Amended in Assembly January 4, 2016

Amended in Assembly March 26, 2015

California Legislature—2015–16 Regular Session

Assembly Bill No. 886

Introduced by Assembly Member Chau

February 26, 2015

An act to amend begin delete Section end delete begin insert Sections 5431 and end insert 5437 of begin delete , and to add Section 5437.5 to, end delete the Public Utilities Code, relating to transportation.

LEGISLATIVE COUNSEL’S DIGEST

AB 886, as amended, Chau. Transportation service network provider: passenger privacy.

The Passenger Charter-Party Carriers’ Act prohibits a transportation network company from disclosing personally identifiable information of a passenger, begin delete except as provided end delete begin insert with certain exceptions, including when the passenger knowingly consents or pursuant to a legal obligation end insert . A violation of the act is a crime.

begin delete

This bill would prohibit a transportation service network provider, as defined, from requesting or requiring personally identifiable data, as defined, of a passenger unless the information is used for certain purposes, including establishing, maintaining, and updating a customer’s account. The bill would require the transportation service network provider to provide an accountholder with an opportunity to cancel or terminate an account. The bill would require a transportation service network provider to destroy or dispose of all personally identifiable data in a secure manner when the information is no longer needed for the purposes for which it was collected or when an accountholder cancels or terminates his or her account. Because a violation of these provisions would be a crime, this bill would impose a state-mandated local program.

end delete begin insert

This bill would modify the knowing consent exception to the prohibition against disclosure of personally identifiable information by requiring the affirmative consent of a passenger through an opt-in selection that is separate from and not conditioned on various other transactions between the passenger and the transportation network company. The bill would modify the legal obligation exception to the prohibition against disclosure of personally identifiable information by instead providing for disclosure pursuant to law, regulation, or court order. The bill would define personally identifiable information. By changing the definition of a crime, this bill would impose a state-mandated local program.

end insert

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.

The people of the State of California do enact as follows:

begin insert

begin insert SECTION 1. end insert   

end insert

begin insert Section 5431 of the end insert begin insert Public Utilities Code end insert begin insert is
amended to read: end insert

5431.  

(a) As used in this article, a “transportation network
company” is an organization, including, but not limited to, a
corporation, limited liability company, partnership, sole proprietor,
or any other entity, operating in California that provides
prearranged transportation services for compensation using an
online-enabled application or platform to connect passengers with
drivers using a personal vehicle.

(b) As used in this article, “participating driver” or “driver” is
any person who uses a vehicle in connection with a transportation
network company’s online-enabled application or platform to
connect with passengers.

(c) As used in this article, “transportation network company
insurance” is a liability insurance policy that specifically covers
liabilities arising from a driver’s use of a vehicle in connection
with a transportation network company’s online-enabled
application or platform.

begin insert

(d) As used in this article, “personally identifiable information,”
with respect to a transportation network company passenger, shall
include electronic communication information, as defined by
subdivision (d) of Section 1546 of the Penal Code, electronic device
information, as defined by subdivision (g) of Section 1546 of the
Penal Code, and subscriber information, as defined by subdivision
(l) of Section 1546 of the Penal Code, and the social security
number, physical characteristics, or financial information of the
passenger.

end insert

begin delete SECTION 1. end delete
begin insert SEC. 2. end insert   

Section 5437 of the Public Utilities Code is amended
to read:

5437.  

(a) A transportation network company shall not disclose
to a third party any personally identifiable information of a
transportation network company passenger unless one of the
following applies:

(1) The begin delete customer knowingly consents. end delete begin insert passenger affirmatively
consents through an opt-in selection. Consent shall be distinct
from any transaction or service provided, and shall be acquired
in a format that is separate from the financial transaction for
services. Consent shall not be required by the transportation
network company as a condition of accepting or processing a
transaction, as a condition of creating a user account, if a user
account is required by the transportation network company, or as
a condition of downloading or installing a mobile application. end insert

(2) Pursuant to a begin delete legal obligation. end delete begin insert law, regulation, or court
order. end insert

(3) The disclosure is to the commission in order to investigate
a complaint filed with the commission against a transportation
network company or a participating driver and the commission
treats the information under confidentiality protections.

begin delete

(b) This section does not apply to personally identifiable
information of a transportation network passenger collected
pursuant to Section 5437.5.

end delete begin insert

(b) Nothing in this section shall prohibit a transportation
network company from sharing any personally identifiable
information of a transportation network company passenger for
the detection, investigation, or prevention of fraud, theft, identity
theft, or other criminal activity if the personally identifiable
information is used solely for those purposes by recipients of the
personally identifiable information.

end insert

begin delete

SEC. 2.  

Section 5437.5 is added to the Public Utilities Code,
to read:

5437.5.  

(a) For purposes of this section, the following terms
mean the following:

(1) “Personally identifiable data” means any of the following:

(A) Information that identifies, relates to, describes, or is capable
of being associated with, a particular individual, including, but not
limited to, his or her name, signature, social security number,
physical characteristics, address, email address, telephone number,
bank account number, credit card number, debit card number, or
any other financial information.

(B) Information describing or concerning the duration of the
transportation service provided, the location and route of the service
provided, and the monetary exchange associated with the service
provided.

(C) Information relating to the mobile device or computer used
to arrange transportation related services, including Internet
protocol address (MAC), media access control address, device
applications, and geolocational information.

(2) “Transportation service network provider” means any
corporation, limited liability company, partnership, sole proprietor,
or any other entity, operating in California, including,
notwithstanding Section 5353, any entity that provides taxicab
transportation services, that provides prearranged transportation
service for compensation using an online-enabled application or
platform to connect to passengers.

(b) (1) When rendering transportation services, a transportation
service network provider shall not request or require any personally
identifiable data of a passenger or accountholder unless the
information is required to complete a transaction for the
transportation service being provided or for the detection,
investigation, or prevention of fraud, identity and other theft, or
other criminal activity, and the personally identifiable data is used
solely for those purposes.

(2) The transportation service network provider shall not disclose
any personally identifiable data collected pursuant to this
subdivision to any other person, firm, partnership, association, or
corporation unless it is required to do so by state or federal law,
or is contractually obligated to share the information with a
financial entity to complete the transaction, or for the detection,
investigation, or prevention of fraud, identity or other theft, or
other criminal activity.

(c) (1) A transportation service network provider may request
or require a consumer to establish an account as a condition of the
transportation service and may require a customer to provide
personally identifiable data to establish, maintain, and update the
account if the information collected is used solely for those
purposes.

(2) A transportation service network provider shall provide an
accountholder with an opportunity to cancel or terminate the
account at which time the transportation service network provider
shall destroy or dispose of all personally identifiable data it required
for the account in a secure manner.

(d) A transportation service network provider shall destroy or
dispose of all personally identifiable data it acquires pursuant to
this section in a secure manner after the information is no longer
needed for the purposes authorized under this section.

(e) (1) A transportation service network provider that violates
this section shall be subject to a civil penalty not to exceed two
hundred fifty dollars ($250) for the first violation and one thousand
dollars ($1,000) for each subsequent violation.

(2) The civil penalty shall be assessed and collected in a civil
action brought by any aggrieved person, the Attorney General, or
by a district attorney or city attorney of the jurisdiction in which
an aggrieved person resides.

(3) The court shall direct the recovery of full costs, including
attorneys’ fees, to the prevailing party.

(f) (1) The Attorney General, or district attorney or city attorney
with appropriate jurisdiction, may bring an action in the superior
court in the name of the People of the State of California to enjoin
a violation of this section.

(2) Upon notice of not less than five days to a transportation
service network provider, the Attorney General, district attorney,
or city attorney may seek to temporarily restrain and preliminary
enjoin a violation of this section.

(3) If the court determines that the transportation service network
provider has violated this section, the court may restrain or enjoin
the violation without requiring proof that any person has been
damaged by the violation.

(4) In an action brought pursuant to this subdivision, if the court
finds that a transportation service network provider has violated
this section, the court may direct the transportation service network
provider to pay the costs incurred by the Attorney General, district
attorney, or city attorney.

(g) The court may consolidate an action for the assessment and
collection of civil penalties with an action for injunctive relief
brought pursuant to subdivision (f).

end delete

SEC. 3.  

No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution because
the only costs that may be incurred by a local agency or school
district will be incurred because this act creates a new crime or
infraction, eliminates a crime or infraction, or changes the penalty
for a crime or infraction, within the meaning of Section 17556 of
the Government Code, or changes the definition of a crime within
the meaning of Section 6 of Article XIII B of the California
Constitution.