SB 746: Political Reform Act of 1974: business entities: online advocacy and advertisements.
- Session Year: 2021-2022
- House: Senate
- Latest Version Date: 2022-09-30
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain political activities and by regulating certain political advertisements.
This bill, beginning on January 1, 2024, would require a business entity to submit a report to the Secretary of State following any calendar year in which the business entity used its products or services to alter its online search results to emphasize or deemphasize materials containing express advocacy, or to target online advertisements to individuals or groups, or generally to users or members of the public, for political purposes and without full and adequate consideration. The bill would require the report to contain certain information relating to the search results and advertisements, as specified. The bill would require reports to be filed on paper or by email with the Secretary of State, and to be made publicly available in a conspicuous location on the Secretary of States website. These provisions would not apply to a business entitys use of its products or services exclusively to carry out its commercial activities, including delivering user-generated content or a paid advertisement on behalf of another person, or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain political activities and by regulating certain political advertisements.
This bill, beginning on January 1, 2024, would require a business entity to submit a report to the Secretary of State following any calendar year in which the business entity used its products or services to alter its online search results to emphasize or deemphasize materials containing express advocacy, or to target online advertisements to individuals or groups, or generally to users or members of the public, for political purposes and without full and adequate consideration. The bill would require the report to contain certain information relating to the search results and advertisements, as specified. The bill would require reports to be filed on paper or by email with the Secretary of State, and to be made publicly available in a conspicuous location on the Secretary of States website. These provisions would not apply to a business entitys use of its products or services exclusively to carry out its commercial activities, including delivering user-generated content or a paid advertisement on behalf of another person, or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain political activities and by regulating certain political advertisements.
This bill, beginning on January 1, 2024, would require a business entity to submit a report to the Secretary of State following any reporting period, as defined, calendar year in which the business entity used its products or services to alter its online search results to emphasize or deemphasize materials containing express advocacy, or to target online advertisements to individuals or groups, or generally to users or members of the public, for political purposes and without full and adequate consideration. The bill would require the report to contain certain information relating to the search results and advertisements, as specified. The bill would require reports to be filed on paper or by email with the Secretary of State, and to be made publicly available in a conspicuous location on the Secretary of States website. These provisions would not apply to a business entitys use of its products or services exclusively to carry out its commercial activities, including delivering user-generated content or a paid advertisement on behalf of another person, or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain political activities and by regulating certain political advertisements.
This bill bill, beginning on January 1, 2024, would require a business entity to submit a report to the Secretary of State following any reporting period, as defined, in which the business entity used its products or services to alter its online search results to emphasize or deemphasize materials containing express advocacy, or to target online advertisements to individuals or groups, or generally to users or members of the public, for political purposes and without full and adequate consideration. The bill would require the report to contain certain information relating to the search results and advertisements, as specified. The bill would require reports to be filed on paper or by email with the Secretary of State, and to be made publicly available in a conspicuous location on the Secretary of States website. These provisions would not apply to a business entitys use of its products or services exclusively to carry out its commercial activities, including delivering user-generated content or a paid advertisement on behalf of another person, or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain campaign contributions and expenditures, as defined. political activities and by regulating certain political advertisements.
This bill would expressly apply these provisions to a business entity that intentionally utilizes its products or services to disseminate communications made for political purposes, as defined, and would provide that certain compensation paid by a business entity operating an online service to an employee who renders services for political purposes is a contribution or expenditure under the act, as specified. These provisions would not apply to a business entitys use of its products or services to exclusively carry out its commercial activities or to communications that are internal to a business entity or entities.This bill would require a business entity to submit a report to the Secretary of State following any reporting period, as defined, in which the business entity used its products or services to alter its online search results to emphasize or deemphasize materials containing express advocacy, or to target online advertisements to individuals or groups, or generally to users or members of the public, for political purposes and without full and adequate consideration. The bill would require the report to contain certain information relating to the search results and advertisements, as specified. The bill would require reports to be filed on paper or by email with the Secretary of State, and to be made publicly available in a conspicuous location on the Secretary of States website. These provisions would not apply to a business entitys use of its products or services exclusively to carry out its commercial activities, including delivering user-generated content or a paid advertisement on behalf of another person, or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the Political Reform Act of 1974, provides for the comprehensive regulation of campaign financing and related matters, including by prohibiting, limiting, or requiring disclosure of certain campaign contributions and expenditures, as defined.
This bill would expressly apply these provisions to a business entity that intentionally utilizes its products or services to disseminate communications made for political purposes, as defined, and would provide that certain compensation paid by a business entity operating an online service to an employee who renders services for political purposes is a contribution or expenditure under the act, as specified. These provisions would not apply to a business entitys use of its products or services to exclusively carry out its commercial activities or to communications that are internal to a business entity or entities.
Existing law makes a knowing or willful violation of the Political Reform Act of 1974 a misdemeanor and subjects offenders to criminal penalties. By expanding the scope of an existing crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Political Reform Act of 1974, an initiative measure, provides that the Legislature may amend the act to further the acts purposes upon a 2/3 vote of each house of the Legislature and compliance with specified procedural requirements.
This bill would declare that it furthers the purposes of the act.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer, as defined, various rights with regard to personal information relating to that consumer that is held by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose the categories of personal information it has collected about that consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, establishes the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.This bill would grant a consumer the right to request that a business disclose to the consumer whether or not the business uses personal information collected about the consumer for a political purpose, as defined. The bill would require a business that collects personal information about a consumer and uses that information for a political purpose to disclose to the consumer specified information upon receipt of a verifiable consumer request from the consumer, including the name of any candidate or committee for which the consumers personal information was used for a political purpose. The bill would also require the business to disclose that information to the California Privacy Protection Agency or the Attorney General, as specified. The bill would also make conforming changes.The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer, as defined, various rights with regard to personal information relating to that consumer that is held by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose the categories of personal information it has collected about that consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, establishes the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.
This bill would grant a consumer the right to request that a business disclose to the consumer whether or not the business uses personal information collected about the consumer for a political purpose, as defined. The bill would require a business that collects personal information about a consumer and uses that information for a political purpose to disclose to the consumer specified information upon receipt of a verifiable consumer request from the consumer, including the name of any candidate or committee for which the consumers personal information was used for a political purpose. The bill would also require the business to disclose that information to the California Privacy Protection Agency or the Attorney General, as specified, and submit a statement certified, under penalty of perjury, by the chief executive officer, or equivalent person, of the business that the business has complied with that requirement. The bill would also require a business with gross revenue exceeding $100,000,000 in the preceding calendar year that does not engage in activities described above to submit to the California Privacy Protection Agency or the Attorney General, as specified, a statement certified, under penalty of perjury, by the chief executive officer, or equivalent person, of the business that the business does not engage in those activities. By expanding the crime of perjury, this bill would impose a state-mandated local program. specified. The bill would also make conforming changes.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer, as defined, various rights with regard to personal information relating to that consumer that is held by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose the categories of personal information it has collected about that consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, establishes the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.
This bill would grant a consumer the right to request that a business disclose to the consumer whether or not the business uses personal information collected about the consumer for a political purpose, as defined. The bill would require a business that collects personal information about a consumer and uses that information for a political purpose to disclose to the consumer specified information upon receipt of a verifiable consumer request from the consumer, including the name of any candidate or committee for which the consumers personal information was used for a political purpose. The bill would also require the business to annually disclose that information to the California Privacy Protection Agency or the Attorney General, as specified, and submit a statement certified, under penalty of perjury, by the chief executive officer officer, or equivalent person, of the business that the business has complied with that requirement. The bill would also require a business with gross revenue exceeding $100,000,000 in the preceding calendar year that does not engage in activities described above to annually submit to the California Privacy Protection Agency or the Attorney General, as specified, a statement certified, under penalty of perjury, by the chief executive officer officer, or equivalent person, of the business that the business does not engage in those activities. By expanding the crime of perjury, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer, as defined, various rights with regard to personal information relating to that consumer that is held by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose the categories of personal information it has collected about that consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, establishes the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.
This bill would grant a consumer the right to request that a business disclose to the consumer whether or not the business uses personal information collected about the consumer for a political purpose, as defined. The bill would require a business that collects personal information about a consumer and uses that information for a political purpose to disclose to the consumer specified information upon receipt of a verifiable consumer request from the consumer, including the name of any candidate or committee for which the consumers personal information was used for a political purpose. The bill would also require the business to annually disclose that information to the California Privacy Protection Agency and submit a statement certified, under penalty of perjury, by the chief executive officer of the business that the business has complied with that requirement. The bill would also require a business with gross revenue exceeding $100,000,000 in the preceding calendar year that does not engage in activities described above to annually submit to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer of the business that the business does not engage in those activities. By expanding the crime of perjury, this bill would create impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer, as defined, various rights with regard to personal information relating to that consumer that is held by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose the categories of personal information it has collected about that consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, establishes the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.
This bill would grant a consumer the right to request that a business disclose to the consumer whether or not the business uses personal information collected about the consumer for a political purpose, as defined. The bill would require a business that collects personal information about a consumer and uses that information for a political purpose to disclose to the consumer specified information upon receipt of a verifiable consumer request from the consumer, including the name of any candidate or committee for which the consumers personal information was used for a political purpose. The bill would also require the business to annually disclose that information to the California Privacy Protection Agency and submit a statement certified, under penalty of perjury, by the chief executive officer of the business that the business has complied with that requirement. By expanding the crime of perjury, this bill would create a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
(a)(1)A business entity shall submit a report to the Secretary of State following any calendar year in which the business entity does either of the following:
(A)Uses its products or services to alter the online search results its products or services generate in order to emphasize or deemphasize materials containing express advocacy, as that term is defined in paragraph (2) of subdivision (c) of Section 82025.
(B)Uses its products or services to target online advertisements to individuals or groups, or generally to users or members of the public, without full and adequate consideration and for political purposes, as that term is described in paragraph (1) of subdivision (b) of Section 82025.
(2)The report shall contain information including, but not limited to, all of the following:
(A)The name of each candidate or measure with regard to which the search results were altered as described in subparagraph (A) of paragraph (1) or that was the subject of an advertisement targeted as described in subparagraph (B) of paragraph (1).
(B)For each candidate or measure, whether the search results or advertisements were to support or oppose the nomination or election of the candidate or the qualification or passage of the measure.
(C)The full name, title, and business street address and telephone number of each person with final decision making authority as to which candidates or measures will be supported or opposed by the business entitys search results or advertisements.
(D)The date or range of dates in which the activity described in subparagraph (A) or (B) of paragraph (1) occurred.
(3)A report shall be filed by January 31 for activity occurring during the previous calendar year.
(4)The report shall be filed on paper or by email with the Secretary of State and shall be made publicly available in a conspicuous location on the Secretary of States website.
(5)The report required by this section may be included in an online filing and disclosure system developed in accordance with subdivision (b) of Section 84602 if the Secretary of State, pursuant to paragraph (7) of that subdivision, certifies that the system is able to incorporate filing of the report.
(b)A business entity subject to this section shall maintain detailed accounts and records necessary to prepare the report required pursuant to subdivision (a), and shall retain those detailed accounts and records for a period of four years following the date that the report is filed.
(c)This section does not apply to either of the following activities:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or a paid advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)This section is not intended to expand or limit the definition of contribution or expenditure under this title.
(e)This section shall become operative on January 1, 2024.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
(a)(1)A business entity shall submit a report to the Secretary of State following any calendar year in which the business entity does either of the following:
(A)Uses its products or services to alter the online search results its products or services generate in order to emphasize or deemphasize materials containing express advocacy, as that term is defined in paragraph (2) of subdivision (c) of Section 82025.
(B)Uses its products or services to target online advertisements to individuals or groups, or generally to users or members of the public, without full and adequate consideration and for political purposes, as that term is described in paragraph (1) of subdivision (b) of Section 82025.
(2)The report shall contain information including, but not limited to, all of the following:
(A)The name of each candidate or measure with regard to which the search results were altered as described in subparagraph (A) of paragraph (1) or that was the subject of an advertisement targeted as described in subparagraph (B) of paragraph (1).
(B)For each candidate or measure, whether the search results or advertisements were to support or oppose the nomination or election of the candidate or the qualification or passage of the measure.
(C)The full name, title, and business street address and telephone number of each person with final decision making authority as to which candidates or measures will be supported or opposed by the business entitys search results or advertisements.
(D)The date or range of dates in which the activity described in subparagraph (A) or (B) of paragraph (1) occurred.
(3)A report shall be filed by January 31 for activity occurring during the previous calendar year.
(4)The report shall be filed on paper or by email with the Secretary of State and shall be made publicly available in a conspicuous location on the Secretary of States website.
(5)The report required by this section may be included in an online filing and disclosure system developed in accordance with subdivision (b) of Section 84602 if the Secretary of State, pursuant to paragraph (7) of that subdivision, certifies that the system is able to incorporate filing of the report.
(b)A business entity subject to this section shall maintain detailed accounts and records necessary to prepare the report required pursuant to subdivision (a), and shall retain those detailed accounts and records for a period of four years following the date that the report is filed.
(c)This section does not apply to either of the following activities:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or a paid advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)This section is not intended to expand or limit the definition of contribution or expenditure under this title.
(e)This section shall become operative on January 1, 2024.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
(a)(1)A business entity shall submit a report to the Secretary of State following any reporting period described in paragraph (3) calendar year in which the business entity does either of the following:
(A)Uses its products or services to alter the online search results its products or services generate in order to emphasize or deemphasize materials containing express advocacy, as that term is defined in paragraph (2) of subdivision (c) of Section 82025.
(B)Uses its products or services to target online advertisements to individuals or groups, or generally to users or members of the public, without full and adequate consideration and for political purposes, as that term is described in paragraph (1) of subdivision (b) of Section 82025.
(2)The report shall contain information including, but not limited to, all of the following:
(A)The name of each candidate or measure with regard to which the search results were altered as described in subparagraph (A) of paragraph (1) or that was the subject of an advertisement targeted as described in subparagraph (B) of paragraph (1).
(B)For each candidate or measure, whether the search results or advertisements were to support or oppose the nomination or election of the candidate or the qualification or passage of the measure.
(C)The full name, title, and business street address and telephone number of each person with final decision making authority as to which candidates or measures will be supported or opposed by the business entitys search results or advertisements.
(D)The date or range of dates in which the activity described in subparagraph (A) or (B) of paragraph (1) occurred.
(3)For activity occurring during the period of January 1 through June 30, a A report shall be filed by July 31. For activity occurring during the period of July 1 through December 31, a report shall be filed by January 31. January 31 for activity occurring during the previous calendar year.
(4)The report shall be filed on paper or by email with the Secretary of State and shall be made publicly available in a conspicuous location on the Secretary of States website.
(5)The report required by this section may be included in an online filing and disclosure system developed in accordance with subdivision (b) of Section 84602 if the Secretary of State, pursuant to paragraph (7) of that subdivision, certifies that the system is able to incorporate filing of the report.
(b)A business entity subject to this section shall maintain detailed accounts and records necessary to prepare the report required pursuant to subdivision (a). (a), and shall retain those detailed accounts and records for a period of four years following the date that the report is filed.
(c)This section does not apply to either of the following activities:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or a paid advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)This section is not intended to expand or limit the definition of contribution or expenditure under this title.
(e)This section shall become operative on January 1, 2024.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
(a)(1)A business entity shall submit a report to the Secretary of State following any reporting period described in paragraph (3) in which the business entity does either of the following:
(A)Uses its products or services to alter the online search results its products or services generate in order to emphasize or deemphasize materials containing express advocacy, as that term is defined in paragraph (2) of subdivision (c) of Section 82025.
(B)Uses its products or services to target online advertisements to individuals or groups, or generally to users or members of the public, without full and adequate consideration and for political purposes, as that term is described in paragraph (1) of subdivision (b) of Section 82025.
(2)The report shall contain information including, but not limited to, all of the following:
(A)The name of each candidate or measure with regard to which the search results were altered as described in subparagraph (A) of paragraph (1) or that was the subject of an advertisement targeted as described in subparagraph (B) of paragraph (1).
(B)For each candidate or measure, whether the search results or advertisements were to support or oppose the nomination or election of the candidate or the qualification or passage of the measure.
(C)The full name, title, and business street address and telephone number of each person with final decision making authority as to which candidates or measures will be supported or opposed by the business entitys search results or advertisements.
(D)The date or range of dates in which the activity described in paragraph (2) subparagraph (A) or (B) of paragraph (1) occurred.
(3)For activity occurring during the period of January 1 through June 30, a report shall be filed by July 31. For activity occurring during the period of July 1 through December 31, a report shall be filed by January 31.
(4)The report shall be filed on paper or by email with the Secretary of State and shall be made publicly available in a conspicuous location on the Secretary of States website.
(5)The report required by this section may be included in an online filing and disclosure system developed in accordance with subdivision (b) of Section 84602 if the Secretary of State, pursuant to paragraph (7) of that subdivision, certifies that the system is able to incorporate filing of the report.
(b)A business entity subject to this section shall maintain detailed accounts and records necessary to prepare the report required pursuant to subdivision (a).
(c)This section does not apply to either of the following activities:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or a paid advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)This section is not intended to expand or limit the definition of contribution or expenditure under this title.
(e)This section shall become operative on January 1, 2024.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
(a)(1)A business entity shall submit a report to the Secretary of State following any reporting period described in paragraph (3) in which the business entity does either of the following:
(A)Uses its products or services to alter the online search results its products or services generate in order to emphasize or deemphasize materials containing express advocacy, as that term is defined in paragraph (2) of subdivision (c) of Section 82025.
(B)Uses its products or services to target online advertisements to individuals or groups, or generally to users or members of the public, without full and adequate consideration and for political purposes, as that term is described in paragraph (1) of subdivision (b) of Section 82025.
(2)The report shall contain information including, but not limited to, all of the following:
(A)The name of each candidate or measure with regard to which the search results were altered as described in subparagraph (A) of paragraph (1) or that was the subject of an advertisement targeted as described in subparagraph (B) of paragraph (1).
(B)For each candidate or measure, whether the search results or advertisements were to support or oppose the nomination or election of the candidate or the qualification or passage of the measure.
(C)The full name, title, and business street address and telephone number of each person with final decision making authority as to which candidates or measures will be supported or opposed by the business entitys search results or advertisements.
(D)The date or range of dates in which the activity described in paragraph (2) occurred.
(3)For activity occurring during the period of January 1 through June 30, a report shall be filed by July 31. For activity occurring during the period of July 1 through December 31, a report shall be filed by January 31.
(4)The report shall be filed on paper or by email with the Secretary of State and shall be made publicly available in a conspicuous location on the Secretary of States website.
(b)A business entity subject to this section shall maintain detailed accounts and records necessary to prepare the report required pursuant to subdivision (a).
(c)This section does not apply to either of the following activities:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or a paid advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)This section is not intended to expand or limit the definition of contribution or expenditure under this title.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
(a)A business entity that intentionally utilizes its products or services to disseminate communications made for political purposes, as described in paragraph (1) of subdivision (b) of Section 82025 of the Government Code, and that takes that action at the direction of one or more of the officers of the business entity, shall be subject to the limits, prohibitions, and reporting requirements set forth in this title for any resulting contribution, as defined in subdivision (a) of Section 82015 of the Government Code, or any resulting expenditure, as defined in subdivision (a) of Section 82025 of the Government Code, as applicable.
(b)If the product or service used by a business entity to disseminate a political communication subject to subdivision (a) is an online service operated by the business entity, any payment of salary, reimbursement for personal expense, or other compensation paid or incurred by the business entity for the specific purpose of disseminating the communication subject to subdivision (a) is a contribution or expenditure for purposes of this title. In this case, the conditions set forth in Section 18423 of Title 2 of the California Code of Regulations shall not apply.
(c)This section does not apply to either of the following:
(1)A business entitys use of its products or services exclusively to carry out its commercial activities, including, but not limited to, delivering user-generated content or an advertisement on behalf of another person.
(2)Communications that are internal to a business entity or entities.
(d)For the purposes of this section, officer means a natural person elected or appointed by the board of directors to manage the daily operations of a business entity, such as a chief executive officer, president, secretary, or treasurer.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 3.The Legislature finds and declares that this bill furthers the purposes of the Political Reform Act of 1974 within the meaning of subdivision (a) of Section 81012 of the Government Code.
SECTION 1.Section 1798.111 is added to the Civil Code, to read:1798.111.(a)A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer whether or not the business uses that personal information for a political purpose.(b)A business that collects personal information about a consumer and uses that information for a political purpose shall disclose to the consumer all of the following information upon receipt of a verifiable consumer request from the consumer:(1)The name of any candidate or committee for which the consumers personal information was used for a political purpose.(2)The title of any ballot measure for which the consumers personal information was used for a political purpose.(3)If the consumers personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).(c)A business that engages in activities described in subdivision (b) shall disclose, pursuant to subdivision (d), all of the following:(1)The name of any candidate or committee for which personal information was used for a political purpose.(2)The title of any ballot measure for which personal information was used for a political purpose.(3)If personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).(d)A disclosure required by subdivision (c) shall be submitted after November 10 but before December 10 of each calendar year as follows:(1)For the January 1, 2022, calendar year, to the Attorney General.(2)For a calendar year beginning on or after January 1, 2023, to the California Privacy Protection Agency.(e)For purposes of this section:(1)Ballot measure has the same meaning as defined in Section 82043 of the Government Code.(2)Candidate has the same meaning as defined in Section 82007 of the Government Code.(3)Committee has the same meaning as defined in Section 82013 of the Government Code.(4)(A)Political purpose means activity undertaken by a business with the actual knowledge, or at the direction, of one or more of the officers of the business for the purpose of influencing, or attempting to influence, the action of the voters for or against either of the following:(i)The nomination or election of a candidate.(ii)The qualification or passage of a ballot measure.(B)Political purpose does not include the use of a consumers personal information by a business in carrying out a commercial transaction on behalf of another person, including, but not limited to, delivering an advertisement to the consumer on behalf of another person.SEC. 2.Section 1798.130 of the Civil Code, as amended by Section 1 of Chapter 172 of the Statutes of 2020, is amended to read:1798.130.(a)In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.(2)Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information within 45 days of receipt of the consumers request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.(3)For purposes of subdivision (b) of Section 1798.110:(A)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(B)Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.(5)For purposes of subdivision (b) of Section 1798.115:(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(B)Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125 and one or more designated methods for submitting requests.(B)For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:(i)A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold, or if the business has not sold consumers personal information in the preceding 12 months, the business shall disclose that fact.(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.(D)In the case of a business that sells or discloses deidentified patient information not subject to this title pursuant to clause (i) of subparagraph (A) of paragraph (4) of subdivision (a) of Section 1798.146, whether the business sells or discloses deidentified patient information derived from patient information and if so, whether that patient information was deidentified pursuant to one or more of the following:(i)The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.(ii)The deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method.(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification.(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.(c)The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140.SEC. 3.Section 1798.130 of the Civil Code, as amended on November 3, 2020, by initiative Proposition 24, Section 12, is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.(B)For purposes of subdivision (b) of Section 1798.110:(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.(5)For purposes of subdivision (b) of Section 1798.115:(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).(B)For purposes of subdivision (c) of Section 1798.110:(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.(ii)The categories of sources from which consumers personal information is collected.(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.(iv)The categories of third parties to whom the business discloses consumers personal information.(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) of Section 1798.140.SEC. 4.The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.(a)A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer whether or not the business uses that personal information for a political purpose.
(b)A business that collects personal information about a consumer and uses that information for a political purpose shall disclose to the consumer all of the following information upon receipt of a verifiable consumer request from the consumer:
(1)The name of any candidate or committee for which the consumers personal information was used for a political purpose.
(2)The title of any ballot measure for which the consumers personal information was used for a political purpose.
(3)If the consumers personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).
(c)(1)A business that engages in activities described in subdivision (b) shall do both of the following: disclose, pursuant to subdivision (d), all of the following:
(A)Disclose, pursuant to subdivision (d), all of the following:(i)(1)The name of any candidate or committee for which personal information was used for a political purpose.
(ii)(2)The title of any ballot measure for which personal information was used for a political purpose.
(iii)(3)If personal information was used to support or oppose the candidate, committee, or measure referred to by clause (i) or (ii). paragraph (1) or (2).
(B)Submit, pursuant to subdivision (d), a statement certified, under penalty of perjury, by the chief executive officer, or equivalent person, of the business that the business has correctly disclosed all activity pursuant to this subdivision.(2)A business with gross revenue exceeding one hundred million dollars ($100,000,000) in the preceding calendar year that does not engage in activities described in subdivision (b) shall submit, pursuant to subdivision (d), to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer, or equivalent person, of the business that the business does not engage in the activities described in subdivision (b).(3)A disclosure required by paragraph (1) shall include any information that has not been previously disclosed pursuant to subdivision (d).(d)A statement or disclosure required by subdivision (c) shall be submitted after November 10 but before December 10 of each calendar year as follows:
(1)For the January 1, 2022, calendar year, to the Attorney General.
(2)For a calendar year beginning on or after January 1, 2023, to the California Privacy Protection Agency.
(e)For purposes of this section:
(1)Ballot measure has the same meaning as defined in Section 82043 of the Government Code.
(2)Candidate has the same meaning as defined in Section 82007 of the Government Code.
(3)Committee has the same meaning as defined in Section 82013 of the Government Code.
(4)(A)Political purpose means activity undertaken by a business with the actual knowledge, or at the direction, of one or more of the officers of the business for the purpose of influencing, or attempting to influence, the action of the voters for or against either of the following:
(i)The nomination or election of a candidate.
(ii)The qualification or passage of a ballot measure.
(B)Political purpose does not include the use of a consumers personal information by a business in carrying out a commercial transaction on behalf of another person, including, but not limited to, delivering an advertisement to the consumer on behalf of another person.
SEC. 2.Section 1798.130 of the Civil Code, as amended by Section 1 of Chapter 172 of the Statutes of 2020, is amended to read:1798.130.(a)In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(2)Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information within 45 days of receipt of the consumers request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.
(3)For purposes of subdivision (b) of Section 1798.110:
(A)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125 and one or more designated methods for submitting requests.
(B)For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold, or if the business has not sold consumers personal information in the preceding 12 months, the business shall disclose that fact.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(D)In the case of a business that sells or discloses deidentified patient information not subject to this title pursuant to clause (i) of subparagraph (A) of paragraph (4) of subdivision (a) of Section 1798.146, whether the business sells or discloses deidentified patient information derived from patient information and if so, whether that patient information was deidentified pursuant to one or more of the following:
(i)The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.
(ii)The deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140.
SEC. 3.Section 1798.130 of the Civil Code, as amended by on November 3, 2020, by initiative Proposition 24, Section 12, is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) of Section 1798.140.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.SEC. 5.SEC. 4.The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.
(a)A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer whether or not the business uses that personal information for a political purpose.
(b)A business that collects personal information about a consumer and uses that information for a political purpose shall disclose to the consumer all of the following information upon receipt of a verifiable consumer request from the consumer:
(1)The name of any candidate or committee for which the consumers personal information was used for a political purpose.
(2)The title of any ballot measure for which the consumers personal information was used for a political purpose.
(3)If the consumers personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).
(c)(1)A business that engages in activities described in subdivision (b) shall do both of the following:
(1)Annually disclose to the California Privacy Protection Agency(A)Disclose, pursuant to subdivision (d), all of the following:
(A)(i)The name of any candidate or committee for which personal information was used for a political purpose.
(B)(ii)The title of any ballot measure for which personal information was used for a political purpose.
(C)(iii)If personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or referred to by subparagraph (A) or (B). clause (i) or (ii).
(2)Submit to the California Privacy Protection Agency(B)Submit, pursuant to subdivision (d), a statement certified, under penalty of perjury, by the chief executive officer officer, or equivalent person, of the business that the business has correctly disclosed all activity pursuant to this subdivision.
(d)(2)A business with gross revenue exceeding one hundred million dollars ($100,000,000) in the preceding calendar year that does not engage in activities described in subdivision (b) shall annually submit submit, pursuant to subdivision (d), to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer officer, or equivalent person, of the business that the business does not engage in the activities described in subdivision (b).
(3)A disclosure required by paragraph (1) shall include any information that has not been previously disclosed pursuant to subdivision (d).
(d)A statement or disclosure required by subdivision (c) shall be submitted after November 10 but before December 10 of each calendar year as follows:
(1)For the January 1, 2022, calendar year, to the Attorney General.
(2)For a calendar year beginning on or after January 1, 2023, to the California Privacy Protection Agency.
(e)For purposes of this section:
(1)Ballot measure has the same meaning as defined in Section 82043 of the Government Code.
(2)Candidate has the same meaning as defined in Section 82007 of the Government Code.
(3)Committee has the same meaning as defined in Section 82013 of the Government Code.
(4)(A)Political purpose means activity undertaken by a business with the actual knowledge, or at the direction, of one or more of the officers of the business for the purpose of influencing, or attempting to influence, the action of the voters for or against either of the following:
(i)The nomination or election of a candidate.
(ii)The qualification or passage of a ballot measure.
(B)Political purpose does not include the use of a consumers personal information by a business in carrying out a commercial transaction on behalf of another person, including, but not limited to, delivering an advertisement to the consumer on behalf of another person.
SEC. 2.Section 1798.130 of the Civil Code, as amended by Section 1 of Chapter 172 of the Statutes of 2020, is amended to read:1798.130.(a)In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(2)Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information within 45 days of receipt of the consumers request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.
(3)For purposes of subdivision (b) of Section 1798.110:
(A)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125 and one or more designated methods for submitting requests.
(B)For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe describes the personal information sold, or if the business has not sold consumers personal information in the preceding 12 months, the business shall disclose that fact.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describe describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(D)In the case of a business that sells or discloses deidentified patient information not subject to this title pursuant to clause (i) of subparagraph (A) of paragraph (4) of subdivision (a) of Section 1798.146, whether the business sells or discloses deidentified patient information derived from patient information and if so, whether that patient information was deidentified pursuant to one or more of the following:
(i)The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.
(ii)The deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140.
SEC. 3.Section 1798.130 of the Civil Code, as amended by November 3, 2020, by initiative Proposition 24, Section 12, is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, consumer has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) of Section 1798.140.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.
(a)A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer whether or not the business uses that personal information for a political purpose.
(b)A business that collects personal information about a consumer and uses that information for a political purpose shall disclose to the consumer all of the following information upon receipt of a verifiable consumer request from the consumer:
(1)The name of any candidate or committee for which the consumers personal information was used for a political purpose.
(2)The title of any ballot measure for which the consumers personal information was used for a political purpose.
(3)If the consumers personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).
(c)A business that engages in activities described in subdivision (b) shall do both of the following:
(1)Annually disclose to the California Privacy Protection Agency all of the following:
(A)The name of any candidate or committee for which personal information was used for a political purpose.
(B)The title of any ballot measure for which personal information was used for a political purpose.
(C)If personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or referred to by subparagraph (A) or (B).
(2)Submit to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer of the business that the business has correctly disclosed all activity pursuant to this subdivision.
(d)A business with gross revenue exceeding one hundred million dollars ($100,000,000) in the preceding calendar year that does not engage in activities described in subdivision (b) shall annually submit to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer of the business that the business does not engage in the activities described in subdivision (b).
(d)(e)For purposes of this section:
(1)Ballot measure has the same meaning as defined in Section 82043 of the Government Code.
(2)Candidate has the same meaning as defined in Section 82007 of the Government Code.
(3)Committee has the same meaning as defined in Section 82013 of the Government Code.
(4)(A)Political purpose means activity undertaken by a business with the actual knowledge, or at the direction, of one or more of the officers of the business for the purpose of influencing, or attempting to influence, the action of the voters for or against either of the following:
(i)The nomination or election of a candidate.
(ii)The qualification or passage of a ballot measure.
(B)For purposes of this paragraph, influencing, or attempting to influence, the action of voters includes serving or placing advertisements.(B)Political purpose does not include the use of a consumers personal information by a business in carrying out a commercial transaction on behalf of another person, including, but not limited to, delivering an advertisement to the consumer on behalf of another person.
SEC. 2.Section 1798.130 of the Civil Code, as amended by Section 1 of Chapter 172 of the Statutes of 2020, is amended to read:1798.130.(a)In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(2)Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information within 45 days of receipt of the consumers request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.
(3)For purposes of subdivision (b) of Section 1798.110:
(A)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125 and one or more designated methods for submitting requests.
(B)For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold, or if the business has not sold consumers personal information in the preceding 12 months, the business shall disclose that fact.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describe the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(D)In the case of a business that sells or discloses deidentified patient information not subject to this title pursuant to clause (i) of subparagraph (A) of paragraph (4) of subdivision (a) of Section 1798.146, whether the business sells or discloses deidentified patient information derived from patient information and if so, whether that patient information was deidentified pursuant to one or more of the following:
(i)The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.
(ii)The deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140.
SEC. 3.Section 1798.130 of the Civil Code, as amended by November 3, 2020, by initiative Proposition 24, Section 12, is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) of Section 1798.140.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.
(a)A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer whether or not the business uses that personal information for a political purpose.
(b)A business that collects personal information about a consumer and uses that information for a political purpose shall disclose to the consumer all of the following information upon receipt of a verifiable consumer request from the consumer:
(1)The name of any candidate or committee for which the consumers personal information was used for a political purpose.
(2)The title of any ballot measure for which the consumers personal information was used for a political purpose.
(3)If the consumers personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or (2).
(c)A business that engages in activities described in subdivision (b) shall do both of the following:
(1)Annually disclose to the California Privacy Protection Agency all of the following:
(A)The name of any candidate or committee for which personal information was used for a political purpose.
(B)The title of any ballot measure for which personal information was used for a political purpose.
(C)If personal information was used to support or oppose the candidate, committee, or measure referred to by paragraph (1) or referred to by subparagraph (A) or (B).
(2)Submit to the California Privacy Protection Agency a statement certified, under penalty of perjury, by the chief executive officer of the business that the business has correctly disclosed all activity pursuant to this subdivision.
(d)For purposes of this section:
(1)Ballot measure has the same meaning as defined in Section 82043 of the Government Code.
(2)Candidate has the same meaning as defined in Section 82007 of the Government Code.
(3)Committee has the same meaning as defined in Section 82013 of the Government Code.
(4)(A)Political purpose means activity undertaken by a business with the actual knowledge, or at the direction, of one or more of the officers of the business for the purpose of influencing, or attempting to influence, the action of the voters for or against either of the following:
(i)The nomination or election of a candidate.
(ii)The qualification or passage of a ballot measure.
(B)For purposes of this paragraph, influencing, or attempting to influence, the action of voters includes serving or placing advertisements.
SEC. 2.Section 1798.130 of the Civil Code, as amended by Section 1 of Chapter 172 of the Statutes of 2020, is amended to read:1798.130.(a)In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.
(2)Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information within 45 days of receipt of the consumers request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.
(3)For purposes of subdivision (b) of Section 1798.110:
(A)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information collected about the consumer in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(4)(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was disclosed for a business purpose in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(5)(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125 and one or more designated methods for submitting requests.
(B)For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold, or if the business has not sold consumers personal information in the preceding 12 months, the business shall disclose that fact.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describe the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(D)In the case of a business that sells or discloses deidentified patient information not subject to this title pursuant to clause (i) of subparagraph (A) of paragraph (4) of subdivision (a) of Section 1798.146, whether the business sells or discloses deidentified patient information derived from patient information and if so, whether that patient information was deidentified pursuant to one or more of the following:
(i)The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.
(ii)The deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method.
(6)(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.111, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(7)(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification.
(b)A business is not obligated to provide the information required by Sections 1798.110 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.110 and 1798.115 shall follow the definition of personal information in Section 1798.140.
SEC. 3.Section 1798.130 of the Civil Code, as amended by November 3, 2020, by initiative Proposition 24, Section 12, is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of Section 1798.111, identify the name of any candidate, committee, or the title of any ballot measure for which the consumers personal information was used for a political purpose and whether the consumers personal information was used to support or oppose the candidate or measure.
(4)(5)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(5)(6)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(6)(7)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.111, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(7)(8)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110 1798.110, 1798.111, and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) of Section 1798.140.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.
|
Date
|
Status
|
|---|---|
| Sep 30, 2022 | Chaptered by Secretary of State. Chapter 876, Statutes of 2022. |
| Sep 30, 2022 | Approved by the Governor. |
| Sep 9, 2022 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 31, 2022 | Assembly amendments concurred in. (Ayes 36. Noes 0. Page 5382.) Ordered to engrossing and enrolling. |
| Aug 31, 2022 | In Senate. Concurrence in Assembly amendments pending. |
| Aug 31, 2022 | Read third time. Passed. Ordered to the Senate. |
| Aug 22, 2022 | Read second time. Ordered to third reading. |
| Aug 18, 2022 | Read second time and amended. Ordered to second reading. |
| Aug 17, 2022 | From committee: Do pass as amended. (Ayes 6. Noes 0.) (August 17). |
| Aug 15, 2022 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on ELECTIONS. |
| Aug 11, 2022 | Read third time and amended. |
| Aug 11, 2022 | Read second time. Ordered to third reading. |
| Aug 10, 2022 | From committee: Do pass. (Ayes 15. Noes 0.) (August 10). |
| Aug 3, 2022 | August 3 hearing postponed by committee. |
| Jun 29, 2022 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 7. Noes 0.) (June 29). Re-referred to Com. on APPR. |
| May 12, 2022 | Re-referred to Com. on ELECTIONS pursuant to Assembly Rule 96. |
| May 10, 2022 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on P. & C.P. |
| May 5, 2022 | Referred to Com. on P. & C.P. |
| Jan 24, 2022 | In Assembly. Read first time. Held at Desk. |
| Jan 24, 2022 | Read third time. Passed. (Ayes 29. Noes 6. Page 2806.) Ordered to the Assembly. |
| Jan 4, 2022 | Read second time. Ordered to third reading. |
| Jan 3, 2022 | From inactive file on motion of Senator Skinner. |
| Jun 1, 2021 | Ordered to inactive file on request of Senator Skinner. |
| May 24, 2021 | Read second time. Ordered to third reading. |
| May 20, 2021 | From committee: Do pass as amended. (Ayes 5. Noes 2. Page 1203.) (May 20). |
| May 14, 2021 | Set for hearing May 20. |
| Apr 20, 2021 | April 19 hearing: Placed on APPR suspense file. |
| Apr 8, 2021 | Set for hearing April 19. |
| Apr 7, 2021 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 9. Noes 1. Page 688.) (April 6). Re-referred to Com. on APPR. |
| Mar 25, 2021 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on JUD. |
| Mar 17, 2021 | Set for hearing April 6. |
| Mar 5, 2021 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on JUD. |
| Mar 3, 2021 | Referred to Com. on JUD. |
| Feb 22, 2021 | Art. IV. Sec. 8(a) of the Constitution dispensed with. |
| Feb 22, 2021 | From printer. May be acted upon on or after March 24. |
| Feb 19, 2021 | Introduced. To Com. on RLS. for assignment. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2022 | SB 746 Skinner Senate Third Reading By Gabriel | Assembly Floor |
Passed |
|
| Aug 31, 2022 | Unfinished Business SB746 Skinner Concurrence | Senate Floor |
Passed |
|
| Jan 24, 2022 | Senate 3rd Reading SB746 Skinner | Senate Floor |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
Bill Author
Bill Co-Author(s):