AB 1391: Unlawfully obtained data.
- Session Year: 2021-2022
- House: Assembly
- Latest Version Date: 2021-10-06
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to through the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell, purchase, or utilize data, as defined, that the person knows or reasonably should know is compromised data. The bill would define the term compromised data to mean data that has been obtained or accessed pursuant to the commission of a crime. sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime and would also make it unlawful for a person, who is not an authorized person, as defined, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to the commission of a crime.
Existing law, the California Consumer Privacy Act of 2018, authorizes a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action, as specified.
This bill would make it unlawful for a person to sell, purchase, or utilize data, as defined, that the person knows or reasonably should know is compromised data. The bill would define the term compromised data to mean data that has been obtained or accessed pursuant to the commission of a crime.
(a)As used in this section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper, (2001) 532 U.S. 514.
(e)This section does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft or fraud.
(f)The court in an action pursuant to this section may award equitable relief, including, but not limited to, an injunction, costs, and any other relief the court deems proper.
(g)Liability under this section shall not limit or preclude liability under any other law.
(h)A violation of this section shall not constitute a crime.
(a)As used in this section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper, (2001) 532 U.S. 514.
(e)This section does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft or fraud.
(f)The court in an action pursuant to this section may award equitable relief, including, but not limited to, an injunction, costs, and any other relief the court deems proper.
(g)Liability under this section shall not limit or preclude liability under any other law.
(h)A violation of this section shall not constitute a crime.
(a)As used in this section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed through pursuant to the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to through the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper, (2001) 532 U.S. 514.
(e)This section does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft. theft or fraud.
(f)The court in an action pursuant to this section may award equitable relief, including, but not limited to, an injunction, costs, and any other relief the court deems proper.
(g)Liability under this section shall not limit or preclude liability under any other law.
(h)A violation of this section shall not constitute a crime.
(a)As used in this section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to through the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, including the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper, (2001) 532 U.S. 514, pertaining to the rights of whistleblowers and the press regarding matters of public concern. 514.
(e)This section does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft.
(f)The court in an action pursuant to this section may award equitable relief, including, but not limited to, an injunction, costs, and any other relief the court deems proper.
(e)(g)Liability under this section shall not limit or preclude liability under any other law.
(h)A violation of this section shall not constitute a crime.
(a)As used in this section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, including those described in Bartnicki v. Vopper, (2001) 532 U.S. 514, pertaining to the rights of whistleblowers and the press regarding matters of public concern.
(e)Liability under this section shall not limit or preclude liability under any other law.
(a)As used in this section, compromised data means data, as defined in Section 502 of the Penal Code, that has been obtained or accessed pursuant to the commission of a crime. section:
(1)Authorized person means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, as applicable.
(2)Data has the same meaning as defined in Section 502 of the Penal Code.
(b)It is unlawful for a person to sell, purchase, or utilize data that the person knows or reasonably should know is compromised data. sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime.
(c)It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data pursuant to the commission of a crime.
(d)This section shall not be construed to limit the constitutional rights of the public, including those described in Bartnicki v. Vopper, (2001) 532 U.S. 514, pertaining to the rights of whistleblowers and the press regarding matters of public concern.
(e)Liability under this section shall not limit or preclude liability under any other law.
(a)As used in this section, compromised data means data, as defined in Section 502 of the Penal Code, that has been obtained or accessed pursuant to the commission of a crime.
(b)It is unlawful for a person to sell, purchase, or utilize data that the person knows or reasonably should know is compromised data.
|
Date
|
Status
|
|---|---|
| Oct 6, 2021 | Chaptered by Secretary of State - Chapter 594, Statutes of 2021. |
| Oct 6, 2021 | Approved by the Governor. |
| Sep 9, 2021 | Enrolled and presented to the Governor at 4 p.m. |
| Sep 1, 2021 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 78. Noes 0. Page 2656.). |
| Aug 31, 2021 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after September 2 pursuant to Assembly Rule 77. |
| Aug 30, 2021 | Read third time. Passed. Ordered to the Assembly. (Ayes 39. Noes 0. Page 2225.). |
| Aug 17, 2021 | Read second time. Ordered to third reading. |
| Aug 16, 2021 | Read third time and amended. Ordered to second reading. |
| Jul 1, 2021 | Read second time. Ordered to third reading. |
| Jun 30, 2021 | From committee: Do pass. (Ayes 5. Noes 0. Page 1721.) (June 29). |
| Jun 24, 2021 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on PUB. S. |
| Jun 22, 2021 | In committee: Testimony taken. Hearing postponed by committee. |
| Jun 16, 2021 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on PUB. S. |
| Jun 8, 2021 | From committee: Do pass and re-refer to Com. on PUB. S. (Ayes 11. Noes 0.) (June 8). Re-referred to Com. on PUB. S. |
| May 12, 2021 | Referred to Coms. on JUD. and PUB. S. |
| Apr 19, 2021 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Apr 19, 2021 | Read third time. Passed. Ordered to the Senate. (Ayes 78. Noes 0. Page 1071.) |
| Apr 13, 2021 | Read second time. Ordered to Consent Calendar. |
| Apr 12, 2021 | Read second time and amended. Ordered returned to second reading. |
| Apr 8, 2021 | From committee: Amend, and do pass as amended. To Consent Calendar. (Ayes 11. Noes 0.) (April 8). |
| Mar 11, 2021 | Referred to Com. on P. & C.P. |
| Feb 22, 2021 | Read first time. |
| Feb 20, 2021 | From printer. May be heard in committee March 22. |
| Feb 19, 2021 | Introduced. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 1, 2021 | AB 1391 Chau Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Aug 30, 2021 | Assembly 3rd Reading AB1391 Chau By Laird | Senate Floor |
Passed |
|
| Apr 19, 2021 | AB 1391 Chau Consent Calendar Second Day Regular Session | Assembly Floor |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
Bill Author
Bill Co-Author(s):