BILL NUMBER: SB 1348	INTRODUCED
	BILL TEXT


INTRODUCED BY   Senator DeSaulnier

                        FEBRUARY 21, 2014

   An act to add Chapter 22.3 (commencing with Section 22590) of
Division 8 of the Business and Professions Code, relating to personal
information.



	LEGISLATIVE COUNSEL'S DIGEST


   SB 1348, as introduced, DeSaulnier. Online Data brokers: sale of
personal information: notice.
   Existing law protects the privacy of personal information,
including customer records, and requires a business that owns or
licenses personal information about a California resident to
implement and maintain reasonable security procedures and practices
appropriate to the nature of the information, in order to protect the
personal information from unauthorized access, destruction, use,
modification, or disclosure.
   Existing law requires an operator of a commercial Internet Web
site or online service that collects personally identifiable
information through the Internet about consumers residing in
California who use or visit its commercial Web site or online service
to conspicuously post its privacy policy on its Web site or online
service and to comply with that policy.
   This bill would require an online data broker, as defined, that
conducts business in California, and that sells to a 3rd party the
personal information of any resident of California, to notify the
individual to whom personal information pertains when the online data
broker sells that information to a 3rd party, and to inform the
individual of the content of the information sold and the identity of
the purchaser.
   Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Chapter 22.3 (commencing with Section 22590) is added
to Division 8 of the Business and Professions Code, to read:
      CHAPTER 22.3.  ONLINE DATA BROKERS


   22590.  The following definitions apply to this chapter:
   (a) "Online data broker" means a person or business that conducts
business in California, and that owns, licenses, compiles, or
accesses computerized data that includes individuals' personal
information, for the purpose of selling the personal information upon
the request of a third party.
   (b) "Personal information" means any information that identifies,
relates to, describes, or is capable of being associated with, a
particular individual, including, but not limited to, his or her
name, signature, social security number, physical characteristics or
description, address, telephone number, passport number, driver's
license or state identification card number, insurance policy number,
education, employment, employment history, bank account number,
credit card number, debit card number, or any other financial
information, medical information, or health insurance information.
"Personal information" does not include publicly available
information that is lawfully made available to the general public
from federal, state, or local government records.
   (c) "Subject individual" means the person to whom personal
information pertains.
   22592.  (a) An online data broker that conducts business in
California, and that sells to a third party the personal information
of any resident of California, shall inform the subject individual of
all of the following:
   (1) That the online data broker has sold the subject individual's
personal information to a third party.
   (2) The content of the personal information sold.
   (3) The identity of the third party to whom the online data broker
sold the subject individual's personal information.
   (b) The online data broker shall provide the information described
in paragraphs (1) to (3), inclusive, of subdivision (a) by
forwarding the information to each e-mail address for the subject
individual to which the online data broker has access, at the same
time that the online data broker provides the personal information to
the third party. If the online data broker does not have access to
any e-mail address for the subject individual, the online data broker
shall mail a copy of the information to the most recent physical
address for the subject individual to which the online data broker
has access, within ___ working days after the online data broker
provides the personal information to the third party.