Amended in Senate June 25, 2015

Amended in Assembly April 27, 2015

Amended in Assembly March 26, 2015

California Legislature—2015–16 Regular Session

Assembly Bill No. 83

Introduced by Assembly Member Gatto

January 6, 2015

An act to amend Section 1798.81.5 of the Civil Code, relating to personal data.

LEGISLATIVE COUNSEL’S DIGEST

AB 83, as amended, Gatto. Information Practices Act of 1977.

Existing law requires a person or business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This bill would define “reasonable security procedures and practices” for purposes of these provisions as requiring, at a minimum, security of personal information, including geophysical location begin insert information and biometric end insert information, to the degree that any reasonably prudent business would provide, as specified.

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Section 1798.81.5 of the Civil Code is amended
to read:

1798.81.5.  

(a) (1) It is the intent of the Legislature to ensure
that personal information about California residents is protected.
To that end, the purpose of this section is to encourage businesses
that own, license, or maintain personal information about
Californians to provide reasonable security for that information.

(2) For the purpose of this section, the terms “own” and
“license” include personal information that a business retains as
part of the business’ internal customer account or for the purpose
of using that information in transactions with the person to whom
the information relates. The term “maintain” includes personal
information that a business maintains but does not own or license.

(b) A business that owns, licenses, or maintains personal
information about a California resident shall implement and
maintain reasonable security procedures and practices appropriate
to the nature of the information, to protect the personal information
from unauthorized access, destruction, use, modification, or
disclosure.

(c) A business that discloses personal information about a
California resident pursuant to a contract with a nonaffiliated third
party that is not subject to subdivision (b) shall require by contract
that the third party implement and maintain reasonable security
procedures and practices appropriate to the nature of the
information, to protect the personal information from unauthorized
access, destruction, use, modification, or disclosure.

(d) For purposes of this section, the following terms have the
following meanings:

(1) “Personal information” means begin delete an end delete begin insert either of the following: end insert

begin insert (A) end insert begin insert   end insert begin insert An end insert individual’s first name or first initial and his or her last
name in combination with any one or more of the following data
elements, when either the name or the data elements are not
encrypted or redacted:

begin delete

(A)

end delete

begin insert (i) end insert  Social security begin delete number. end delete begin insert number, tax identification number,
passport number, or any other unique government-issued
identification number. end insert

begin delete

(B)

end delete

begin insert (ii) end insert  Driver’s license number or California identification card
number.

begin delete

(C)

end delete

begin insert (iii) end insert  Account number, credit or debit card number, in
combination with any required security code, access code, or
password that would permit access to an individual’s financial
account.

begin delete

(D)

end delete

begin insert (iv) end insert  Medical information.

begin delete

(E)

end delete

begin insert (v) end insert  Geophysical location information.

begin insert

(vi) Biometric information.

end insert begin insert

(vii) Signature.

end insert begin insert

(B) Username or email address in combination with a password
or security question and answer that would permit access to an
online account.

end insert

(2) “Geophysical location information” means any begin delete personally
identifiable information describing or concerning the duration of
a transportation service provided to an individual, the location and
route of a transportation service provided to an individual, or, if
applicable, the monetary exchange associated with a transportation
service provided to an individual. end delete begin insert location data generated to assess
the past or current location of, or travel by, an individual,
including, but not limited to, geographic coordinates, street
address, or WiFi positioning system. end insert

begin insert

(3) “Biometric information” means data generated by automatic
measurements of an individual’s biological characteristics that
are used by the owner or licensee to authenticate an individual’s
identity, such as a fingerprint, voice print, eye retinas or irises, or
other unique biological characteristic.

end insert begin delete

(3)

end delete

begin insert (4) end insert  “Medical information” means any individually identifiable
information, in electronic or physical form, regarding the
individual’s medical history or medical treatment or diagnosis by
a health care professional.

begin insert

(5) “Health insurance information” means an individual’s
insurance policy number or subscribed identification number, any
unique identifier used by a health insurer to identify the individual,
or any information in an individual’s application and claims
history, including any appeals records.

end insert begin delete

(4)

end delete

begin insert (6) end insert  “Personal information” does not include publicly available
information that is lawfully made available to the general public
from federal, state, or local government records.

(e) The provisions of this section do not apply to any of the
following:

(1) A provider of health care, health care service plan, or
contractor regulated by the Confidentiality of Medical Information
Act (Part 2.6 (commencing with Section 56) of Division 1).

(2) A financial institution as defined in Section 4052 of the
Financial Code and subject to the California Financial Information
Privacy Act (Division 1.2 (commencing with Section 4050) of the
Financial Code).

(3) A covered entity governed by the medical privacy and
security rules issued by the federal Department of Health and
Human Services, Parts 160 and 164 of Title 45 of the Code of
Federal Regulations, established pursuant to the Health Insurance
Portability and Availability Act of 1996 (HIPAA).

(4) An entity that obtains information under an agreement
pursuant to Article 3 (commencing with Section 1800) of Chapter
1 of Division 2 of the Vehicle Code and is subject to the
confidentiality requirements of the Vehicle Code.

(5) A business that is regulated by state or federal law providing
greater protection to personal information than that provided by
this section in regard to the subjects addressed by this section.
Compliance with that state or federal law shall be deemed
compliance with this section with regard to those subjects. This
paragraph does not relieve a business from a duty to comply with
any other requirements of other state and federal law regarding
the protection and privacy of personal information.

(f) For purposes of this section, “reasonable security procedures
and practices” as they pertain to the storage and transmission of
personal information shall require, at a minimum, the security of
that information to the degree that any reasonably prudent business
would provide. All of the following shall also apply:

(1) At a minimum, the business shall:

(A) Identify reasonably foreseeable internal and external risks
to the privacy and security of personal information that could result
in the unauthorized disclosure, misuse, alteration, destruction, or
other compromise of the information.

(B) Establish, implement, and maintain safeguards reasonably
designed to ensure the security of the personal information,
including, but not limited to, protecting against unauthorized loss,
misuse, alteration, destruction, access to, or use of the information.

(C) Regularly assess the sufficiency of any safeguards in place
to control reasonably foreseeable internal and external risks, and
evaluate and adjust those safeguards in light of the assessment.

(D) Evaluate and adjust any material changes in the operations
or business arrangements of the business, or any other
circumstances, that create a material impact on the privacy or
security of personal information under control of the business.

(2) The reasonableness of the security procedures and practices
shall be determined in light of all of the following:

(A) The begin delete degree of the privacy risk associated with the end delete begin insert type of end insert
personal information under the business’s control.

(B) The foreseeability of threats to the security of the
information.

(C) The existence of widely accepted practices in administrative,
technical, and physical safeguards for protecting personal
information.

(D) The cost of implementing and regularly reviewing the
safeguards.