BILL NUMBER: AB 372	AMENDED
	BILL TEXT

	AMENDED IN ASSEMBLY  MARCH 19, 2007

INTRODUCED BY   Assembly Member Salas

                        FEBRUARY 15, 2007

   An act to amend Section 1798.84 of the Civil Code, relating to
personal information.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 372, as amended, Salas. Personal  information: civil
penalties   information  .
   Existing law requires a business to take all reasonable steps to
destroy, or arrange for the destruction of, a customer's records
within its custody or control containing personal information that is
no longer to be retained by the business, as specified.
   Existing law requires a business that owns or licenses personal
information about a California resident to implement and maintain
reasonable security procedures and practices appropriate to the
nature of the information, and to protect that personal information
from unauthorized access, destruction, use, modification, or
disclosure. Existing law requires a business that discloses that
information to a 3rd party to ensure by contract that the 3rd party
agrees to implement and maintain reasonable security procedures.
   Existing law requires any person or business that conducts
business in California, and that owns or licenses computerized data
that includes personal information, to disclose any breach of that
data.
   Existing law, upon request, requires a business to provide
specified information to a customer in relation to the disclosure of
personal information to 3rd parties, as specified.
   For a violation of any of the above-described provisions, existing
law allows an injured customer to institute a civil action to
recover damages or for injunctive relief.
   This bill would  , in addition to those remedies, impose a
civil penalty in the amount of up to $2,500 upon any business that
violates, proposes to violate, or has violated any of the
above-described provisions, to be assessed and recovered in a civil
action brought in the name of the people of the State of California
by the Attorney General, or by any district attorney, any county
counsel, or any city attorney of a city or city and county 
 make technical, nonsubstantive changes to that provision  .

   Vote: majority. Appropriation: no. Fiscal committee:  yes
  no  . State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 1798.84 of the Civil Code is amended to read:
   1798.84.  (a) Any waiver of a provision of this title is contrary
to public policy and is void and unenforceable.
   (b) Any customer injured by a violation of this title may
institute a civil action to recover damages. 
   (c) Any business that violates, proposes to violate, or has
violated this title shall be liable for a civil penalty not to exceed
two thousand five hundred dollars ($2,500), which shall be assessed
and recovered in a civil action brought in the name of the people of
the State of California by the Attorney General, or by any district
attorney, any county counsel, or any city attorney of a city or city
and county.  
   (d) 
    (c)  Any business that violates, proposes to violate, or
has violated this title may be enjoined. 
   (e) 
    (d)  In addition, for a willful, intentional, or
reckless violation of Section 1798.83, a customer may recover a civil
penalty not to exceed three thousand dollars ($3,000) per violation.
Otherwise, the customer may recover a civil penalty of up to five
hundred dollars ($500) per violation for a violation of Section
1798.83. 
   (f) 
    (e)  Unless the violation is willful, intentional, or
reckless, a business that is alleged to have not provided all the
information required by subdivision (a) of Section 1798.83, to have
provided inaccurate information, failed to provide any of the
information required by subdivision (a) of Section 1798.83, or failed
to provide information in the time period required by subdivision
(b) of Section 1798.83, may assert as a complete defense in any
action in law or equity that it thereafter provided regarding the
information that was alleged to be untimely, all the information, or
accurate information, to all customers who were provided incomplete
or inaccurate information, respectively, within 90 days of the date
the business knew that it had failed to provide the information,
timely information, all the information, or the accurate information,
respectively. 
   (g) 
    (f)  A prevailing plaintiff in any action commenced
under Section 1798.83 shall also be entitled to recover his or her
reasonable attorney's fees and costs. 
   (h) 
    (g)  The rights and remedies available under this
section are cumulative to each other and to any other rights and
remedies available under law.