt the financial services industry (because it is already regulated under the federal Gramm-Leach-Bliley Act for data security) – but the language still requires adherence to the privacy policy of an ALPR operator.
To effect that change, the Committee and author may wish to consider the following amendments:
At Civil Code Section 1798.90.5 (a)(2), strike the words "(B) The person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information."
At Civil Code Section 1798.90.5 (a)(3), strike the words ", if the person has agreed to comply with and is subject to the privacy policy of the ALPR operator providing the information"
At Civil Code Section 1798.90.52, renumber the existing language under subdivision (a), and add the following language as (b): "Require that the ALPR information only be used for the authorized purposes described in the usage and privacy policy required by section 1798.90.51(b)."
Additionally, representatives of law enforcement have pointed out that, in addition to data hosting services, law enforcement occasionally contracts with private towing companies to impound vehicles. It was not the intent of the section prohibiting sale or sharing of information by public agencies to interfere with such activity, and so the following amendment would exempt towing services as well:
At Civil Code Section 1798.90.55(b), after the word "hosting" add "and towing"
Previous legislation. SB 893 (Hill), of 2014, would have placed restrictions on the use of ALPR technology by both public-sector and private-sector users, in a manner similar to this bill. SB 893 failed passage on the Senate Floor.
SB 1330 (Simitian) of 2011 would have placed restrictions on the use of license plate recognition (LPR) technology by private entities, including restrictions on the retention, use, and sale of such data. SB 1330 failed passage on the Senate Floor.
AB 115 (Committee on Budget), Chapter 38, Statutes of 2011, allows the California Highway Patrol (CHP) to retain data captured by ALPR systems for no more than 60 days, and also prohibits the CHP from selling ALPR data or making it available to anyone other than law enforcement agencies.
SB 854 (Committee on Budget and Fiscal Review) of 2010 would have
authorized the California Highway Patrol to retain ALPR data for not
more than 72 hours unless the data is being used as evidence or for a
legitimate law enforcement purpose, and also would have prohibited
CHP from selling ALPR data or making the data available to an agency
that is not a law enforcement agency or an individual that is not a
law enforcement officer. SB 854 failed passage on the Senate
Floor.
AB 1614 (Committee on Budget and Fiscal Review) of
2010 would have authorized the California Highway Patrol to retain
ALPR data for not more than 72 hours unless the data is being used as
evidence or for a legitimate law enforcement purpose, and also would
have prohibited CHP from selling ALPR data or making the data
available to an agency that is not a law enforcement agency or an
individual that is not a law enforcement officer. AB 1614 died on
the Senate Floor.
Potential chaptering conflicts with other bills. Because this bill would amend the code sections related to California's data breach notification law, it presents a potential chaptering conflict with four other measures: AB 259 (Dababneh), AB 739 (Irwin), AB 964 (Chau), and SB 570 (Jackson).
Double referral. This bill was double-referred to the Assembly Transportation Committee, where it was heard on June 22, 2015 and passed out on a 13-1 vote.
REGISTERED SUPPORT / OPPOSITION:
Support
Bay Area Civil Liberties Coalition
California Civil Liberties Advocacy
Citizens for Criminal Justice Reform California
Conference of California Bar Associations
Media Alliance
Small Business California
Opposition
None received.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200
SB 34
Page 4
Date of Hearing: June 22, 2015
ASSEMBLY COMMITTEE ON TRANSPORTATION
Jim Frazier, Chair
SB 34
(Hill) – As Amended April 22, 2015
SENATE VOTE: 25-12
SUBJECT: Automated license plate recognition systems: use of data.
SUMMARY: Establishes provisions on the usage of automatic license plate recognition (ALPR) data and expands the meaning of “personal information” to include information or data collected through the use or operation of an ALPR system, as specified. Specifically, this bill:
Specifies that a person's information collected through the use or operation of an ALPR system by a person or business is considered personal information for purposes of personal data collection or customer records, as specified.
Defines an ALPR system as a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
Defines ALPR information to mean information or data collected through the use of an ALPR system.
Defines an ALPR end-user as a person that accesses or uses ALPR information and an ALPR operator as a person that operates an ALPR system, or that stores or maintains ALPR information. Specifies, a "person" may include a law enforcement agency, government agency, private entity, or individual.
Specifies that an ALPR end-user or operator does not include a transportation agency, as defined.
Requires that ALPR operators ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
Requires that ALPR operators implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
Requires that ALPR operators and end users implement and maintain a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for an individuals’ privacy and civil liberties.
Requires the ALPR operator and end-user's usage and privacy policy contain a minimum set of information, as specified.
Requires ALPR operators that access or provide access to ALPR information to maintain a record of that access. The record must include the date and time of access, the license plate number which was queried, the name of the person who accessed the information and if possible, the organization or entity with whom the person is affiliated, and the purpose for accessing the information.
Allows an individual who has been harmed by a violation of this title to bring a civil action against a person who knowingly caused the violation. The court can award damages which are stipulated in this bill.
Requires a public agency that considers using an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the agency before it implements the program of ALPR use.
EXISTING LAW:
Requires any agency, person, or business that is conducting business within the state that owns or licenses compuerized data that includes personal information, to disclose any breach of security of the system or data following the discovery of the security breach to any person within the state whose personal information was or suspected to be acquired by an unauthorized person, as specified.
Defines "personal information" for the abovementioned purposes to include an individual's first and last name, or first initial and last name, in combination with one or more designated data elements relating to social security numbers, driver's license numbers, financial accounts, and medical information.
Prohibits a transporation agency from selling or otherwise providing to any other person or entity personally identifiable information of any person who subscribes to an electronic toll or transit fare collection system or uses a tolling faciltiy that employs an electronic toll collection system, as specfied.
Requires a transportation agency that employs an electronic toll collection or an electronic transit fare collection system to establish a privacy policy regarding the collection and use of personally identifiable information and provide subscribers of that system a copy of the privacy policy, as specified.
FISCAL EFFECT: Unknown
COMMENTS: ALPR is a common public safety enforcement method that utilizes optical character recognition to read vehicle license plates. ALPR systems typically use infrared lighting and a variety of algorithms to take a picture of a license plate, identify any text, and determine the proper letter/number sequence on the plate. This technology also allows an ALPR camera to capture license plate images at any time of the day or night. Once a license plate is scanned, in most cases, the license plate sequence is then checked against a variety of databases to determine if the vehicle is stolen, has outstanding tickets, or whether the registered owner possesses outstanding arrest warrants. If a "hit" occurs, the ALPR system alerts the appropriate law enforcement entity. While many law enforcement and local government entities utilize ALPR technology, ALPR hardware and systems are generally developed and managed by non-governmental entities.
Aside for the California Highway Patrol and local transportation agencies, existing law is silent on how government agencies and businesses manage and protect the data gathered by ALPR systems. The author introduced this bill to institute a number usage and privacy standards for the operation of ALPR systems within the state. Additionally, the author notes that this bill also provides an opportunity for public input on the usage and standards of ALPR system that are used by government entities, something the author contends most government entities do not practice.
With the use of ALPR technology by government agencies and private industry becoming commonplace, states are now discussing how to best use and manage the data collected through these systems. According to the National Conference of State Legislators (NCSL), 18 states have introduced legislation attempting to establish or revise standards and privacy requirements related to ALPR systems. Additionally, 9 states have enacted laws in some form that address the use and management of data collected through ALPR systems.
Furthermore, while the discussion of ALPR standards is ongoing at the state level, privacy concerns surrounding to the collection of personal information remains a key policy issue that has been raised by a number of stakeholders. According to a 2013 study conducted by the American Civil Liberties Union (ACLU), the ACLU found that an estimated one percent of ALPR scans resulted in a "hit" while the other 99% of data had no relation to criminal activity. Thus, when an ALPR system is used by law enforcement, whether or not a "hit" occurs, all license plate scans are transmitted and checked by databases that aggregate and store license plate data. This data that is collected, for example, may be used to by law enforcement to investigate and enforce the law; however, minimal, if any, requirements exist on how this data is managed, stored, retained, accessed, or shared.
SB 34 aims to establish a minimal set of privacy standards for personal data collected by a person or entity using ALPR technology. SB 34 further exempts transportation agencies involved in automatic toll and transit fare collection from the provisions specified in this bill as existing law sets privacy standards for personal data collected using ALPR technology for these purposes. The author asserts SB 34 will put in place regulations for businesses and agencies which currently do not have any policies regarding the use of ALPR data and exempt transportation agencies which are already regulated by existing law.
Previous legislation: SB 893 (Hill) of 2014, would have placed restrictions on the use of ALPR technology by both public and private sector users. SB 893 died on the Senate Inactive File.
AB 179 (Bocanegra, Chapter 375, Statutes of 2013) prohibits transportation agencies and other entities that employ an electronic transit fare collection system (ETFC) for the payment of transit fares from selling or providing to third parties any personally identifiable information obtained through a person’s participation in an ETFC, with certain exceptions.
SB 1330 (Simitian) of 2011, would have placed restrictions on the use of automated license plate recognition technology by private entities, including restrictions on the retention, use, and sale of such data. SB 1330 would have also restricted the ability for a person to transfer ALPR data to a law enforcement agency absent a search warrant or other specified circumstances. SB 1330 died on the Senate Floor.
SB 1268 (Simitian, Chapter 489, Statutes of 2010) prohibits transportation agencies from selling, or providing to any other person, the personally identifiable information of either subscribers of an electronic toll collection system or anyone who uses a toll bridge, lane, or highway that utilizes an electronic toll collection system.
Double referral: This bill will be referred to the Assembly Privacy and Consumer Protection Committee should it pass out of this committee.
REGISTERED SUPPORT / OPPOSITION:
Support
Bay Area Civil Liberties Coalition
California Civil Liberties Council
Media Alliance
Small Business California
Opposition
None on file
Analysis Prepared by: Manny Leon / TRANS. / (916) 319-2093
SB 34
Page 6
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: SB 34
Amended: 4/22/15
SENATE TRANS. & HOUSING COMMITTEE: 8-2, 4/7/15
AYES: Beall, Allen, Galgiani, Leyva, McGuire, Mendoza, Roth, Wieckowski
NOES: Bates, Gaines
NO VOTE RECORDED: Cannella
SENATE JUDICIARY COMMITTEE: 4-2, 4/14/15
AYES: Jackson, Leno, Monning, Wieckowski
NOES: Vidak, Anderson
NO VOTE RECORDED: Hertzberg
SENATE APPROPRIATIONS COMMITTEE: 5-2, 5/4/15
AYES: Lara, Beall, Hill, Leyva, Mendoza
NOES: Bates, Nielsen
SUBJECT: Automated license plate recognition systems: use of data
DIGEST: This bill establishes regulations on the privacy and usage of automatic license plate recognition (ALPR) data and expands the meaning of “personal information” to include information or data collected through the use or operation of an ALPR system.
Existing law:
1) Places regulations on agencies, persons, or businesses that own, license, or maintain computerized data that includes personal information. These regulations include disclosing a breach of security.
2) Prohibits a transportation agency from selling or providing personally identifiable information of any person who subscribes to an electronic toll or electronic transit fare collection system or who uses a toll bridge, toll lane, or toll highway that employs an electronic toll collection system. Agencies covered by this regulation are the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system and any transit operator participating in that system, or any entity under contract with the above-mentioned entities.
3) Requires that transportation agencies employing an electronic toll or transit fare collection system establish a privacy policy for the collection and use of personally identifiable information and provide users with a copy of the privacy policy. Transportation agencies include the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system, and any transit operator participating in that system, or any entity under contract with the above-mentioned entities.
4) Establishes limits on the length of time that transportation agencies may keep personal information. All information may be kept only as long as necessary to perform account functions. All other information must be discarded within 4½ years after the conclusion of the billing cycle.
This bill:
1) Defines an ALPR system as a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
2) Requires that data collected through the use or operation of an ALPR system be considered as personal information subject to existing law pertaining to agencies, persons, or businesses that conduct business in California, and that own or license computerized data including personal information.
3) Defines an ALPR end-user as a person that accesses or uses ALPR information and an ALPR operator as a person that operates an ALPR system, or that maintains ALPR information, with the exception of transportation agencies. A person may include a law enforcement agency, government agency, private entity, or individual.
4) Requires that ALPR operators ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
5) Requires that ALPR operators implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
6) Requires that ALPR operators and end users implement and maintain a usage and privacy policy in order to ensure that the collection, access, and use of ALPR information is consistent with respect for individuals’ privacy and civil liberties.
7) Requires that the usage and privacy policy include, in part:
the purpose for using ALPR systems/data
a list of authorized users of ALPR systems/data
how the ALPR systems/data will be monitored
how ALPR operators will comply with security procedures
the length of time that ALPR information will be stored and how it will be determined whether/when to destroy retained information
the owner of the ALPR data and the employees who are responsible for implementing the usage and privacy policy
the reason and process by which ALPR data is shared with other parties
a plan for how end users will maintain security of ALPR data
8) Requires ALPR operators that access or provide access to ALPR information to maintain a record of that access. The record must include the date and time of access, the license plate number which was queried, the person who accesses the information, and the purpose of accessing the information.
9) Allows an individual who has been harmed by a violation of this title to bring a civil action against a person who knowingly caused the violation. The court can award damages which are stipulated in this bill.
10) Requires a public agency that considers using an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the agency before it implements the program of ALPR use.
Comments
Purpose. The author states that this bill is necessary to institute reasonable usage and privacy standards for the operation of ALPR systems, which do not exist for the majority of local agencies that have approved the use of ALPR technology, according to the American Civil Liberties Union (ACLU). Additionally, this bill requires an opportunity for public input on the usage and standards of ALPR technologies, something the author contends few local agencies allow. The author states that the main focus of this bill is to put in place regulations for businesses and agencies which currently do not have any policies regarding the use of ALPR data, unlike transportation agencies which are already regulated by existing law.
ALPR background and history. ALPR systems automatically scan any license plate within range. Some ALPR systems can scan 2,000 plates in a minute. When used by law enforcement, each scanned license plate is checked against crime databases. If a “hit” occurs — for example, a stolen vehicle, AMBER alert, or an arrest warrant — the ALPR technology alerts the law enforcement officer. While some suggest this technology is useful for modern policing, others raise concerns over an invasion of peoples’ civil liberties. Whether or not a hit occurs, all license plate scans are sent to large regional databases that aggregate ALPR data from various law enforcement agencies. The ACLU reports that an estimated 1% of ALPR data results in a hit and the other 99% of data has no relation to criminal activity. Databases maintained for northern California law enforcement agencies, San Diego law enforcement agencies, and private companies (such as insurance companies, collections agencies, and private investigators) contain 100 million, 49 million, and more than 1 billion license plate scans, respectively. Some argue that this information has the potential to be involved in large-scale security breach issues.
The use of ALPR technology is growing. The ACLU estimates that nationally, 75% of law enforcement currently uses ALPRs, 85% plan to expand their use, and within the next five years at least 25% of all police vehicles will be equipped with the technology.
Privacy concerns. The collection of a license plate number, location, and time stamp over multiple time points can identify not only a person’s exact whereabouts but also their pattern of movement. Unlike other types of personal information that are covered by existing law, civilians are not always aware when their ALPR data is being collected. One does not even need to be driving to be subject to ALPR technology: A car parked on the side of the road can be scanned by an ALPR system.
This bill will put in place minimal privacy protections by requiring the establishment of privacy and usage protection policies for ALPR operators and end users. This bill does not prevent the authorized sharing of data, but if data is shared, it must be justified and recorded.
Exemption for transportation agencies. This bill defines an “automated license plate recognition operator” as a person that operates an ALPR system, but exempts transportation agencies. The author states the exemption is included because transportation agencies are already required, under existing law, to establish a privacy policy for personally identifiable information. However, transportation agencies are not currently required to maintain a record of access to ALPR information, including the date and time of access, the license plate number or other data elements used to query the ALPR database or system, the person who accessed the information, and the purpose for accessing the information. Toll operators frequently access data as part of a system that captures hundreds of thousands of images daily.
According to toll authority representatives, being subject to these regulations would be extremely burdensome and inefficient for the operation of toll roads and bridges given the immense volume of transactions conducted by toll operators every day. They also contend that removing the exemption would add no substantive privacy protection for California.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
According to the Senate Appropriations Committee:
Potentially significant local law enforcement agency costs to comply with the provisions of this measure, to the extent those entities wish to operate ALPR systems. As the use or access of ALPR systems is not a mandated activity, the implementation of additional security, privacy, and access protocols and procedures are estimated to be non-reimbursable by the state.
Potential periodic minor to significant costs to public (state/local) and private ALPR operators, to issue data breach notifications. Private entities and public agencies are already subject to data breach notification law, so costs would be dependent on the frequency and size of data breaches specific to unencrypted ALPR data, and the process of notification utilized by each agency. See staff comments.
Bay Area Civil Liberties Coalition
California Civil Liberties Council
Citizens for Criminal Justice Reform California
Conference of California Bar Associations
Media Alliance
Small Business California
None received
ARGUMENTS IN SUPPORT:
The Citizens for Criminal Justice Reform California state that the language in this bill provides a long-overdue legislative framework which establishes basic policies that will enhance privacy and procedural requirements to outline the security, usage, and storage of ALPR data.
Small Business California, Media Alliance, Bay Area Civil Liberties Coalition, and the Conference of California Bar Associations all support the transparency and protections that are provided by this bill.
Prepared by: Christine Hochmuth / T. & H. / (916) 651-4121
5/6/15 17:02:41
SB 34 (Hill) Page 3 of 3
SENATE COMMITTEE ON APPROPRIATIONS
Senator Ricardo Lara, Chair
2015 - 2016 Regular Session
SB 34 (Hill) - Automated license plate recognition systems: use of data
|
|
Version: April 22, 2015 |
Policy Vote: T. & H. 8 - 2, JUD. 4 - 2 |
Urgency: No |
Mandate: No |
Hearing Date: May 4, 2015 |
Consultant: Mark McKenzie |
This bill does not meet the criteria for referral to the Suspense File.
Bill Summary:
SB 34 would establish security and privacy protocols to ensure the protection of data collected through the use of an automated license plate recognition (ALPR) system.
Fiscal Impact:
Potentially significant local law enforcement agency costs to comply with the provisions of this measure, to the extent those entities wish to operate ALPR systems. As the use or access of ALPR systems is not a mandated activity, the implementation of additional security, privacy, and access protocols and procedures are estimated to be non-reimbursable by the state.
Potential periodic minor to significant costs to public (State/Local) and private ALPR operators, to issue data breach notifications. Private entities and public agencies are already subject to data breach notification law, so costs would be dependent on the frequency and size of data breaches specific to unencrypted ALPR data, and the process of notification utilized by each agency. See staff comments.
Background:
Existing law restricts the use of ALPR technology by the California Highway Patrol (CHP). Pursuant to AB 115 (Committee on Budget), Chap 38/2011, the transportation budget trailer bill, the CHP is authorized to retain data captured by ALPR systems for no more than 60 days except in circumstances when the data is being used as evidence or for felony investigations. Further, the CHP is prohibited from selling the data for any purpose or making the data available to any agency or person other than law enforcement agencies or officers. The data may only be used by law enforcement agencies for purposes of locating vehicles or persons reasonably suspected of being involved in the commission of a public offense. The CHP is required to monitor the internal use of ALPR data to prevent unauthorized use, and to regularly report to the Legislature on its ALPR practices and uses.
Existing law, the Data Breach Protection Law, requires any state or local agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose any security breach concerning that data to any California resident whose unencrypted personal information was, or is believed to have been, acquired by an unauthorized person.
Proposed Law:
SB 34 would establish security and privacy protocols to ensure the protection of data collected through the use of an ALPR system. Specifically, this bill would:
Define “ALPR system” as a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of license plates and their characters into computer-readable data.
Define an “ALPR operator” as a person (including a law enforcement, government, or private entity, but not including a transportation agency) that operates an ALPR system, or that stores or maintains ALPR information.
Define an “ALPR end-user” as a person that accesses or uses ALPR information, not including a transportation agency.
Add unencrypted information or data collected through the use or operation of an ALPR system (when combined with an individual’s name) to the list of personal information subject to breach notification under the Data Breach Notification Law.
Require an ALPR operator to ensure ALPR information is protected, and to implement and maintain reasonable security procedures and practices, as specified.
Require an ALPR operator to implement and maintain a usage and privacy policy that includes eight specified elements, at a minimum, to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for an individual’s privacy and civil liberties.
Require an ALPR operator to maintain a record of access to ALPR information, as specified.
Require an ALPR end-user to implement and maintain a usage and privacy policy that includes eight specified elements, at a minimum, to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for an individual’s privacy and civil liberties.
Create a private right of action to enforce these provisions and allow for the recovery of specified damages and costs.
Require a public agency that considers implementing an ALPR system to provide an opportunity for public comment at a regularly-scheduled public meeting of the agency’s governing body before implementing an ALPR data collection program.
Related Legislation:
SB 893 (Hill), which died on the Senate Inactive File last year, would have placed restrictions on the use of ALPR technology by both public and private users, limited the types of ALPR data that could be retained, and prohibited a public agency from sharing ALPR data with private entities, as specified. Both CHP and transportation agencies were exempt from the bill’s requirements.
Staff Comments:
By adding ALPR data to the list of information subject to California’s data breach notification law, public and private entities could incur costs periodically to issue notices in the event of an ALPR data breach, as specified. State costs, including those incurred by the CHP and transportation agencies, would be dependent on the frequency and size of data breaches specific to unencrypted ALPR data, and the method of notification utilized by each agency. Under existing law, if the costs to provide notifications exceed $250,000, or if the breach affected more than 500,000 persons, an entity could utilize one of several methods of notification including posting a notice on the entity’s website, which would only result in minor costs.
As the usage of ALPR systems is not a mandated activity on local agencies, any activities related to the implementation of additional security, privacy, and access protocols and procedures would not appear to be reimbursable by the state. In other words, the use of ALPR systems is an optional activity by local agencies, so any additional requirements related to those systems are generally not construed to be state-mandated activities. However, whether the costs to local agencies would be subject to reimbursement by the state cannot be known with certainty, and would ultimately be subject to determination by the Commission on State Mandates, should a local agency file a test claim.
CHP does not anticipate any fiscal impacts as a result of this bill, as existing law already contains prescriptive requirements regarding the department’s use of ALPR systems and data that are consistent with the bill’s requirements.
-- END --
SB 34 (Hill)
Page 13 of 13
Senator Hannah-Beth Jackson, Chair
2015 - 2016 Regular Session
SB 34 (Hill)
Version: December 1, 2014
Hearing Date: April 14, 2015
Fiscal: Yes
Urgency: No
TH
SUBJECT
Automated License Plate Recognition Systems: Use Of Data
DESCRIPTION
This bill would place restrictions on the use of Automated License Plate Recognition (ALPR) technology by both public and private sector users. Specifically, this bill would:
add ALPR data to the list of personal information covered by California’s Data Breach Notification Law;
specify data security protocols for the use and storage of ALPR data;
require ALPR operators and users to implement and maintain a usage and privacy policy consistent with respect for individuals’ privacy and civil liberties;
require ALPR operators to maintain a record documenting access to ALPR data;
require public agencies to hold a public meeting with public comment prior to implementing an ALPR program; and
create a private right of action to enforce these restrictions, and allow for recovery of actual or statutory damages, attorney’s fees, and costs of suit.
BACKGROUND
Automated License Plate Recognition (ALPR) systems use either mobile (e.g., attached to the outside of a vehicle) or stationary cameras and sophisticated computer software to capture and record a vehicle’s license plate information. These systems typically operate by photographing an image of a license plate, using character recognition software to convert the image into the alpha-numeric characters of the license plate, and then comparing the alpha-numeric data to data held in other databases to, for example, instantly identify stolen cars or locate vehicles subject to repossession. ALPR systems capture other data as well, including the geographic location of a license plate and the time and date that the license plate was scanned. Using this additional ALPR captured data, it is possible over time and with multiple scans to construct the locational history of scanned vehicles. The technology works at lightning speed; one company, ELSAG North America, advertises that its vehicle-based ALPR system can capture up to 1,800 license plate reads per minute, day or night, can capture data from parked and moving vehicles across up to 4 lanes of traffic, day or night and in any weather, and can read license plate data at moving speeds of up to 150 mph (241 kph). (See http://elsag.com /mobile.htm [as of April 8, 2015].)
Law enforcement uses ALPR technology to identify and locate stolen vehicles and to compare information obtained against databases of outstanding warrants. Auto repossession companies take advantage of ALPR technology to help find debtors who are behind on their car payments. In January 2012, a California Watch article entitled “Private Company Hoarding License-Plate Data on US Drivers” noted:
Capitalizing on one of the fastest-growing trends in law enforcement, a private California-based company has compiled a database bulging with more than 550 million license-plate records on both innocent and criminal drivers that can be searched by police. . . . [P]olice around the country have been affixing high-tech scanners to the exterior of their patrol cars, snapping a picture of every passing license plate and automatically comparing them to databases of outstanding warrants, stolen cars, and wanted bank robbers. The units work by sounding an in-car alert if the scanner comes across a license plate of interest to police, whereas before, patrol officers generally needed some reason to take an interest in the vehicle, like a traffic violation. But when a license plate is scanned, the driver’s geographic location is also recorded and saved, along with the date and time, each of which amounts to a record or data point. Such data collection occurs regardless of whether the driver is a wanted criminal, and the vast majority are not.
While privacy rules restrict what police can do with their own databases, Vigilant Video, headquartered in Livermore, Calif., offers a loophole. It’s a private business not required to operate by those same rules. . . . Vigilant distinguished itself from competitors by going one step further and collecting hundreds of millions of scans to create what’s known as the National Vehicle Location Service. A West Coast sales manager for the company, Randy Robinson, said the scanners – as well as data from them compiled in the location system – do far more than simply help identify stolen vehicles. Stories abound of the technology also being used by police to stop wanted killers, bank robbers, and drug suspects. Kidnappers could be intercepted, too. (Schulz, Private Company Hoarding License-Plate Data on US Drivers (January 12, 2012) <http://californiawatch.org/print/14379> [as of April 8, 2015].)
In response to the issues raised by ALPR technology, this bill would impose some restrictions on the use of ALPR technology and ALPR system-derived data. Specifically, it would add ALPR data to the list of personal information covered by California’s Data Breach Notification Law, would require specific data security protocols for the storage of ALPR data and require entities that store ALPR data to keep an access log, and would require public agencies to hold a public meeting with public comment prior to implementing an ALPR program. Additionally, this bill would require ALPR operators and users to implement and maintain a usage and privacy policy consistent with respect for individuals’ privacy and civil liberties.
CHANGES TO EXISTING LAW
Existing law, the California Constitution, provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)
Existing law permits the CHP to retain license plate data captured by a license plate reader for no more than 60 days, except in circumstances when the data is being used as evidence or for all felonies being investigated, including, but not limited to, auto theft, homicides, kidnapping, burglaries, elder and juvenile abductions, Amber Alerts, and Blue Alerts. (Veh. Code Sec. 2413(b).)
Existing law prohibits the CHP from selling ALPR data for any purpose and making it available to an agency that is not a law enforcement agency or an individual who is not a law enforcement officer. The data may be used by a law enforcement agency only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. (Veh. Code Sec. 2413(c).)
Existing law requires the CHP to monitor internal use of the ALPR data to prevent unauthorized use. (Veh. Code Sec. 2413(d).)
Existing law requires the CHP to report to the Legislature its ALPR practices and usage, including the number of ALPR data disclosures, a record of the agencies to which data was disclosed and for what purpose, and any changes in policy that affect privacy concerns. (Veh. Code Sec. 2413(e).)
This bill would add unencrypted information or data collected through the use or operation of an ALPR system to the list of personal information subject to breach notification under California’s Data Breach Notification Law.
This bill would require an ALPR operator, as defined, to ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity, as well as to implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
This bill would require an ALPR operator to implement and maintain a usage and privacy policy in order to ensure that the collection of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall:
be available in writing;
be posted conspicuously on the Internet Web site of the ALPR operator if it has an Internet Web site;
describe the authorized purposes for using ALPR systems and collecting ALPR information;
include a description of the employees and independent contractors who are authorized to use ALPR systems, collect ALPR information, or access ALPR information, as well as a description of their training requirements;
describe how the use of ALPR systems will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits;
describe the measures that will be used to ensure the accuracy of ALPR information and a process to correct data errors;
describe how the ALPR operator will comply with required security procedures and practices;
describe the length of time ALPR information will be stored or retained;
identify the official custodian, or owner, of ALPR information and those employees and independent contractors who have the responsibility and accountability for implementing the privacy policy; and
describe the purpose of, and process for, sharing or disseminating ALPR information with other persons.
This bill would require an ALPR operator to maintain a record of access if the ALPR operator accesses or provides access to information or data collected through the use or operation of an ALPR system. This bill would specify that, at a minimum, the record shall include all of the following:
the date and time the information is accessed;
the license plate number or other data elements used to query the ALPR database or system;
the person who accesses the information; and
the purpose for accessing the information.
This bill would require an ALPR end-user, as defined, to implement and maintain a usage and privacy policy in order to ensure that the access and use of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall:
be available in writing;
be posted conspicuously on the Internet Web site of the ALPR end-user if it has an Internet Web site;
describe the authorized purposes for accessing and using ALPR information;
include a description of the employees and independent contractors who are authorized to access and use ALPR information, as well as their training requirements;
describe how the access and use of ALPR information will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits;
describe length of time ALPR information will be retained by the ALPR end-user, and the process the end-user will follow to determine if and when to destroy the retained information;
identify the official custodian of ALPR information;
describe the purpose of, and process for, sharing or disseminating ALPR information with other persons; and
describe how the end-user will implement reasonable security measures to secure ALPR information from unauthorized access, destruction, use, modification, or disclosure.
This bill would provide that in addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. This bill would further provide that a court may award one or more of the following:
actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500);
punitive damages upon proof of willful or reckless disregard of the law;
reasonable attorney’s fees and other litigation costs reasonably incurred; and
other preliminary and equitable relief as the court determines to be appropriate.
This bill would require a public agency that considers implementing a program to gather information through the use of an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before it implements the program.
This bill would define “ALPR end-user” to mean a person that accesses or uses ALPR information, but to not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
This bill would define “ALPR operator” to mean a person that operates an ALPR system, or that stores or maintains ALPR information, but to not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.
COMMENT
Stated need for the bill
The author writes:
Used primarily by law enforcement agencies on police vehicles, ALPR systems use a combination of high-speed cameras, software and criminal databases to rapidly check the license plates of millions of Californians. Some ALPR systems can scan up to 2,000 license plates per minute. When used by law enforcement, each scanned license plate is checked against crime databases, such as the federal National Crime Information Center. If a ‘hit’ occurs for a stolen vehicle, AMBER Alert, an arrest warrant, or other reasons, the ALPR technology alerts the law enforcement officer.
ALPR technology has become a useful component of modern policing. For example, the Sacramento County Sheriff’s Department, in just the first 30 days of using the technology, identified and located 495 stolen vehicles, five carjacked vehicles, and 19 other vehicles that were involved in felonies. These ALPR identifications enabled the Sheriff’s Department to take 45 suspects into custody, including individuals involved with bank robbery and home invasion.
The ACLU estimates that nationally, 75 percent of law enforcement agencies currently use ALPRs, 85 percent plan to expand their use, and within the next five years at least 25 percent of all police vehicles will be equipped with the technology. The technology is also used by various private, non-law enforcement entities, such as parking and repossession companies. Some private communities use it to monitor who enters and leaves the community.
The increased use of this technology has raised concern over civil liberties. Whether or not a ‘hit’ occurs, all license plate scans are sent to “fusion centers” – large regional databases that aggregate ALPR data from various law enforcement agencies. The ACLU estimates that only 1 percent of ALPR data results in a ‘hit,’ the other 99 percent of data has no relation to the commission of a crime.
While at least seven other states have already passed laws to regulate ALPR systems, current California law has not kept up with the rapid adoption of the technology. Except for the California Highway Patrol (CHP) and transportation agencies, current California law doesn’t require any privacy safeguards or establish any protocols for the use of ALPR systems.
SB 34 will require reasonable usage and privacy standards for the operation of ALPR systems.
Fundamental Right to Privacy
Staff notes that the right to privacy is a fundamental right protected by Section 1 of Article I of the California Constitution. This bill would build upon that fundamental right by requiring entities that collect, use, share, or disseminate information derived from an automated license plate reader system to disclose how such information is gathered and used, and to ensure that the use of ALPR technology is consistent with respect for individuals’ privacy and civil rights.
The prevalence of ALPR systems and the ease with which license plate data can be gathered and aggregated have raised serious privacy concerns. (See e.g. Clark, License Plate Readers Spark Privacy, Public Safety Debate (November 20, 2013) <http:// www.usatoday.com/story/news/2013/11/20/license-plate-readers-spark-privacy-public-safety/3650273/> [as of April 8, 2015].) Using large datasets of ALPR data gathered over time, it is possible to reconstruct the locational history of a vehicle and extrapolate certain details about the car’s driver. As the American Civil Liberties Union explains in a recent report:
Tens of thousands of license plate readers are now deployed throughout the United States. Unfortunately, license plate readers are typically programmed to retain the location information and photograph of every vehicle that crosses their path, not simply those that generate a hit. The photographs and all other associated information are then retained in a database, and can be shared with others, such as law enforcement agencies, fusion centers, and private companies. Together these databases contain hundreds of millions of data points revealing the travel histories of millions of motorists who have committed no crime. (ACLU, You Are Being Tracked: How License Plate Readers Are Being Used to Record Americans’ Movements (July 17, 2013) <https://www.aclu.org/technology-and-liberty/you-are-being-tracked-how-license-plate-readers-are-being-used-record> [as of April 8, 2015].)
The U.S. Supreme Court recently examined the significant privacy concerns raised by locational tracking technology in United States v. Jones (2012) 132 S. Ct. 945. The Jones case considered whether the attachment of a Global Positioning System (GPS) tracking device to an individual’s vehicle, and the subsequent use of that device to track the vehicle’s movements on public streets, constituted a search within the meaning of the Fourth Amendment. In her concurring opinion, Justice Sotomayor made the following observations:
Awareness that the Government may be watching chills associational and expressive freedoms. And the Government’s unrestrained power to assemble data that reveal private aspects of identity is susceptible to abuse. The net result is that GPS monitoring--by making available at a relatively low cost such a substantial quantum of intimate information about any person whom the Government, in its unfettered discretion, chooses to track--may alter the relationship between citizen and government in a way that is inimical to democratic society.
I would take these attributes of GPS monitoring into account when considering the existence of a reasonable societal expectation of privacy in the sum of one's public movements. I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on. (United States v. Jones (2012) 132 S. Ct. 945, 955-956 [internal citations and quotation marks omitted].)
As with GPS monitoring, the accumulation of ALPR locational data into databases that span both time and distance also threatens to undermine one’s right to privacy. As with GPS monitoring, California residents may be less willing to exercise their associational and expressive freedoms if they know that their movements are being compiled into databases accessible not only to the government, but also to private industries and individuals.
This bill seeks to strengthen California residents’ fundamental right to privacy by requiring ALPR operators and end-users to implement and maintain privacy policies that ensure that the collection, use, and dissemination of ALPR-derived information is consistent with respect for individuals’ privacy and civil liberties. The bill would also require public agencies that consider implementing programs to gather information through ALPR systems to first provide an opportunity for public comment at a public meeting. As a matter of public policy, the requirement to allow for public comment at a public meeting prior to implementing an ALPR program makes government decisionmaking more transparent and enables residents to have a voice in deciding whether their community should adopt this technology. Writing in support, the Conference of California Bar Associations states:
SB 34 would impose reasonable curbs on the use of ALPR information by designating it as protectable personal information, restricting its dissemination, and providing a private means of enforcement. This will enable law enforcement to use ALPR information for its legitimate purposes, while protecting the privacy interests of Californians.
Data Security
Existing law requires any state agency, and any person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose any security breach concerning that data to any California resident whose unencrypted personal information was, or is believed to have been, acquired by an unauthorized person. (Civ. Code Secs. 1798.29(a), 1798.82(a).) This bill would add unencrypted ALPR information to the list of personal information subject to breach notification under California’s Data Breach Notification Law. This bill would also require ALPR operators to adhere to specific data security protocols, including ensuring that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity, as well as implementing and maintaining reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
Staff notes that ALPR data has been mishandled in the past, in part due to ineffective data security protocols. In 2013, the Boston Police Department inadvertently released unencrypted ALPR records pertaining to 40,000 different vehicles as part of a public records request. (See Musgrave, Boston Police Halt License Scanning Program (December 14, 2013) <http://www.bostonglobe.com/metro/2013/12/14/boston-police-suspend-use-high-tech-licence-plate-readers-amid-privacy-concerns/ B2hy9UIzC7KzebnGyQ0JNM/story.html> [as of April 8, 2015].) Collectively, the data security protocols implemented through this bill will help ensure that sensitive personal information collected through the use of ALPR systems will be better protected from improper use and inadvertent disclosure. In so doing, these data security requirements further the Legislature’s longstanding policy of providing effective laws to protect the integrity of personal information entrusted to or held by third parties.
Exclusion of Transportation Agencies
Transportation agencies and other entities that operate toll bridges, toll highways, and toll lanes often use ALPR systems as automated methods to charge tolls to passing vehicles. Tolls for crossing the Golden Gate Bridge, for example, are assessed electronically using ALPR cameras that record images of license plates as a vehicle passes through the toll plaza. After the toll is assessed, an invoice is generated and mailed to the registered owner of the vehicle. (See Toll Payment Options -- All Electronic Tolling on the Golden Gate Bridge <http://goldengate.org/tolls/ tollpaymentoptions.php> [as of April 8, 2015].) In California, these entities are prohibited from selling or providing to third parties any personally identifiable information obtained through a person’s participation in an electronic toll collection system (ETC) or use of a toll facility, including travel pattern and license plate information. (Sts. & Hy. Code Sec. 31490(a).) These entities are also required to establish a privacy policy regarding the collection and use of personally identifiable information by a toll system, and to provide to subscribers of that system a copy of the privacy policy in a manner that is conspicuous and meaningful. (Sts. & Hy. Code Sec. 31490(b).)
This bill expressly excludes a transportation agency when subject to Section 31490 of the Streets and Highways Code from the definition of both an ALPR operator and an ALPR end-user. Staff notes that existing law pertaining to ALPR use in electronic toll collection generally imposes stricter requirements on transportation agencies than would be the case under this bill. For example, a transportation agency must destroy personal information in its possession no later than four years and six months after a toll user’s account is closed, whereas this bill imposes no maximum retention period on personal information. (See Sts. & Hy. Code Sec. 31490(d).) Similarly, a transportation agency may not use a nonsubscriber’s personally identifiable information obtained using an electronic toll collection system to market products or services to that nonsubscriber. (See Sts. & Hy. Code Sec. 31490(k).) This bill contains no similar restriction on marketing. However, one provision of this bill not replicated in current law pertaining to transportation agencies is the requirement that ALPR operators maintain a record of access to ALPR information.
Technical and Clarifying Amendments
The author offers the following technical amendments to correct erroneous references in the bill:
On page 12, line 28, strike (b) and insert (a)
On page 12, line 33, strike (b) and insert (a)
The author offers the following clarifying amendments to ensure that an ALPR operator’s privacy policy matches the scope of requirements specified for inclusion in that privacy policy:
On page 12, line 5, strike “collection” and insert “collection, use, maintenance, sharing, and dissemination”
On page 13, line 8, strike “access and use” and insert “access, use, sharing, and dissemination”
The author offers the following clarifying amendment to resolve ambiguity surrounding the identity of a person recorded as accessing ALPR information:
On page 13, line 4, strike “(c) The person who accesses the information.” and insert “(c) The name of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.”
The author offers the following clarifying amendments to eliminate inconsistencies between the privacy policy requirements of ALPR operators and ALPR end-users:
On page 13, line 27, strike “custodian” and insert “custodian, or owner,”
On page 13, between lines 32 and 33, insert “(8) Which employees and independent contractors have the responsibility and accountability for implementing subdivision (a) and this subdivision.”
Support: Bay Area Civil Liberties Coalition; Conference of California Bar Associations; Media Alliance; Small Business California
Opposition: None Known
HISTORY
Source: Author
Related Pending Legislation: None Known
Prior Legislation:
SB 893 (Hill, 2014) would have placed restrictions on the use of automated license plate recognition (ALPR) technology by both public and private sector users. Among other things, this bill would have: required retained ALPR data to consist only of a license plate number, date and time of capture, and geographical location; would have prohibited ALPR operators from trespassing onto private property to collect ALPR data without first obtaining written consent of the landowner; and would have prohibited any public agency from sharing ALPR data with any private entity or individual absent a court order. This bill died on the Senate Inactive File.
AB 179 (Bocanegra, Ch. 375, Stats. 2013) prohibits transportation agencies and other entities that employ an electronic transit fare collection system (ETFC) for the payment of transit fares from selling or providing to third parties any personally identifiable information obtained through a person’s participation in an electronic transit fare collection system (ETFC), with certain exceptions.
SB 1330 (Simitian, 2011) would have placed restrictions on the use of automated license plate recognition technology by private entities, including restrictions on the retention, use, and sale of such data. This bill would have also restricted the ability for a person to transfer ALPR data to a law enforcement agency absent a search warrant or other specified circumstances. This bill died on the Senate Floor.
AB 115 (Committee on Budget, Ch. 38, Stats. 2011), see Background.
SB 1268 (Simitian, Ch. 489, Stats. 2010) prohibits transportation agencies from selling, or providing to any other person, the personally identifiable information of either subscribers of an electronic toll collection system or anyone who uses a toll bridge, lane, or highway that utilizes an electronic toll collection system.
SB 854 (Committee on Budget and Fiscal Review, 2010) would have, among other things, authorized the Department of the California Highway Patrol to retain license plate data captured by an automated license plate reader for not more than 72 hours unless the data is being used as evidence or for a legitimate law enforcement purpose. The bill would have prohibited the Department from selling ALPR data or making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer, and would require the Department to monitor internal use of the data to prevent unauthorized use. This bill died on the Senate Floor.
AB 1614 (Committee on Budget and Fiscal Review, 2010) would have, among other things, authorized the Department of the California Highway Patrol to retain license plate data captured by an automated license plate reader for not more than 72 hours unless the data is being used as evidence or for a legitimate law enforcement purpose. The bill would have prohibited the Department from selling ALPR data or making the data available to an agency that is not a law enforcement agency or an individual that is not a law enforcement officer, and would require the Department to monitor internal use of the data to prevent unauthorized use. This bill died on the Senate Floor.
Prior Vote:
Senate Transportation and Housing Committee (Ayes 8, Noes 2)
**************
SB 34 (Hill) Page 6 of 6
SENATE COMMITTEE ON TRANSPORTATION AND HOUSING
Senator Jim Beall, Chair
2015 - 2016 Regular
Bill No: SB 34 Hearing Date: 4/7/2015
Author: |
Hill |
||
Version: |
12/1/2014 |
||
Urgency: |
No |
Fiscal: |
Yes |
Consultant: |
Christine Hochmuth |
||
SUBJECT: Automated license plate recognition systems: use of data
DIGEST: This bill establishes regulations on the privacy and usage of automatic license plate recognition (ALPR) data and expands the meaning of “personal information” to include information or data collected through the use or operation of an ALPR system.
ANALYSIS:
Existing law:
1. Places regulations on agencies, persons, or businesses that own, license, or maintain computerized data that includes personal information. These regulations include disclosing a breach of security.
2. Prohibits a transportation agency from selling or provide personally identifiable information of any person who subscribes to an electronic toll or electronic transit fare collection system or who uses a toll bridge, toll lane, or toll highway that employs an electronic toll collection system. Agencies covered by this regulation are the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system and any transit operator participating in that system, or any entity under contract with the above-mentioned entities.
3. Requires that transportation agencies employing an electronic toll or transit fare collection system establish a privacy policy for the collection and use of personally identifiable information and provide its users with a copy of the privacy policy. Transportation agencies include the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, any entity administering an electronic transit fare collection system, and any transit operator participating in that system, or any entity under contract with the above mentioned entities.
4. Establishes limits on the length of time that transportation agencies may keep personal information. All information may be kept only as long as necessary to perform account functions. All other information must be discarded within four and a half years after the conclusion of the billing cycle.
This bill:
1. Defines an ALPR system as a system of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.
2. Requires that data collected through the use or operation of an ALPR system be considered as personal information subject to existing law pertaining to agencies, persons, or businesses that conduct business in California, and that own or license computerized data including personal information.
3. Defines an ALPR end-user as a person that accesses or uses ALPR information and an ALPR operator as a person that operates an ALPR system, or that maintains ALPR information, with the exception of transportation agencies. A person may include a law enforcement agency, government agency, private entity, or individual.
4. Requires that ALPR operators ensure that ALPR information is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.
5. Requires that ALPR operators implement and maintain reasonable security procedures and practices in order to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.
6. Requires that ALPR operators and end users implement and maintain a usage and privacy policy in order to ensure that the collection, access, and use of ALPR information is consistent with respect for individuals’ privacy and civil liberties.
7. Requires that the usage and privacy policy include, in part:
the purpose for using ALPR systems/data
a list of authorized users of ALPR systems/data
how the ALPR systems/data will be monitored
how ALPR operators will comply with security procedures
the length of time that ALPR information will be stored and how it will be determined whether/when to destroy retained information
the owner of the ALPR data and the employees who are responsible for implementing the usage and privacy policy
the reason, and process by which, ALPR data is shared with other parties
a plan for how end users will maintain security of ALPR data
8. Requires ALPR operators that access or provide access to ALPR information to maintain a record of that access. The record must include the date and time of access, the license plate number which was queried, the person who accesses the information, and the purpose of accessing the information.
9. Allows an individual who has been harmed by a violation of this title to bring a civil action against a person who knowingly caused the violation. The court can award damages which are stipulated in this bill.
10. Requires a public agency that considers using an ALPR system to provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the agency before it implements the program of ALPR use.
COMMENTS:
1. Purpose. The author states that this bill is necessary to institute reasonable usage and privacy standards for the operation of ALPR systems, which do not exist for the majority of local agencies that have approved the use of ALPR technology, according to the American Civil Liberties Union (ACLU). Additionally, this bill requires an opportunity for public input on the usage and standards of ALPR technologies, something the author contends few local agencies allow. The author states that the main focus of this bill is to put in place regulations for businesses and agencies which currently do not have any policies regarding the use of ALPR data, unlike transportation agencies which are already regulated by existing law.
2. ALPR background and history. ALPR systems automatically scan any license plate within range. Some ALPR systems can scan 2,000 plates in a minute. When used by law enforcement, each scanned license plate is checked against crime databases. If a “hit” occurs — for example, a stolen vehicle, AMBER alert, or an arrest warrant — the ALPR technology alerts the law enforcement officer. While some suggest this technology is useful for modern policing, others raise concerns over an invasion of peoples’ civil liberties. Whether or not a hit occurs, all license plate scans are sent to large regional databases that aggregate ALPR data from various law enforcement agencies. The ACLU reports that an estimated 1% of ALPR data results in a hit and the other 99% of data has no relation to criminal activity. Databases maintained for northern California law enforcement agencies, San Diego law enforcement agencies, and private companies (such as insurance companies, collections agencies, and private investigators) contain 100 million, 49 million, and more than 1 billion license plate scans, respectively. Some argue that this information has the potential to be involved in large-scale security breach issues.
The use of ALPR technology is growing. The ACLU estimates that nationally, 75% of law enforcement currently uses ALPRs, 85% plan to expand their use, and within the next five years at least 25% of all police vehicles will be equipped with the technology.
3. Privacy concerns. The collection of a license plate number, location, and time stamp over multiple time points can identify not only a person’s exact whereabouts but also their pattern of movement. Unlike other types of personal information that are covered by existing law, civilians are not always aware when their ALPR data is being collected. One does not even need to be driving to be subject to ALPR technology: A car parked on the side of the road can be scanned by an ALPR system.
This bill will put in place minimal privacy protections by requiring the establishment of privacy and usage protection policies for ALPR operators and end users. This bill does not prevent the authorized sharing of data, but if data is shared, it must be justified and recorded.
4. Exemption for transportation agencies. This bill defines an “automated license plate recognition operator” as a person that operates an ALPR system, but exempts transportation agencies. The author states the exemption is included because transportation agencies are already required, under existing law, to establish a privacy policy for personally identifiable information. However, transportation agencies are not currently required to maintain a record of access to ALPR information, including the date and time of access, the license plate number or other data elements used to query the ALPR database or system, the person who accessed the information, and the purpose for accessing the information. Toll operators frequently access data as part of a system that captures hundreds of thousands of images daily.
According to toll authority representatives, being subject to these regulations would be extremely burdensome and inefficient for the operation of toll roads and bridges given the immense volume of transactions conducted by toll operators every day. They also contend that removing the exemption would add no substantive privacy protection for California.
5. Support for the bill. The Citizens for Criminal Justice Reform California state that the language in this bill provides a long-overdue legislative framework which establishes basic policies that will enhance privacy and procedural requirements to outline the security, usage, and storage of ALPR data. This bill mandates chain of custody procedures and provides additional civil remedies for anyone injured by a person who knowingly violates those requirements. In this way, this bill provides a degree of accountability which does not exist under current law.
Small Business California, Media Alliance, and the Conference of California Bar Associations all support the transparency and protections that are provided by this bill. They state this bill will promote sound public policy in protecting the public’s privacy rights against improper use of new technology, while still allowing for the use of that new technology.
6. Double referral. The rules committee has referred this bill to both this committee and the Judiciary committee. Therefore, if the bill passes this committee, it will be referred to the Judiciary Committee.
RELATED LEGISLATION:
AB 259 (Dababneh, current session) requires a public agency that is the source of a data breach to offer at least 12 months of identity-theft prevention and mitigation services at no cost to affected consumers. This bill has passed through the Assembly Privacy and Consumer Protection Committee and is currently in Assembly Appropriations.
AB 964 (Chau, current session) requires disclosure of data breaches to occur within 30 days, unless the breach relates to encrypted data, in which case no disclosure is necessary. This bill is currently in the Assembly Privacy and Consumer Protection Committee.
SB 893 (Hill, 2014) placed restrictions on the use of ALPR technology by both public- and private-sector users. This bill failed on the Senate Floor.
AB 179 (Bocanegra, Chapter 375, Statutes of 2013) prohibits transportation agencies and other entities that employ an electronic transit fare collection system (ETFC) for the payment of transit fares from selling or providing to third parties any personally identifiable information obtained through a person’s participation in an ETFC, with certain exceptions.
SB 24 (Simitian, Chapter 197, Statutes of 2011) standardizes the security breach notification that any agency, person, or business is required to issue upon a breach of security in personal information.
SB 1330 (Simitian, 2011) restricted the use of ALPR technology by private entities, including restrictions on the retention, use, and sale of such data. This bill also restricted the ability for a person to transfer ALPR data to a law enforcement agency absent a search warrant or other specified circumstances. This bill failed on the Senate Floor.
AB 115 (Committee on Budget, Chapter 38, Statutes of 2011) allows the California Highway Patrol (CHP) to retain data captured by ALPR systems for no more than 60 days. It also prohibits the CHP from selling ALPR data or making it available to anyone other than law enforcement agencies.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
POSITIONS: (Communicated to the committee before noon on Wednesday,
April 1, 2015.)
SUPPORT:
Citizens for Criminal Justice Reform California
Conference of California Bar Associations
Media Alliance
Small Business California
OPPOSITION:
None received.
-- END --
Discussed in Hearing
2MIN
Senate Floor
59SEC
Assembly Floor
31SEC
Assembly Floor
1MIN
Assembly Standing Committee on Appropriations
13MIN
Assembly Standing Committee on Privacy and Consumer Protection
6MIN
Assembly Standing Committee on Transportation
2MIN
Senate Floor
2MIN
Senate Standing Committee on Appropriations
Bill Author
Bill Co-Author(s):
