BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2011-2012 Regular Session
AB 1280 (Hill)
As Amended May 26, 2011
Hearing Date: July 5, 2011
Fiscal: Yes
Urgency: No
BCP
SUBJECT
Ephedrine: Retail Sale
DESCRIPTION
This bill would require retailers to immediately transmit
information regarding pseudoephedrine purchases to the National
Precursor Log Exchange (NPLEx), a privately funded out-of-state
database. That system would be required to provide retail
distributors with an immediate real-time alert if a person
attempts to purchase pseudoephedrine in violation of the sales
limits. This bill would require the retail distributor to
transmit information regarding the consumer to the database,
including the consumer's name, date of birth, and address and
the product sold, the quantity of packages, and the total gram
amount of pseudoephedrine involved in the sale.
This bill would also repeal existing statutory provisions for
over-the-counter sales of pseudoephedrine and related products
and replace them with new sales limits consistent with federal
law. This bill would impose additional restrictions on the sale
of pseudoephedrine products in accordance with federal law,
including that retail distributors must store those products in
a locked cabinet or behind the counter.
BACKGROUND
Despite limits on purchases of pseudoephedrine, laboratory
incidents in California rose in 2008 to 346. Many law
enforcement agencies, including the Drug Enforcement
Administration, have concluded that the rise in laboratories in
(more)
AB 1280 (Hill)
PageB of?
2008 resulted from an increase in "smurfing" of pseudoephedrine.
Smurfing involves purchases of small amounts of pseudoephedrine
from numerous drug stores. While smurfers may violate federal
law in purchasing more than 9 grams in a month - although each
purchase would not be over the 3.6 gram limit - the lack of
adequate law enforcement personnel and resources to manually
review purchase logs allows smurfing to continue.
In 2006, the federal Combat Methamphetamine Epidemic Act (CMEA)
was enacted to restrict the retail sale of ephedrine,
pseudoephedrine, norpseudoephedrine, or phenylpropanolamine.
States have enacted limits on purchases of pseudoephedrine,
imposed point-of-sale restrictions, or enacted pseudoephedrine
tracking laws. Oregon has required a prescription for
pseudoephedrine purchases since 2006. Mississippi has required
a prescription since July 2010.
Of the states that require electronic tracking (an arguable
alternative to requiring a prescription), 14 out of the 16 use
the National Precursor Log Exchange (NPLEx), funded by the
manufacturers of pseudoephedrine products to track
pseudoephedrine sales. Those purchase logs are then freely
accessible by law enforcement with no requirement for a warrant.
This bill would add California to that list of states by
requiring retail distributors to send purchase information to
NPLEx for purposes of determining whether a proposed sale would
violate limit requirements. A substantially similar bill, AB
1455 (Hill, 2010) was held in this Committee last year due to
privacy concerns.
This bill was approved by the Senate Committee on Public Safety
on June 21, 2011.
CHANGES TO EXISTING LAW
Existing law, the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. Art. I, Sec. 1.)
Existing law , with specified and detailed exceptions, prohibits
disclosure of medical information without the authorization of
the patient. Medical information shall be disclosed pursuant to
a court order or a warrant issued to a law enforcement agency.
Other specific exceptions are enumerated. (Civ. Code Sec.
AB 1280 (Hill)
PageC of?
56.10.)
Existing law provides that medical information can be disclosed
"when otherwise specifically required by law." (Civ. Code Sec.
56.10, subd. (b)(9).)
Existing federal law includes the Health Insurance Portability
and Accountability Act of 1996 (HIPAA) which, subject to
specified exceptions and procedures, provides that medical
information shall be confidential. (Pub. Law 104-191; 45 CFR
160, 164.)
Existing law classifies controlled substances in five schedules
according to their dangerousness and potential for abuse.
(Health & Saf. Code Secs. 11054-11058.)
Existing law includes the CURES (Controlled Substance
Utilization Review and Evaluation System) system to provide for
the electronic monitoring of the prescribing and dispensing of
Schedule II, III and IV controlled substances. CURES provides
for the electronic transmission of Schedule II, III and IV
prescription data to the Department of Justice (DOJ) at the time
prescriptions are dispensed. (Health & Saf. Code Sec. 11165.)
Existing law provides that pharmacists, in filling a controlled
substance prescription, shall provide to DOJ the patient's name,
date of birth, the name, form, strength, and quantity of the
drug, and the pharmacy name, pharmacy number, and the
prescribing physician information. (Health & Saf. Code Sec.
11165 (d).)
Existing law provides that the DOJ may initiate the referral of
the history of controlled substances dispensed to an individual,
based on the CURES data, to licensed health care practitioners
and pharmacists, as specified. (Health & Saf. Code Sec.
11165.1(b).) Existing law provides that the history of
controlled substances dispensed to a patient based on CURES data
that is received by a practitioner or pharmacist shall be
considered medical information, as specified. (Health & Saf.
Code Sec. 11165.1(c).)
Existing law includes a detailed regulatory scheme for the
production and distribution of specified chemicals that may be
precursors to controlled substances, and provides that producers
and users of precursor chemicals must obtain a permit from DOJ.
Applications for permits must include documentation of
AB 1280 (Hill)
PageD of?
legitimate uses for regulated chemicals. (Health & Saf. Code
Sec. 11106.)
Existing law requires any person or entity that sells,
transfers, or otherwise furnishes a specified chemical
precursor to another person or entity to submit a report to
the DOJ, generally within 21 days, of each transaction. The
report must include the identification information about the
purchaser. (Health & Saf. Code Sec. 11100(d).)
Existing law provides that it is unlawful for a retailer to sell
in a single transaction more than three packages, or 9 grams, of
a product that he or she knows to contain ephedrine,
pseudoephedrine, norpseudoephedrine, or phenylpropanolamine.
With specified exceptions, the three package-9 grams per
transaction limitation applies to any product lawfully furnished
over the counter without a prescription pursuant to applicable
federal law. This offense is a misdemeanor, punishable by a
county jail term of up to 6 months, a fine of up to $1,000, or
both. (Health & Saf. Code Sec. 11100 (g)(3).)
Existing federal law, the Combat Methamphetamine Epidemic Act
(CMEA) , includes detailed restrictions and requirements for the
retail sale of ephedrine, pseudoephedrine, norpseudoephedrine,
or phenylpropanolamine. These restrictions include, in part:
no more than 3.6 grams may be sold in a single
transaction;
no more than 9 grams per customer may be sold in a
one-month period;
if the drug is obtained through postal or similar
delivery, no more than 7.5 grams can be so obtained;
the seller must maintain a written or electronic logbook
of each sale, including the date of the transaction, the
name and address of the purchaser, and the quantity sold;
the purchaser must present valid identification, as
specified, and the seller must verify the identification;
the purchaser must sign a paper or electronic logbook,
as specified;
the seller must maintain these documents, as specified;
and
law enforcement shall have access to the information
pursuant to regulations adopted by the DOJ. (21 U.S.C.
Secs. 830(e), 844 (a).)
Existing federal law includes an exception to the log book
AB 1280 (Hill)
PageE of?
recording of transactions in the case of a transaction that
involves a single package that contains not more than 60
milligrams of pseudoephedrine. (21 U.S.C. Sec. 841
(e)(1)(A)(iii).) Existing federal law requires retailers to
retain purchase information for not less than two years. (21
U.S.C. Sec. 841(v)(6).)
Existing federal regulations protect the privacy of individuals
who purchase scheduled listed chemical products by restricting
disclosure of information in logbooks as follows:
the information shall be disclosed as appropriate to the
Administration and to State and local law enforcement
agencies;
the logbook information shall not be accessed, used, or
shared for any purpose other than compliance with CMEA or
to facilitate a product recall; and
a regulated seller who in good faith releases
information in a logbook to Federal, State, or local law
enforcement authorities is immune from civil liability for
the release unless the release constitutes gross negligence
or intentional, wanton, or willful misconduct. (21 C.F.R.
Sec. 1314.45.)
This bill would repeal existing statutory provisions for
over-the-counter sales of pseudoephedrine and replace them with
new purchase limits and electronic tracking of purchases.
This bill would provide that a violation of either the sales
limits or required procedures for a pseudoephedrine transaction
is a misdemeanor, punishable on a first conviction by a fine of
up to $1,000, a jail term of up to six months, or both. Upon a
subsequent conviction, the maximum jail term is one year and the
maximum fine is $10,000.
This bill would include the following procedures and sales
limits:
a retailer must store pseudoephedrine products in a locked
cabinet or behind the counter;
a retailer may sell no more than 3.6 grams of pseudoephedrine
within 24 hours and no more than 9 grams in a 30-day period;
data recording shall not apply to sale of a single package
containing no more than 60 milligrams of a product containing
pseudoephedrine;
the user must present valid photo identification;
AB 1280 (Hill)
PageF of?
the retailer must record the following at the time of making a
transaction:
o the date of the transaction;
o the type and number of the buyer's identification,
and the issuing agency;
o the name, date of birth and address of the
purchaser;
o the name and quantity product sold, including gram
weight;
o the name or initials of the person making the sale;
the retailer shall immediately transmit the information about
the sale and the purchaser to the National Precursor Log
Exchange (NPLEx) electronic monitoring system administered by
the National Association of Drug Diversion Investigators
(NADDI) for the purpose of determining whether or not the sale
would exceed statutory limits;
the retailer's duty arises when the NPLEx system is available
to retailers without cost;
the purchaser must provide valid identification, as specified;
and
the purchaser must sign a written or electronic log.
This bill would, provided that the DOJ executes a memorandum of
understanding (MOU) governing access, require NADDI to forward
California transaction records in NPLEx to the Department of
Justice weekly and provide real-time access to NPLEx information
to law enforcement in the state, as specified. This bill would
additionally require the MOU to:
state that no party to the MOU, nor any entity under contract
to provide the electronic authorization and monitoring system,
shall be authorized to use the information contained in the
system or any purpose other than set forth in this bill, the
federal Combat Methamphetamine Epidemic Act of 2005, or
applicable regulation. The system operation would be
authorized to analyze the information for the sole purpose of
assessing and improving performance and efficacy of the
system; and
require that any retail distributor's access to the database
is limited solely to records of sales transactions made by
that distributor, which shall be solely for the purposes of
complying with federal law or this bill, or to respond to a
duly authorized law enforcement request or court order.
This bill would additionally:
require the system to be capable of providing a retail
AB 1280 (Hill)
PageG of?
distributor with an immediate real-time alert if a sale
violates the legal limits;
require the system's security program to comply with security
standards for the Criminal Justice Information System of the
Federal Bureau of Investigation, and may be audited once a
year by the DOJ;
provide that a retail distributor's use of the system shall be
subject to Section 56.101 of the Civil Code (imposes various
requirements to preserve the confidentiality of the medical
information); prohibit those distributors from maintaining any
records collected under the system for longer than two years,
or as otherwise required by federal law;
require the system to record law enforcement access to the
system by means of a unique access code for each individual
accessing the system; each user's history shall be maintained
and maybe audited by the department; and
allow the DOJ to submit recommendations to NADDI regarding
system changes to assist in identifying false identification
cards.
This bill would require the State Board of Equalization to
notify all retailers about the requirement to submit
transactions to NPLEx no later than April 1, 2012.
This bill would not apply to a health care practitioner with
prescriptive authority who is currently licensed in the state.
This bill would state the intent of the Legislature to preempt
all local ordinances or regulations governing the sale by a
retail distributor of over-the-counter products containing
ephedrine, pseudoephedrine, norpseudoephedrine, or
phenylpropanolamine.
This bill would sunset on January 1, 2018.
COMMENT
1. Stated need for the bill
According to the author:
AB 1280 provides teeth to existing federal law limiting the
sales of pseudoephedrine (PSE) products. Federal law in
place since 2006 has imposed both daily and monthly limits
on quantities of products containing PSE that can be
AB 1280 (Hill)
PageH of?
purchased. Consumers must specifically ask for the products
(only available behind the counter), provide identification
and sign a log book prior to completing a sale. Limits on
PSE quantities were imposed as it is a primary ingredient in
the manufacture of methamphetamine.
However, the paper logs maintained by each store or pharmacy
are independent. As such, there is no way for a retailer to
know if an individual has already met or exceeded the
federal limit. A criminal could easily go from one store to
another and hence accumulate large quantities of PSE.
AB 1280 requires California retailers selling PSE products
over the counter to enter the purchase into an electronic
log prior to completing the sale. The networked, unified,
electronic log will immediately alert retailers if the
consumer has exceeded the federal limits. If so, retailers
would be required to stop the sale.
The electronic log in AB 1280 will be both consumer and
retailer friendly. The interaction for the consumer would
be the same as under current law. The retailer would simply
enter the information into an electronic log (i.e. a web
based interface) as opposed to the existing paper log.
Retailers will know in real-time whether or not the purchase
will exceed the federal limits.
The electronic log in AB 1280 would be both anti-criminal
and pro-consumer. Criminals will have a much harder time
violating federal law if each store he or she approaches
knows immediately whether or not the purchase is legal.
Simultaneously, AB 1280 will protect access to effective
medication for the millions of California allergy sufferers.
The Consumer Healthcare Products Association (CHPA), the trade
association representing U.S. manufacturers of nonprescription
medicines, further asserts:
With NPLEx in place, retailers will obtain pre-approval from
the system to make a sale, and over-limit sales are denied,
stopping illegal sales before they happen. The sales data
are maintained in a highly secure environment and, under
federal law and the provisions of AB 1280, are legally
available to law enforcement. Manufacturers fully fund
NPLEx, so there is no charge to retailers, states, or law
AB 1280 (Hill)
PageI of?
enforcement.
In the states with the most critical meth lab problems,
electronic tracking has been overwhelmingly the policy
solution of choice for addressing the critical issue of PSE
diversion. In addition, AB 1280 represents an alternative
to proposals which would make these FDA approved products
available only with a prescription. Such proposals are in
extreme reaction and have serious negative health care
access and fiscal impacts. As you know, over the counter
medications are taxed at the point of sale while
prescription medications are not. This measure, AB 1280,
preserves the sales tax on these safe and effective products
estimated at over $4M in 2010, while helping to safeguard
the community from illicit meth production.
2. Background on the National Precursor Log Exchange (NPLEx)
This bill seeks to require all retail distributors to use a
database (NPLEx) that will store information regarding every
person who purchases pseudoephedrine-based products within the
state of California without a prescription - that tracking
system would alert stores when a particular purchaser has
exceeded the specified purchase limit.
For background, the National Association of Drug Diversion
Investigators (NADDI)<1> provides NPLEx at no cost to states.
Funding for the NPLEx database comes from the manufacturers of
pseudoephedrine products, and Appriss (a private company
headquartered in Louisville, Kentucky) provides the software and
houses the service in its data center. The bill would also
allow the Department of Justice to execute a memorandum of
understanding (MOU) with NADDI governing access to the database,
which would also include language seeking to address the privacy
of the information.
---------------------------
<1> NADDI (est. 1989) is a national non-profit organization
that, according to its Web site, "facilitates cooperation
between law enforcement, healthcare professionals, state
regulatory agencies and pharmaceutical manufacturers in the
investigation and prevention of prescription drug abuse and
diversion. NADDI also sponsors and conducts specialized
educational seminars and conferences." NADDI is based in
Maryland. The association has 21 state chapters, including
California.
AB 1280 (Hill)
PageJ of?
That unusual relationship between the State of California and
NADDI raises not only questions about how California may enforce
the provisions of a third party contract (NADDI with Appriss),
but also the appropriateness of authorizing a database
containing customers' names, addresses, dates of birth,
identification numbers, and names and quantities of
pseudoephedrine to be maintained by that third-party outside of
California.
a. NADDI and Appriss
The proposed requirement for retailers to submit transaction
data to NPLEx appears to be consistent with a multi-state
initiative by industry to implement an electronic tracking of
over-the-counter sales of pseudoephedrine. That initiative is
described as follows by the Consumer Healthcare Products
Association (CHPA), a supporter, in their January 11, 2010
letter to the President of the Kansas Board of Pharmacy:
On behalf of our member companies that make
nonprescription PSE medicines, CHPA has offered to fully
fund a PSE sales electronic tracking system in Kansas.
CHPA's proposal is the only one that meets the statutory
funding requirement, allowing the Board of Pharmacy to
meet its legislative directive.
CHPA's member companies have entered into exclusive
contracts with the nation's leading vendor of PSE
e-tracking systems, and therefore are able only to
provide funding for the system that has been offered to
the Board. We are offering to provide this system, named
the National Precursor Log Exchange (NPLEx), across
multiple states as an integrated solution. . . .
NADDI is a non-profit association that provides education
and training for law enforcement agents on the diversion
of pharmaceutical products. Its role in the NPLEx
initiative is to enter into a Memorandum of Understanding
(MOU) with the appropriate state agency, act as the
administrator of NPLEx, and to liaise with law
enforcement to ensure that NPLEx is understood and fully
utilized.
CHPA's participating member companies are supporting
NPLEx by paying a transactional fee based on sales of
AB 1280 (Hill)
PageK of?
their PSE products. This funding stream fully supports
NPLEx, meaning that the system can be deployed and
maintained at no charge to retailers or to states. Access
to NPLEx is available free of charge to any law
enforcement agent who is properly authorized by the
state. . . .
Reflecting the priority that our member companies have
put on delivering a single vendor platform for NPLEx,
their contracts with Appriss and NADDI are exclusive, and
therefore prohibit our companies from sponsoring systems
operated by any other vendor.
This bill represents the policy choice of joining other states
in selecting a single out-of-state private company to operate
a database that would track purchases of pseudoephedrine
products by requiring retailers to enter the purchaser's
personal information. That database, funded by the
manufacturers of pseudoephedrine products, would log not only
the individual's personal information, but also the product
they purchased.
b. Lack of a direct contract with Appriss, a non-California
company
Although similar to the process in other states, this bill
would take the unusual approach of requiring retailers to
send sensitive information to NPLEx (an out-of-state
database run by a private company). This bill would allow
the Department of Justice (DOJ) to enter into a Memorandum
of Understanding with NADDI governing access, and require
that MOU to state that no party to the MOU, nor any entity
under contract to provide the database (Appriss), shall be
authorized to use the information contained in the system
for any purpose other than those set forth in the bill,
federal law, or implementing regulations. The relationship
between those parties raises legal issues of enforcement
should Appriss use (or release) the information in NPLEx for
unauthorized purposes.
For example, if Appriss were to release information to
manufacturers regarding customers who were purchasing
pseudoephedrine based products, including name, address,
type of product, and frequency of purchase, the question
arises as to how that violation could be enforced. The
action would arguably violate the intent of the MOU between
AB 1280 (Hill)
PageL of?
the DOJ and NADDI, but Appriss is arguably not a party to
that agreement. Additionally, since Appriss is located
outside of California, some of California's consumer
protections may not apply to that release of information.
As a result, while any MOU between the DOJ and NADDI would
be required to include information restricting access to the
database, it is unclear what legal restrictions (and
California laws) would be enforceable on the actual vendor
of the database who is arguably not a party to the
agreement.
DOES THIS BILL RAISE ENFORCEABILITY ISSUES?
It is also unclear whether that Memorandum of Understanding
would be a binding contract, or whether it would just
represent a mutual agreement between parties (MOUs can be
either, the key issue is whether the agreement itself meets
the requirement of a contract, and in the absence of any
funds changing hands (which would create the legal
requirement of consideration) it is unclear whether the MOU
would be a binding contract). Even if the MOU is a binding
contract, the actual entity providing the service is another
party, Appriss, who would not have a direct contractual
relationship with DOJ.
Given the contractual distance between the DOJ and Appriss,
the Committee should consider whether the State of
California has sufficient control and recourse to enforce
the requirements imposed by this bill.
DOES CALIFORNIA HAVE SUFFICENT CONTROL OVER APPRISS TO
ADEQUATELY ENSURE THE PRIVACY OF CONSUMERS' INFORMATION?
c. Comparison to CURES
Committee staff notes that there are alternatives to the
proposed privately held, third-party database.
Specifically, the CURES program provides for real-time
electronic transmission of specified prescription data to
DOJ. Under CURES, pharmacists, in filling a controlled
substance prescription, must provide to DOJ the patient's
name, date of birth, the name, form, strength, and quantity
of the drug, and the pharmacy name, pharmacy number, and the
prescribing physician information. Essentially the data is
analyzed for indications that controlled substances are
AB 1280 (Hill)
PageM of?
being improperly prescribed, or that drug abusers are
obtaining prescriptions for controlled substances from many
different doctors ("doctor shopping"). Physicians and
pharmacists, in addition to law enforcement, have access to
CURES data through PAR - patient activity reports.
Currently, a private contractor - Infinite Solutions Inc.
(ISI) - collects CURES data for DOJ.
Unlike the system proposed by this bill, that existing
system serves as an example of the DOJ directly contracting
with a third party for a similar system. That direct
contracting allows DOJ to use a competitive bid process and
select the company that is best suited for providing the
service to the State of California - that process also
provides DOJ with clear recourse should the system not meet
the stated need or goals.
SHOULD DOJ HAVE THE ABILITY TO CHOOSE THE VENDOR OF THE
DATABASE?
3. Opposition's concerns
The opposition, consisting of consumer groups, narcotics
officers, public defenders, and the California Attorney
General's Office raise numerous concerns about the mandated use
of a privately run database.
a. Database may not achieve stated goal of reducing
methamphetamine labs
Methamphetamine is a highly addictive, destructive drug that
is unique in that it generally cannot be formulated without
relying on a commercially produced compound (pseudoephedrine).
To the extent that the distribution of pseudoephedrine to
individuals who manufacture methamphetamine can be reduced,
that reduction has a direct result in limiting the amount of
produced product (although it can be argued that other meth
producers out of the area may step in). Given the fundamental
privacy issues that are raised by the requirement for
retailers to submit customer information to an out-of-state
privately run database, this bill raises a fundamental policy
question about whether those privacy issues are outweighed by
the benefits of the proposed system. Those potential benefits
are difficult to quantify and must be examined in conjunction
with a competing pending proposal to require prescriptions for
AB 1280 (Hill)
PageN of?
pseudoephedrine products (which has not triggered privacy
concerns).
DO THE PRIVACY RISKS OUTWEIGH THE POTENTIAL BENEFITS?
The California Attorney General's Office, sponsor of pending
prescription-only legislation, asserts that tracking systems
in place in other states have failed to curtail the increase
in methamphetamine labs and that implementation of the
proposed tracking system would not address California's
methamphetamine problem, and, would simply act to delay
implementation of a prescription only system. The Los Angeles
County District Attorney's Office contends that:
. . . experience has shown this system is ineffective at
keeping methamphetamine producers from obtaining the
pseudoephedrine they need to cook meth. Our office
notes, that the State of Kentucky is billed as the role
model for the type of program that AB 1280 would
establish. However the results of the electronic
authorization and monitoring program in Kentucky have
been disheartening at best and a complete failure at
reducing the amount of methamphetamine labs at worst.
Last year the State of Kentucky, utilizing it's
electronic authorization and monitoring law designed to
keep pseudoephedrine out of the hands of methamphetamine
producers, achieved the unsettling distinction of having
more methamphetamine labs than at any other time in the
state's history.
Alternatively, supporters point to the numerous sales that are
blocked each month by retailers in participating states using
the NPLEx database. It is unclear, however, whether the
majority of those blocked sales are average individuals who
are seeking allergy medicine who accidentally exceeded the
legal limit, or, reflect a concerted effort by certain
individuals to purchase those products for purposes of making
methamphetamine.
b. Law enforcement access
This bill would allow law enforcement to access the
information submitted by retailers, require that access to be
recorded by means of a unique access code, and require each
user's history to be maintained and provide that the DOJ may
AB 1280 (Hill)
PageO of?
audit that history. While the bill would allow DOJ to enter
into an MOU with NADDI governing access, NADDI would be
required to "provide real-time access to NPLEx information
through the NPLEx online portal to law enforcement in the
state as authorized by the department." The ability to access
that information would also apply to law enforcement in other
states, thus, allowing a vast number of law enforcement to
look through voluminous data regarding sales, and attempted
sales, of pseudoephedrine.
The Electronic Frontier Foundation (EFF) opposes the creation
of a database of consumers "with easy access by law
enforcement agencies without justification. Law enforcement
access to prescription medication requires a search warrant
under the California Confidentiality of Medical Information
Act (CMIA). Furthermore, stores faced with law enforcement
requests for information about people purchasing
non-prescription medications require search warrants . . . AB
1280 treats ordinary Sudafed consumers as criminal suspects
and raises serious concerns about consumer privacy and
protections against unlawful search and seizure, as protected
by the Fourth Amendment and our state constitution." The
American Civil Liberties Union, in an oppose unless amended
position, further contends that:
Law enforcement officials could follow up with
individuals after their purchase of a packet of the
common congestion remedy, "Sudafed," and then grill them
about why they purchased it, what their medical condition
is, and other private information. These absurd results
should be avoided."
Given the numerous stopped sales that arguably occur each day,
it is unclear whether law enforcement (even if they were
watching each transaction) would have the time or resources to
investigate each stopped sale. Alternatively, given the
voluminous data contained in the system, it is unclear how
exactly law enforcement would identify a smurfer, as opposed
to a mom that has kids with allergies who need more product
than the law allows; additionally, it is unclear what steps
smurfers are taking to circumvent the database in other states
(such as fake IDs).
Regarding single denials (which arguably are more likely to
happen to an innocent person than an individual well
AB 1280 (Hill)
PageP of?
acquainted with pseudoephedrine restrictions), the bill states
that the "Legislature finds that it is necessary for probable
cause to be demonstrated to trigger an investigation in
connection with an individual whose requested purchase is
denied by the system a single time." That provision codifies
an important point - just because an individual is denied a
single purchase does not mean that the single denial, absent
probable cause, should be sufficient to trigger an
investigation. If that were the circumstance, many
individuals who accidentally attempt to purchase an amount
over the statutory limit could find themselves the subject of
an investigation.
Additionally, while law enforcement arguably has the authority
under existing law to examine the paper log books of the
individual stores, the act of placing that information in an
electronic real-time easy to read format raises additional
issues regarding privacy. The real-time data provides law
enforcement (and the database provider) with detailed
information about purchases of pseudoephedrine - the privacy
implications of reviewing that information online are
significantly greater than if law enforcement had to go to an
individual store and examine the log book. Regarding that
access, the California State Sheriffs' Association (CSSA), in
support, notes that the "electronic system contemplated allows
law enforcement to monitor all sales in real-time and on a
statewide basis which will greatly enhance suppression and
investigative efforts."
In light of the above concerns, the Committee should consider
whether, in fact, it is appropriate to require retailers to
use a system to track purchases of pseudoephedrine products
where law enforcement can monitor sales in real-time, without
a warrant.
SHOULD LAW ENFORCEMENT BE ABLE TO MONITOR SALES IN REAL-TIME
WITHOUT A WARRANT?
c. Limitations on retailers represent only half of the
potential problem
This bill would specifically provide that a retail
distributor's use of NPLEx shall be subject to Section 56.101
of the Civil Code. That Section, part of the Confidentiality
of Medical Information Act (CMIA), generally requires health
AB 1280 (Hill)
PageQ of?
care providers that create, maintain, preserve, store,
abandon, destroy, or dispose of medical records to do so in a
manner that preserves the confidentiality of information;
negligent actions are subject to specific remedies and
penalties. This bill would also require the DOJ's MOU to
limit access by retailers to records of sales transactions
made by that retailer, and provide that access is solely for
purposes of complying with this bill, federal law, or to
respond to law enforcement or court order. Retailers would
also be prohibited from maintaining separate copies of
transaction information, as specified. While those
protections are appropriate for the individual stores that are
accessing NPLEx and entering customer data, they would appear
to cover only half of the transaction - namely, while the
retailer is subject to various requirements, the provider of
the database would not be subject to those same laws.
For example, while this bill applies a provision of CMIA to a
California retail store, it would not apply that same
provision to Appriss (provider of the NPLEx database). By not
applying that provision, or any other provisions of California
law, it is unclear what control California actually could
exert over NPLEx, the third-party out-of-state database run by
Appriss. The Committee should consider whether the above
fundamental privacy concerns, the lack of a direct contractual
relationship between DOJ and Appriss, and the inability to
apply California protections to NPLEx outweigh the arguable
benefits of requiring this database.
DO THE FUNDAMENTAL PRIVACY CONCERNS OUTWEIGH BENEFITS?
It should be noted that Section 56.101 already applies to
pharmacies and, as a result, the impact of this bill's
provision is to extend it to other "retail distributors" who
are not already subject to its provisions. Yet, those
additional entities are already required to safeguard their
customers' personal information under provisions of existing
law that require businesses to protect customers' personal
information from unauthorized access, destruction, use,
modification, or disclosure.
d. Notification to consumers that their information will be
entered into the database
This bill would require the retail distributor to give notice
AB 1280 (Hill)
PageR of?
to customers explaining that their identification and purchase
data will be provided to law enforcement pursuant to this bill
and federal law for purposes of determining the legality of a
proposed sale. Notice may be given electronically, in
writing, or through signs.
This bill applies only to the sale of pseudoephedrine products
for personal use to walk-in customers or in a face-to-face
transaction. As a result, it is not clear how notice would be
given electronically. For example, would notice on the retail
distributor's Web site meet this requirement? Or, would
emailed notice suffice? In either case, the customer does not
receive this important notification at the time of the
transaction, which arguably lessens its impact. In fact,
nothing in the bill requires that any of the notifications be
provided at the time of the transaction.
SHOULD NOTIFICATION BE GIVEN AT THE TIME OF THE TRANSACTION?
Existing law currently exempts prescription sales of
pseudoephedrine from over-the-counter sales limits. This bill
would likewise exempt those sales from being included in the
database. Because it could be argued that customers should
know that they can purchase pseudoephedrine with a
prescription and their personal information will not be
included in the database, the Committee may wish to consider
whether consumers should be notified of that fact.
SHOULD CONSUMERS ALSO BE TOLD THAT THEY CAN AVOID THE
COLLECTION OF THEIR INFORMATION IN A DATABASE BY OBTAINING A
PRESCRIPTION FOR THEIR PSEUDOEPHEDRINE PURCHASE?
4. Other opposition concerns
In addition to the above issues, the opposition asserts the
following:
Retailers should be prohibited from obtaining any
information from the database other than a "stop sale"
response;
the database should be held by DOJ rather than a private
company;
security breach laws should apply (Civ. Code Sec.
1798.29);
private right of action should be available if data is
used, disclosed, or shared in violation of the law;
AB 1280 (Hill)
PageS of?
an annual independent audit and public report of the use
of the system by DOJ; an audit every three years of the
effectiveness of the system;
destruction of personal information at the time of
expiration of the statute of limitations for prosecution of
a purchaser;
clear and conspicuous notice should be provided to each
consumer before the individual purchases the ephedrine
explaining that the information will be added to a
database; and
database must be encrypted and subject to stringent
accessibility restrictions.
5. AB 1455 (Hill, 2010) and arguable privacy improvements
As discussed above, this bill is similar to AB 1455 (Hill,
2010), which was held in this Committee. This committee's
analysis raised similar privacy issues as those raised above,
and, additionally suggested that the bill should be amended to
authorize DOJ to create and run the proposed database. Although
the author elected not to accept that suggested amendment last
year, a similar amendment would appear to address many of the
concerns expressed above.
Furthermore, in response to the privacy issues raised by this
committee regarding AB 1455, supporters have provided committee
staff with a list of specific privacy protections that are
included in the bill. That list of "privacy protections" is as
follows:
prohibit retail distributors from using collected
information for any purposes other than to comply with
federal law;
prohibit retail distributors from maintaining any separate
copies of the transaction information except as may be
required by federal law;
require all retailers to provide a notice in writing or by
signage that the information collected is pursuant to federal
law;
makes legislative finding that demonstration of probable cause
is necessary for investigation of denial on a single occasion;
should the DOJ sign the MOU with NADDI governing law
enforcement access to NPLEx data, the MOU must provide that
the information contained therein cannot be used for any
purpose other than to enforce the federal law;
the Confidentiality of Medical Information Act provisions and
AB 1280 (Hill)
PageT of?
sanctions have been extended to the retailer's use of the
system.
Despite those provisions, the Committee should consider whether
the benefits of the bill, in its entirety, outweigh the
fundamental privacy issues raised by mandating the use of a
third-party out-of-state database funded by the manufacturers of
pseudoephedrine based products.
Support : Alameda County Sheriff's Office; Alliance for Patient
Access, California Chapter; Alameda Health Consortium; Bayer
Health Care; BIOCOM; Calaveras County Sheriffs' Department;
California Alliance for Retired Americans; California Black
Health Network; California Chamber of Commerce; California
District Attorneys Association; California Healthcare Institute;
California Hispanic Chamber of Commerce; California
Manufacturers and Technology Association; California Medical
Association; California Pharmacists Association; California
Primary Care Association; California Retailers Association;
California State Sheriffs' Association; Community Clinic
Association of LA County; Consumer Healthcare Products
Association; Johnson and Johnson; Healthy African American
Families II; Kern County Sheriff; Lassen County Sheriff's
Office; Los Angeles County Medical Association; Los Angeles
Society of Allergy, Asthma & Clinical Immunology, Inc.; Marin
Medical Society; Napa County Medical Society; National
Association of Chain Drug Stores; National Federation of
Independent Business; Orange County Business Council; Orange
County Sheriff-Coroner Department; Peace Officers Research
Association of California; Pfizer, Inc.; Reckitt Benckiser; Rite
Aid; Sacramento County Sheriff's Department; San Francisco
Chamber of Commerce; San Joaquin County Sheriff; Sanofi-Aventis;
Santa Clara County Medical Association; Santa Cruz County
Sheriff-Coroner; Shasta County Sheriff; Siskiyou County
Sheriff's Department; Solano County Medical Society; Sonoma
County Medical Association; Valley Industry & Commerce
Association (VICA); Walgreens; Yolo County Sheriff's Department
Opposition : American Civil Liberties Union; California
Department of Justice; California Narcotics Officers'
Association; California Public Defenders Association; Electronic
Frontier Foundation; Los Angeles County District Attorney;
National Narcotics Officers Association Coalition; Privacy
Rights Clearinghouse
AB 1280 (Hill)
PageU of?
HISTORY
Source : Author
Related Pending Legislation : SB 315 (Wright), would require a
prescription for pseudoephedrine products. This bill is in the
Senate Health Committee.
Prior Legislation :
AB 1455 (Hill, 2010), would have enacted an electronic database
substantially similar to that proposed by this bill. This bill
was held in this Committee due to privacy concerns.
SB 484 (Wright, 2009), would have required a prescription for
pseudoephedrine products. This bill failed passage in the
Assembly Public Safety Committee.
Prior Vote :
Senate Public Safety Committee (Ayes 6, Noes 0)
Assembly Floor (Ayes 79, Noes 0)
Assembly Appropriations Committee (Ayes 16, Noes 0)
Assembly Public Safety Committee (Ayes 7, Noes 0)
**************