BILL NUMBER: SB 849	INTRODUCED
	BILL TEXT


INTRODUCED BY   Senator Anderson

                        JANUARY 9, 2014

   An act to amend Section 22575 of the Business and Professions
Code, relating to consumers.


	LEGISLATIVE COUNSEL'S DIGEST


   SB 849, as introduced, Anderson. Consumers: Internet privacy.
   Existing law requires an operator of a commercial Internet Web
site or online service that collects personally identifiable
information through the Internet about consumers residing in
California who use or visit its commercial Internet Web site or
online service to conspicuously post its privacy policy on its
Internet Web site or online service and to comply with that policy.
Existing law requires that the privacy policy specify how personally
identifiable information is managed by the operator.
   This bill would make nonsubstantive changes to this law.
   Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 22575 of the Business and Professions Code is
amended to read:
   22575.  (a) An operator of a commercial Web site or online service
that collects personally identifiable information through the
Internet about individual consumers residing in California who use or
visit its commercial Web site or online service shall conspicuously
post its privacy policy on its Web site, or in the case of an
operator of an online service, make that policy available in
accordance with paragraph (5) of subdivision (b) of Section 22577. An
operator shall be in violation of this subdivision only if the
operator fails to post its policy within 30 days after being notified
of noncompliance.
   (b) The privacy policy required by subdivision (a) shall do all of
the following:
   (1) Identify the categories of personally identifiable information
that the operator collects through the Web site or online service
about individual consumers who use or visit its commercial Web site
or online service and the categories of third-party persons or
entities with whom the operator may share that personally
identifiable information.
   (2) If the operator maintains a  process  
procedure for an individual consumer who uses or visits its
commercial Web site or online service to review and request changes
to any of his or her personally identifiable information that is
collected through the Web site or online service, provide a
description of that  process   procedure  .

   (3) Describe the  process  procedure  by
which the operator notifies consumers who use or visit its
commercial Web site or online service of material changes to the
operator's privacy policy for that Web site or online service.
   (4) Identify its effective date.
   (5) Disclose how the operator responds to Web browser "do not
track" signals or other mechanisms that provide consumers the ability
to exercise choice regarding the collection of personally
identifiable information about an individual consumer's online
activities over time and across third-party Web sites or online
services, if the operator engages in that collection.
   (6) Disclose whether other parties may collect personally
identifiable information about an individual consumer's online
activities over time and across different Web sites when a consumer
uses the operator's Web site or service.
   (7) An operator may satisfy the requirement of paragraph (5) by
providing a clear and conspicuous hyperlink in the operator's privacy
policy to an online location containing a description, including the
effects, of any program or protocol the operator follows that offers
the consumer that choice.