Existing law prohibits an individuals name and address from being distributed for commercial purposes, sold, or rented by an agency, as defined, unless that action is specifically authorized by law.

This bill would instead prohibit an individuals name and address personal information, as defined, from being distributed, sold, or rented by an agency for any purpose that has financial gain unless that action is specifically authorized by law. The bill would make other nonsubstantive conforming changes.

The Information Practices Act of 1977 prohibits an individuals name and address from being distributed for commercial purposes, sold, or rented by an agency, as defined, unless that action is specifically authorized by law.

This bill would instead prohibit an individuals name and address from being distributed, sold, or rented by an agency for any purpose that has financial gain unless that action is specifically authorized by law.

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2023 - 2024 Regular Session

AB 2388 (Joe Patterson) - Information Practices Act of 1977: personal information

Bill Summary:

This bill expands the definition of “personal information” in the Information Practices Act (IPA) and prohibits a state agency from distributing, selling, or renting a person’s personal information for any purpose that has financial gain unless specifically authorized elsewhere in law.

Fiscal Impact:

• Costs (General Fund, special funds) of an unknown but potentially significant amount to state agencies that must change their policies and practices to conform to the bill’s more expansive definition of personal information.
  
• Possible revenue loss (General Fund, special funds) of an unknown amount to state agencies that may no longer generate financial gain from the sale or distribution of personal information. As discussed in more detail below, the extent of this practice among state agencies that must comply with the IPA is unknown.

Background:

The IPA governs the collection, maintenance, and disclosure of personal information by California state agencies. The statute was passed in 1977 and has largely remained unchanged since then, despite significant changes in how personal information is collected and used by private companies and government agencies. The IPA does not apply to local agencies. This bill expands the definition of “personal information” in the IPA to mirror the more comprehensive definition included in the California Consumer Privacy Act, which governs collection and disclosure of personal data by private companies. The bill also specifies a state agency may not distribute, sell, or rent personal information “for any purpose that has financial gain” unless doing so is specifically authorize by law.

The DMV is required by statute to provide specified personal information to commercial requesters and the revenues cited in media stories were fees the department charges to offset its costs for providing the data (see Vehicle Code sections 1810 and 1811). These fees are authorized by statute and the amount of the fees is set in regulations. Additionally, the IPA contains an exemption that expressly permits the DMV to release specified personal information (Civil Code section 1798.24, subd. (m).) In light of this exemption and the DMV’s existing statutory authority to collect fees for provision of personal information, it is not clear that this bill would alter the DMV’s personal information practices.

That said, it is unknown whether any other state agencies in California currently sell personal information for financial gain and would be required to stop doing so under this bill.

Proposed Law:

This bill updates the definition of “personal information” in the IPA to include any information that is maintained by an agency that identifies, relates to, describes, or is capable of being associated with a particular individual, including, but not limited to, the individual’s name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, vehicle registration information, license plate number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. It includes statements made by, or attributed to, the individual. This bill also prohibits any agency from distributing, selling, or renting personal information, pursuant to the IPA, for any purpose that has financial gain unless that action is specifically authorized by law.

Related Legislation:

AB 2677 (Gabriel), of the 2021-2022 Legislative Session, would have expanded the definition of “personal information” in the IPA and made it easier to enforce violations of the IPA by state agencies. AB 2677 was vetoed by Governor Newsom, who wrote:

…I am concerned this bill is overly prescriptive and could conflict with the State’s goal to provide person-centered, data driven, and integrated services. Additionally, this bill would cost tens of millions of dollars to implement across multiple state agencies that were not accounted for in the budget…Bills with significant fiscal impact, such as this measure, should be considered and accounted for as part of the annual budget process.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 2388 (Author:Joe Patterson)

Version: April 10, 2024

Hearing Date: June 18, 2024

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Information Practices Act of 1977: personal information

DIGEST

This bill amends the Information Practices Act (IPA) by expanding the definition of “personal information” (PI) and bolstering protections against agencies distributing, selling, or renting the personal information of Californians for financial gain.

EXECUTIVE SUMMARY

The Information Practices Act of 1977 is the statutory scheme that governs the collection, use, retention, and disclosure of personal information by state agencies in California. Passed over 40 years ago, it has not been meaningfully updated since.

With reports of state agencies making a profit off of Californian’s personal information, calls for strengthening the IPA have grown stronger.

This bill makes two key changes to the IPA. It expands the definition of personal information to include information that relates to or is capable of being associated with a particular individual and includes a broader list of nonexclusive examples. Currently the IPA prohibits the distribution, sale, or renting of personal information for “commercial purposes.” This bill expands this protection by prohibiting such conduct for any purpose that has financial gain.

These changes bring a long overdue strengthening of this important but woefully antiquated privacy protection statute.

The bill is author sponsored. It is supported by ACLU California Action and Oakland Privacy. No timely opposition was received by this Committee.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)
2. Establishes the Information Practices Act of 1977 (IPA), which declares that the right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them. It further states the following legislative findings:
   1. the right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies;
   2. the increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information; and
   3. in order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798 et seq.)
3. Defines “personal information” for purposes of the IPA as any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, the individual’s name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual. (Civ. Code § 1798.3(a).)
4. Defines “agency” to include every state office, officer, department, division, bureau, board, commission, or other state agency. “Agency” explicitly excludes:
   1. the California Legislature;
   2. any agency established under Article VI of the California Constitution;
   3. the State Compensation Insurance Fund, except as to any records that contain personal information about the employees of the State Compensation Insurance Fund; or
   4. a local agency, as defined. (Civ. Code § 1798.3(b).)
5. Defines “commercial purpose” to mean any purpose that has financial gain as a major objective. It does not include the gathering or dissemination of newsworthy facts by a publisher or broadcaster. (Civ. Code § 1798.3(j).)
6. Prohibits an individual’s name and address from being distributed for commercial purposes, sold, or rented by an agency unless such action is specifically authorized by law.
7. Provides that each agency shall maintain in its records only PI which is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government; and requires each agency to maintain all records, to the maximum extent possible, with accuracy, relevance, timeliness, and completeness. (Civ. Code §§ 1798.14, 1798.18.)
8. Requires an agency that collects PI to maintain the source of that information, except as specified; and specifies that each agency shall collect PI to the greatest extent practicable directly from the individual who is the subject of the PI. (Civ. Code §§ 1798.15, 1798.16.)
9. Requires each agency to provide with any form used to collect PI from individuals a notice containing specified information including: the name and specified contact information of the agency requesting the information; the statutory, regulatory, or executive authority that authorizes the maintenance of the information; whether submission of the information is mandatory or voluntary; the consequences, if any, of not providing all or any part of the requested information; the principal purpose or purposes for which the information is to be used; any known or foreseeable disclosures that may be made of the information; and the individual’s right of access to records containing PI which are maintained by the agency. (Civ. Code § 1798.17.)
10. Requires each agency to establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing PI and to instruct each such person with respect to those rules; and further requires each agency to establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the provisions of the IPA, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to their security or integrity which could result in an injury. (Civ. Code § 1798.20.)
11. Prohibits an agency from disclosing any PI in a manner that would link the information disclosed to the individual to whom it pertains unless the information is disclosed as specified, including:
    1. with the prior written voluntary consent of the individual to whom the PI pertains within the preceding 30 days;
    2. to a person or another agency if the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected;
    3. to a governmental entity if required by state or federal law;
    4. pursuant to the California Public Records Act (Gov. Code § 6250, et seq.);
    5. pursuant to a subpoena, court order, search warrant, or other compulsory legal process with notification to the individual, unless notification is prohibited by law; and
    6. for statistical and research purposes, as specified. (Civ. Code § 1798.24.)
12. Requires each agency to keep an accurate accounting of the date, nature, and purpose of each disclosure of a record made pursuant to specified circumstances; and requires each agency to retain that accounting for at least three years after the disclosure, or until the record is destroyed, whichever is shorter. (Civ. Code §§ 1798.25, 1798.27.)
13. Grants individuals with specified rights in connection with their PI, including the right to inquire and be notified as to whether the agency maintains a record about them; to inspect all PI in any record maintained; and to submit a request in writing to amend a record containing PI pertaining to them maintained by an agency. (Civ. Code § 1798.30, et seq.)
14. Provides that an agency that fails to comply with any provisions of the IPA may be enjoined by any court of competent jurisdiction, and, as specified, the agency may be liable to the individual in an amount equal to the sum of actual damages sustained by the individual, including damages for mental suffering, and the costs of the action together with reasonable attorney’s fees as determined by the court. (Civ. Code §§ 1798.46-1798.48.)
15. Provides that the intentional violation of any provision of the IPA, or any rules or regulations adopted thereunder, by an officer or employee of an agency shall constitute a cause for discipline, including termination of employment; and further specifies that the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of the IPA is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains. (Civ. Code §§ 1798.55, 1798.57.)
16. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. It does not apply to government entities. (Civ. Code § 1798.100 et seq.)
17. Defines “personal information” for purposes of the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including biometric information, geolocation data, and “sensitive personal information.” (Civ. Code § 1798.140(v)(1).)

This bill:

1. Updates the definition of “personal information” in the IPA to include any information that is maintained by an agency that identifies, relates to, describes, or is capable of being associated with a particular individual, including, but not limited to, the individual’s name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, vehicle registration information, license plate number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. It includes statements made by, or attributed to, the individual.
2. Prohibits any agency from distributing, selling, or renting personal information, pursuant to the IPA, for any purpose that has financial gain unless that action is specifically authorized by law.
3. Deletes the definition of “commercial purpose.”

COMMENTS

1. The IPA and Californians’ privacy

Article I, Section 1 of the California Constitution provides: “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” Privacy is therefore not just a policy goal, it is a constitutional right of every Californian. However, it has been under increasing assault.

The phrase “and privacy” was added to the California Constitution as a result of Proposition 11 in 1972; it was known as the “Privacy Initiative.” The arguments in favor of the amendment were written by Assemblymember Kenneth Cory and Senator George Moscone. The ballot pamphlet stated in relevant part:

At present there are no effective restraints on the information activities of government and business. This amendment creates a legal and enforceable right of privacy for every Californian. The right of privacy . . . prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes or to embarrass us. . . . The proliferation of government and business records over which we have no control limits our ability to control our personal lives. . . . Even more dangerous is the loss of control over the accuracy of government and business records on individuals. . . . Even if the existence of this information is known, few government agencies or private businesses permit individuals to review their files and correct errors. . . . Each time we apply for a credit card or a life insurance policy, file a tax return, interview for a job[,] or get a drivers' license, a dossier is opened and an informational profile is sketched.^[1]

In 1977, the Legislature reaffirmed through the IPA that the right of privacy is a “personal and fundamental right” and that “all individuals have a right of privacy in information pertaining to them.”^[2] The Legislature further stated the following findings:

• “The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.”
• “The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.”
• “In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits.”

Modeled after the Federal Privacy Act of 1974, the IPA governs the collection, maintenance, and disclosure of personal information by state agencies, specifically excluding local agencies. The IPA places guidelines and restrictions on the collection, maintenance, and disclosure of Californians’ PI, including a prohibition on the disclosure of an individual’s PI that can be used to identify them without the individual’s consent except under one of a list of specified circumstances. State agencies are required to provide notice to individuals of their rights with respect to their PI, the purposes for which the PI will be used, and any foreseeable disclosures of that PI.

The IPA also provides individuals with certain rights to be informed of what PI an agency holds relating to that individual, to access and inspect that PI, and to request corrections to that PI, subject to specified exceptions. In addition, when state agencies contract with private entities for services, the contractors are typically governed by the IPA.

1. Updating the existing framework for the digital age

In response to growing concerns about the privacy and safety of consumers’ data, AB 375 (Chau, Ch. 55, Stats. 2018) created the CCPA, later amended by initiative, which grants a set of rights to consumers with regard to their PI, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to delete certain information, the right to restrict the sale of information, and protection from discrimination for exercising these rights.

The CCPA defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including biometric information, geolocation data, and “sensitive personal information.”

However, the modernized protections of the CCPA only apply to businesses. The IPA, on the other hand, has not been updated in decades, leaving its framework vulnerable. The Legislature at the time could not conceive of the digital information revolution that was to come. This bill seeks to bring the IPA into this new era and bolster the protections for Californians’ PI that is collected, used, and retained by state agencies.

1. A strengthened IPA

According to the author:

California continues to be a leader on privacy, making it imperative that state agencies uphold the same standards of personal data privacy. Our state has long been at the forefront of advocating for robust privacy protections, recognizing that safeguarding personal information is foundational to individual autonomy and dignity. Therefore, it is incumbent upon state agencies to not only comply with existing privacy laws, but also to exceed them in their commitment to protecting sensitive data entrusted to them by the public.

This bill first expands the definition of “personal information,” recognizing the enhanced ability to reidentify what previously was anonymous data and to cover the full scope of what is now considered personal information. The current definition is “any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, the individual’s name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual.” This antiquated definition leaves a variety of forms of PI out and can be narrowly read to only apply to information that is maintained in a form that it can be actively associated with a specific individual.

Conversely, the definition of PI in the CCPA appreciates that in combination with other sources of data an otherwise non-identifying data set can be connected to a specific person.

This bill borrows from that definition to update the definition currently in the IPA:

The term “personal information” means any information that is maintained by an agency that identifies, relates to, describes, or is capable of being associated with a particular individual, including, but not limited to, the individual’s name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, vehicle registration information, license plate number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. It includes statements made by, or attributed to, the individual.

In addition, the IPA currently provides a protection against agencies using PI for financial gain. However, it is an extremely weak protection. It provides: “An individual’s name and address may not be distributed for commercial purposes, sold, or rented by an agency unless such action is specifically authorized by law.” “Commercial purpose” means any purpose that has financial gain as a major objective. This therefore allows agencies to distribute information so long as financial gain is not a major objective. More importantly, this protection only applies to names and addresses.

This bill bolsters this protection by applying it to all PI and expressly prohibiting any distribution, selling, or renting of PI for any purpose that has financial gain, unless specifically authorized by law.

The author points to one recent incident that motivates such a change:

The California Department of Motor Vehicles is generating revenue of $50,000,000 a year through selling drivers’ personal information, according to a DMV document obtained by Motherboard.

DMVs across the country are selling data that drivers are required to provide to the organization in order to obtain a license. This information includes names, physical addresses, and car registration information. California’s sales come from a state which generally scrutinizes privacy to a higher degree than the rest of the country.

In a public record acts request, Motherboard asked the California DMV for the total dollar amounts paid by commercial requesters of data for the past six years. The responsive document shows the total revenue in financial year 2013/14 as $41,562,735, before steadily climbing to $52,048,236 in the financial year 2017/18.

The document doesn't name the commercial requesters, but some specific companies appeared frequently in Motherboard's earlier investigation that looked at DMVs across the country. They included data broker LexisNexis and consumer credit reporting agency Experian. Motherboard also found DMVs sold information to private investigators, including those who are hired to find out if a spouse is cheating. It is unclear if the California DMV has recently sold data to these sorts of entities.

In an email to Motherboard, the California DMV said that requesters may also include insurance companies, vehicle manufacturers, and prospective employers.^[3]

Writing in support, ACLU California Action asserts:

When the IPA was passed in 1977, some of the categories AB 2388 would add to the definition of personal information were not even in existence, such as a cell phone number. Other categories listed in AB 2388 are natural extensions of the intent of the IPA that would greatly increase the protections personal information has when it is in the hands of state actors.

The changes to the IPA contemplated by AB 2388 are an important first step towards modernizing the IPA and ensuring its intent – protecting the privacy of personal information held by state actors – continues to be lived out in the modern era.

SUPPORT

ACLU California Action

Oakland Privacy

OPPOSITION

None received

RELATED LEGISLATION

Pending Legislation: None known.

Prior Legislation:

AB 2677 (Gabriel, 2022) would have amended the Information Practices Act by updating definitions, bolstering existing protections, applying data minimization principles, limiting disclosure, and increasing accountability. The bill was vetoed by Governor Newsom, who stated: “I am concerned this bill is overly prescriptive and could conflict with the State's goal to provide person-centered, data driven, and integrated services. Additionally, this bill would cost tens of millions of dollars to implement across multiple state agencies that were not accounted for in the budget.”

AB 825 (Levine, Ch. 527, Stats. 2021) added “genetic information” to the definition of personal information for purposes of the laws requiring certain businesses to implement and maintain reasonable security procedures and practices to protect personal information they own, license, or maintain. It required businesses and agencies that maintain personal information to disclose a breach of genetic information.

AB 3223 (Gallagher, 2020) would have prohibited an agency from selling, renting, or exchanging for commercial purposes the PI an agency holds without the consent of the person to whom that information applies. It would have held an agency liable for all damages resulting from a negligent or intentional violation of the IPA. This bill died at the Assembly Desk.

AB 1130 (Levine, Ch. 750, Stats. 2019) updated the definition of “personal information” in various consumer protection statutes, including the DBNL, to include certain government identification numbers and biometric data.

AB 375 (Chau, Ch. 55, Stats. 2018) See Comment 2.

AB 928 (Olsen, Ch. 851, Stats. 2014) required each state department and state agency to conspicuously post its privacy policy, including specified information, on its website.

PRIOR VOTES:

Assembly Floor (Ayes 67, Noes 0)

Assembly Appropriations Committee (Ayes 15, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

1. Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 17, quoting the official ballot pamphlet for the Privacy Initiative. ↑

2. Civ. Code § 1798.1. ↑

3. Joseph Cox, The California DMV Is Making $50M a Year Selling Drivers’ Personal Information (November 25, 2019) Vice, https://www.vice.com/en/article/evjekz/the-california-dmv-is-making-dollar50m-a-year-selling-drivers-personal-information [as of June 14, 2024]. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 2388

Author:(Joe Patterson)

As Amended Ver:April 10, 2024

Majority vote

SUMMARY

Prohibits a state agency from distributing, selling, or renting an individual's personal information for any purpose that has financial gain unless that action is specifically authorized.

Major Provisions

1. Defines "personal information," under the Information Practices Act (IPA), as any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, vehicle registration information (including license plate number), insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
2. Prohibits a state agency from distributing, selling, or renting personal information for any financial gain unless specifically authorized by state statutes.

COMMENTS

The Information Practices Act of 1977 (IPA) modeled after the Federal Privacy Act of 1974, is the primary privacy statute governing the collection, maintenance, and disclosure of personal information by California state agencies. The act has not been significantly updated since its enactment.

Over the past decade, it has become increasingly clear that not only is our right to privacy significantly eroded, our private information and activities are now being harvested and sold for a profit, not only by private companies but potentially by state agencies as well. According to a 2019 investigation by Motherboard (provided by the author), a Public Records Act (PRA) request uncovered the fact that California's state agencies are also selling Californians' personal information, without their consent, for financial gain. Specifically, the Department of Motor Vehicles (DMV) reported that in fiscal year 2013-14, the DMV received approximately $42 million in revenue from selling the names, addresses, and car registration information to commercial requesters. By 2017-18, that figure increased to $52 million.

This bill is attempting to address this finding by updating the IPA in three significant ways:

1. By updating the definition of "personal information" in the law to more closely align with the definition in the California Consumer Privacy Act (CCPA) and to reflect our current understanding of what constitutes personal information in the age of the internet.
2. By expanding the current statute that limits prohibitions against state agencies selling Californians' names and addresses for profit to include a prohibition against the sale of any personal information, as newly defined, by a state agency unless it is explicitly authorized in state statutes.
3. By replacing the term "commercial purposes" with a more precise and accurate term for government entities – "financial gain."

Background. In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA) (AB 375 (Chau), Chapter 55, Statutes of 2018), which gave consumers certain rights regarding their personal information, such as the right to: 1) know what personal information that is collected and sold about them; 2) request the categories and specific pieces of personal information the business collects about them; and 3) opt out of the sale of their personal information, or opt in, in the case of minors under 16 years of age. Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has one of the most comprehensive privacy laws in the country when it comes to protecting consumers' personal information. Since the passage of these two key laws, other states around the country have followed California's lead and adopted similarly stringent privacy laws.

However, as the state has moved to the forefront in strengthening an individual's right to protect their personal information from large, private companies through the passage of the CCPA and CPRA, it has not yet updated the laws that are designed to protect Californians' privacy from state and local government agencies. The state's IPA has remained largely untouched since it was first passed in 1977. Since its initial passage, the world has undergone a digital revolution. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

According to the Author

California continues to be a leader on privacy, making it imperative that state agencies uphold the same standards of personal data privacy. Our state has long been at the forefront of advocating for robust privacy protections, recognizing that safeguarding personal information is foundational to individual autonomy and dignity. Therefore, it is incumbent upon state agencies to not only comply with existing privacy laws, but also to exceed them in their commitment to protecting sensitive data entrusted to them by the public.

Arguments in Support if Amended

Oakland Privacy, writing in a support if amended position of the bill notes:

The proposed change in the prohibition language that binds public agencies in the Information Practices Act of 1977 from "commercial purposes" to "financial benefit" would be a good change. By the nature of public agencies, relatively little of their activity can be strictly defined as purposefully commercial. However, any number of activities carried out for governmental purposes may convey a financial gain for the agency. We agree that selling or distributing the personal information of Californians by public agencies and receiving a financial benefit for doing so is behavior that should be prohibited unless specifically authorized in law. The specific authorization allows the Legislature to make exceptions on a case-by-case basis when there is a public good and when appropriate privacy protections are put into place. The Legislature has already done this in recent years for the Community College District to boost enrollment and for the EDD to assist Covered California with outreach to newly unemployed people. The language proposed here in AB 2388 is a more accurate description of the kinds of agency behavior the IPA is intended to regulate.

Oakland Privacy's initial position was "support if amended." Amendments taken in the Privacy and Consumer Protection Committee addressed the concerns they raised.

Arguments in Opposition

None

FISCAL COMMENTS

1. Costs (General Fund, special funds) of an unknown but potentially significant amount to state agencies that must change their policies and practices to conform to the bill's more expansive definition of personal information.
2. Possible revenue loss (General Fund, special funds) of an unknown amount to state agencies that may no longer generate financial gain from the sale or distribution of personal information. As discussed in more detail below, the extent of this practice among state agencies that must comply with the IPA is unknown.

According to the Legislative Analyst's Office, the General Fund faces a structural deficit in the tens of billions of dollars over the next several fiscal years. 

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta, Villapudua

UPDATED

VERSION: April 10, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0003250

1. Preston, Alex. "The death of privacy." The Guardian (Aug. 3, 2014) available at https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

Date of Hearing: May 8, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 2388

Author:(Joe Patterson) – As Amended Ver:April 10, 2024

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill expands the definition of “personal information” in the Information Practices Act (IPA) and prohibits a state agency from distributing, selling, or renting a person’s personal information for any purpose that has financial gain unless specifically authorized elsewhere in law.

FISCAL EFFECT:

1. Costs (General Fund, special funds) of an unknown but potentially significant amount to state agencies that must change their policies and practices to conform to the bill’s more expansive definition of personal information.
2. Possible revenue loss (General Fund, special funds) of an unknown amount to state agencies that may no longer generate financial gain from the sale or distribution of personal information. As discussed in more detail below, the extent of this practice among state agencies that must comply with the IPA is unknown.

According to the Legislative Analyst’s Office, the General Fund faces a structural deficit in the tens of billions of dollars over the next several fiscal years. 

COMMENTS:

1. Purpose. According to the author:

California continues to be a leader on privacy, making it imperative that state agencies uphold the same standards of personal data privacy. Our state has long been at the forefront of advocating for robust privacy protections, recognizing that safeguarding personal information is foundational to individual autonomy and dignity. Therefore, it is incumbent upon state agencies to not only comply with existing privacy laws, but also to exceed them in their commitment to protecting sensitive data entrusted to them by the public.

1. Background. The IPA governs the collection, maintenance, and disclosure of personal information by California state agencies. The statute was passed in 1977 and has largely remained unchanged since then, despite significant changes in how personal information is collected and used by private companies and government agencies. The IPA does not apply to local agencies. This bill expands the definition of “personal information” in the IPA to mirror the more comprehensive definition included in the California Consumer Privacy Act, which governs collection and disclosure of personal data by private companies. The bill also specifies a state agency may not distribute, sell, or rent personal information “for any purpose that has financial gain” unless doing so is specifically authorize by law.

According to the author’s office, this bill was inspired in part by media reports that indicate the California Department of Motor Vehicles (DMV) has generated significant revenue from the commercial sale of certain personal information the department maintains about California drivers. The DMV reports it is required by statute to provide specified personal information to commercial requesters and the revenues cited in media stories were fees the department charges to offset its costs for providing the data (see Vehicle Code sections 1810 and 1811). These fees are authorized by statute and the amount of the fees is set in regulations. Additionally, the IPA contains an exemption that expressly permits the DMV to release specified personal information (Civil Code section 1798.24, subd. (m).). In light of this exemption and the DMV’s existing statutory authority to collect fees for provision of personal information, it is not clear that this bill would alter the DMV’s personal information practices.

That said, it is unknown whether any other state agencies in California currently sell personal information for financial gain and would be required to stop doing so under this bill. The author’s office has not identified any other agencies that do so.

1. Prior Legislation. AB 2677 (Gabriel), of the 2021-2022 Legislative Session, would have expanded the definition of “personal information” in the IPA and made it easier to enforce violations of the IPA by state agencies. AB 2677 was vetoed by Governor Newsom, who wrote:

…I am concerned this bill is overly prescriptive and could conflict with the State’s goal to provide person-centered, data driven, and integrated services. Additionally, this bill would cost tens of millions of dollars to implement across multiple state agencies that were not accounted for in the budget…Bills with significant fiscal impact, such as this measure, should be considered and accounted for as part of the annual budget process.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 2, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 2388 (

Author:Joe Patterson) – As Introduced Ver:February 12, 2024

AS PROPOSED TO BE AMENDED

SUBJECT: Information Practices Act of 1977

SYNOPSIS

The Information Practices Act of 1977 (IPA) modeled after the Federal Privacy Act of 1974, is the primary privacy statute governing the collection, maintenance, and disclosure of personal information by California state agencies. The act has not been significantly updated since its enactment.

Over the past decade, it has become increasingly clear that not only is our right to privacy significantly eroded, our private information and activities are now being harvested and sold for a profit, not only by private companies but potentially by state agencies as well. According to a 2019 investigation by Motherboard (provided by the author), a Public Records Act (PRA) request uncovered the fact that California’s state agencies are also selling Californians’ personal information, without their consent, for financial gain. Specifically, the Department of Motor Vehicles (DMV) reported that in fiscal year 2013-14, the DMV received approximately $42 million in revenue from selling the names, addresses, and car registration information to commercial requesters. By 2017-18, that figure increased to $52 million.

This bill is attempting to address this finding by updating the IPA in three significant ways:

1. By updating the definition of “personal information” in the law to more closely align with the definition in the California Consumer Privacy Act (CCPA) and to reflect our current understanding of what constitutes personal information in the age of the internet.
2. By expanding the current statute that limits prohibitions against state agencies selling Californians’ names and addresses for profit to include a prohibition against the sale of any personal information, as newly defined, by a state agency unless it is explicitly authorized in state statutes.
3. By replacing the term “commercial purposes” with a more precise and accurate term for government entities – “financial gain.”

The Committee has proposed several strengthening amendments, primarily around the definition of “personal information.” Those amendments are discussed in detail in this analysis.

This bill is author-sponsored and has no registered opposition. Oakland Privacy has taken a “support if amended position.” The proposed amendments should address the concerns raised in their letter.

SUMMARY: Prohibits a state agency from distributing, selling, or renting an individual’s personal information for any purpose that has financial gain unless that action is specifically authorized. Specifically, this bill:

1. Defines “personal information” as any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, vehicle registration information (including license plate number), insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
2. Prohibits a state agency from distributing, selling, or renting personal information for any financial gain unless specifically authorized by state statutes.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. Establishes the Information Practices Act (IPA) of 1977, which generally enumerates the requirements applicable to state agencies that collect, maintain, and disclose personal information from California residents, including limitations on permissible disclosure, the rights of residents to know and access the information, and required accounting of disclosures of the information. (Civ. Code § 1798, et seq.)
3. States, in the IPA, that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
4. Requires that each state agency maintain in its records only personal information that is relevant and necessary to accomplish the purpose of the agency. (Civ. Code § 1798.14.)
5. Requires that each agency collect personal information to the greatest extent practicable directly from the individual who is the subject of the information rather than from another source. (Civ. Code § 1798.15.)
6. Prohibits an individual’s name and address from being distributed for commercial purposes, sold, or rented by an agency unless such action is specifically authorized by law. (Civ. Code § 1798.60.)
7. Defines “personal information,” for purposes of the IPA, as any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, the individual’s name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. (Civ. Code § 1798.3(a).)
8. Defines “agency”, for the purposes of the IPA, to mean every state office, officer, department, division, bureau, board, commission, or other state agency, except for the California Legislature, agencies within the judicial branch, the State Compensation Insurance Fund, and local agencies, defined to include: counties; cities, whether general law or chartered; cities and counties; school districts; municipal corporations; districts; political subdivisions; or any board, commission, or agency thereof; other local public agencies, or entities that are legislative bodies of a local agency as specified. (Civ. Code § 1798.3(b); Gov. Code § 6252(a).)
9. Requires each agency to keep an accurate accounting of the date, nature, and purpose of each disclosure of a record made pursuant to specified circumstances; and requires each agency to retain that accounting for at least three years after the disclosure, or until the record is destroyed, whichever is shorter. (Civ. Code §§ 1798.25 & 1798.27.)
10. Except as specified, endows each individual with the following rights: to inquire and be notified as to whether the agency maintains a record about them; to inspect all personal information in any record maintained by reference to an identifying particular of the individual; and to submit a request in writing to amend a record containing personal information pertaining to them maintained by an agency. (Civ. Code § 1798.30, et seq.)
11. Requires each state agency, when it provides by contract for the operation or maintenance of records containing personal information to accomplish an agency function, to cause, consistent with its authority, the requirements of the IPA to be applied to those records; and specifies that for purposes of enforcing penalties for violations of the IPA, any contractor and any employee of the contractor, shall be considered to be an employee of an agency. (Civ. Code § 1798.19.)
12. Defines “Personal information” under the California Consumer Privacy Act as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
    1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
    2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
    3. Biometric information.
    4. Internet activity information, including browsing history and search history.
    5. Geolocation data.
    6. Professional or employment-related information. (Civ. Code § 1798.140(v).)

FISCAL EFFECT: As currently in print, this bill is keyed fiscal.

COMMENTS:

1) Background. In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA) (AB 375 (Chau, Chap. 55, Stats. 2018)), which gave consumers certain rights regarding their personal information, such as the right to: (1) know what personal information that is collected and sold about them; (2) request the categories and specific pieces of personal information the business collects about them; and (3) opt out of the sale of their personal information, or opt in, in the case of minors under 16 years of age. Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has one of the most comprehensive privacy laws in the country when it comes to protecting consumers’ personal information. Since the passage of these two key laws, other states around the country have followed California’s lead and adopted similarly stringent privacy laws.

However, as the state has moved to the forefront in strengthening an individual’s right to protect their personal information from large, private companies through the passage of the CCPA and CPRA, it has not yet updated the laws that are designed to protect Californians’ privacy from state and local government agencies. As discussed in detail in a later section, the state’s IPA has remained largely untouched since it was first passed in 1977. Since its initial passage, the world has undergone a digital revolution. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only is our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed “surveillance capitalism” by social psychologist, Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the “normal” economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.

The social effect is a new form of inequality, reflected in the colossal asymmetry between what these companies know about us and what we know about them.^[2]

2) Purpose of this bill. What this bill is attempting to address is the realization that it is not only private businesses that are profiting from the sale of individuals’ personal information, but government agencies as well. According to a 2019 investigation by Motherboard (provided by the author), a Public Records Act (PRA) request uncovered the fact that California’s state agencies are also selling Californians’ personal information, without their consent, for financial gain. Specifically, the Department of Motor Vehicles (DMV) reported that in fiscal year 2013-14 the DMV received approximately $42 million in revenue from selling the names, addresses, and car registration information to commercial requesters. By fiscal year 2017-18, the amount of revenue generated had grown to over $52 million.^[3] The article goes on to note that a previous investigation that looked at DMVs across the country determined that data broker LexisNexis and credit reporting agency Experian appeared frequently on the list of companies that obtained information. In addition, that investigation also found that DMVs sold information to private investigators, “including those hired to find out if a spouse is cheating.” The author of the investigation does note in the 2019 article that is was unclear if the California DMV had recently sold data to these types of entities. Finally, the article notes that the California DMV told the authors that requesters may also include insurance companies, vehicle manufacturers, and prospective employers. In a response to the authors of the report, the California DMV stated:

The DMV takes its obligation to protect personal information very seriously. Information is only released pursuant to legislative direction, and the DMV continues to review its release practices to ensure information is only released to authorized persons/entities and only for authorized purposes. The DMV also audits requesters to ensure proper audit logs are maintained and that employees are trained in the protection of DMV information and anyone having access to this information sign[s] a security document.^[4]

3) Author’s statement. According to the author:

California continues to be a leader on privacy, making it imperative that state agencies uphold the same standards of personal data privacy. Our state has long been at the forefront of advocating for robust privacy protections, recognizing that safeguarding personal information is foundational to individual autonomy and dignity. Therefore, it is incumbent upon state agencies to not only comply with existing privacy laws, but also to exceed them in their commitment to protecting sensitive data entrusted to them by the public.

4) The Information Practices Act of 1977. The Information Practices Act of 1977 (IPA; Civ. Code § 1798, et seq.), modeled after the Federal Privacy Act of 1974, is the primary privacy statute governing the collection, maintenance, and disclosure of personal information by California state agencies. As outlined in the EXISTING LAW section previously, along with the substantive provisions of the IPA, the Legislature codified findings and declarations upon its passage justifying the need for the consistent limits on the maintenance and dissemination of personal information by government agencies (see #3 in that section).

Generally, the IPA places several conditions and restrictions on the collection, maintenance, and disclosure of the personal information of Californians held by state agencies, including a prohibition on the disclosure of an individual’s personal information without the individual’s consent except in specified circumstances. In addition, the IPA requires that along with any form requesting personal information from an individual, an agency provide notice of information pertaining to the individual’s rights with respect to their personal information, the purposes for which the personal information will be used, and any foreseeable disclosures of that personal information.

The IPA also provides individuals with certain rights to be informed of what personal information an agency holds relating to that individual; to access and inspect that personal information; and to request corrections to that personal information, subject to specified exceptions. Finally, when state agencies contract with private entities for services, the contractors are typically governed by the IPA, with few additional privacy protections generally stipulated in the contracts themselves.

5) How this bill would work. As proposed to be amended, this bill would update the definition of “personal information” in the IPA to more closely conform to the more comprehensive definition included in the CCPA. Along with that updated definition, the bill proposes replacing the current statutory prohibition against selling names and addresses with the updated definition of personal information in order to expand the prohibition to include all information that could “identify, describe or is capable of being associated with a particular individual.”

Finally, this bill amends the current law prohibition against state agencies selling, renting, or distributing the name and addresses of Californians for commercial purposes to clarify that personal information cannot be distributed, sold, or rented for financial gain unless specifically authorized by state statutes.

6) Proposed amendments.

Amendment #1 does the following:

Civ Code § 1798.3(a) would be amended as follows:

The term “personal information” means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, the individual’s name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. “Personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, vehicle registration information (including license plate number), insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. 

Amendment #2 does the following:

Civ Code § 1798.60, as amended in AB 2388 would be further amended as follows:

An individual’s name and address personal information as defined in Section 1798.3(a) shall not be distributed, sold, or rented by an agency for any purpose that has financial gain unless that action is specifically authorized by law.

7) Analysis. Definition of Personal Information. As discussed previously, the IPA currently defines “personal information” to mean “any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual (Civ. Code § 1798.3(a)).” In addition to not explicitly including several more modern forms of personal information, this definition also seems to imply that the information must actively identify or describe a particular individual in order to qualify as “personal information.” In other words, even if, through processing or integration with other information, that information can ultimately identify a person, so long as the information is not maintained in a manner directly associated with an individual, it may not qualify as personal information under the current definition.

This bill, as proposed to be amended, would expand the definition of “personal information” in the IPA to include information that is not presently identifiable but could be re-identified. The expanded definition expressly includes types of information gleaned through technology that did not exist when the IPA was originally enacted. Given how much individual privacy has been eroded as the internet has evolved and how personal information is being sold and shared for a profit despite the implications and risks of sharing the information, it is in keeping with the state’s privacy goals to update the IPA’s definition of personal information to more closely align with California’s modern privacy laws.

Further, in their “support if amended” letter, Oakland Privacy notes:

The proposed change in the prohibition language that binds public agencies in the Information Practices Act of 1977 from “commercial purposes” to “financial benefit” would be a good change. By the nature of public agencies, relatively little of their activity can be strictly defined as purposefully commercial. However, any number of activities carried out for governmental purposes may convey a financial gain for the agency. We agree that selling or distributing the personal information of Californians by public agencies and receiving a financial benefit for doing so is behavior that should be prohibited unless specifically authorized in law. The specific authorization allows the Legislature to make exceptions on a case-by-case basis when there is a public good and when appropriate privacy protections are put into place.

Oakland Privacy’s conclusions that the current language centered around “commercial purposes” is inadequate, combined with the DMV investigation discussed at length above, makes a compelling case for clarifying the bill to prohibit state agencies from reaping any financial gain from continuing to commodify the personal information of Californians without explicit statutory authority.

Finally, the last few years, particularly since the fall of Roe v. Wade, this Committee has prioritized enhancing the state’s privacy protections in order to ensure that vulnerable California residents and those coming to California for reproductive health and gender-affirming services are not put at risk due to the sharing or sale of their personal information. This bill clearly furthers those priorities.

8) Related legislation. AB 2677 (Gabriel, 2022) would have made changes to the Information Practices Act of 1977 (IPA), including expanding the definition of personal information to include information that is reasonably capable of identifying an individual, prohibiting an agency from using records containing personal information for any purposes other than those for which the information was collected or generated, and adjusting penalties for violations of the law to include discipline negligent violations and to eliminate injury-in-fact requirements for intentional disclosures of sensitive information. That bill was vetoed by the Governor. In his veto message, the Governor stated:

I commend the author for his commitment to data privacy and am supportive of expanding security protocols to further protect personal information collected by state agencies and businesses. However, I am concerned this bill is overly prescriptive and could conflict with the State's goal to provide person-centered, data driven, and integrated services. Additionally, this bill would cost tens of millions of dollars to implement across multiple state agencies that were not accounted for in the budget.

With our state facing lower-than-expected revenues over the first few months of this fiscal year, it is important to remain disciplined when it comes to spending, particularly spending that is ongoing. We must prioritize existing obligations and priorities, including education, health care, public safety and safety-net programs.

The Legislature sent measures with potential costs of well over $20 billion in one-time spending commitments and more than $10 billion in ongoing commitments not accounted for in the state budget. Bills with significant fiscal impact, such as this measure, should be considered and accounted for as part of the annual budget process. For these reasons, I cannot sign this bill.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Support if amended

Oakland Privacy

Opposition

None on file

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Preston, Alex. “The death of privacy.” The Guardian (Aug. 3, 2014) available at https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. “You Are the Object of a Secret Extraction Operation.” The New York Times (Nov. 12, 2021) available at https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Cox, Joseph. “The California DMV Is Making $50M a Year Selling Drivers’ Personal Information,” Motherboard Tech by Vice (Nov. 25, 2019) ↑

4. Ibid. ↑