SB 741, as amended, Hill. Mobile communications: privacy.
Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.
This bill would require every local agency that operates cellular communications interception technology, as defined, to maintain reasonable operational, administrative, technical, and physical safeguards to protect information gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through use of the technology complies with applicable law and is consistent with respect for an individual’s privacy and civil liberties. The billbegin delete wouldend deletebegin insert would, except asend insertbegin insert provided,end insert
prohibit a local agency from acquiring cellular communications interception technology unless that acquisition is approved by a resolution or ordinance adopted by itsbegin delete legislatureend deletebegin insert legislativeend insert body at a regularly scheduled public meeting of the legislative body held pursuant to a specified open meetings law. The bill would require that the resolution or ordinance set forth the policies of the local agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to
bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.
Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.
The people of the State of California do enact as follows:
Article 11 (commencing with Section 53166) is
2added to Chapter 1 of Part 1 of Division 2 of Title 5 of the 3Government Code, to read:
4
(a) For purposes of this article, the following terms
8have the following meanings:
9(1) “Cellular communications interception technology” means
10any device that intercepts mobile telephony calling information
11or content, including an international mobile subscriber identity
P3 1catcher or other virtual base transceiver station that masquerades
2as a cellular station and logs mobile telephony calling information.
3(2) “Local agency” means any city, county, city and county,
4special district, authority, or other political subdivision of the state,
5and includes every county sheriff and city police department.
6(b) Every local agency that operates cellular communications
7interception technology shall do both of the following:
8(1) Maintain reasonable security procedures and practices,
9including operational, administrative, technical, and physical
10safeguards, to protect information gathered through the use of
11cellular communications interception technology from unauthorized
12access, destruction, use, modification, or disclosure.
13(2) Implement a usage and privacy policy to ensure that the
14collection, use, maintenance, sharing, and dissemination of
15information gathered through the use of cellular communications
16interception technology complies with all applicable law and is
17consistent with respect for an individual’s privacy and civil
18liberties.
This usage and privacy policy shall be available in writing
19to the public, and, if the local agency has an Internet Web site, the
20usage and privacy policy shall be posted conspicuously on that
21Internet Web site. The usage and privacy policy shall, at a
22minimum, include all of the following:
23(A) The authorized purposes for using cellular communications
24interception technology and for collecting information using that
25technology.
26(B) A description of the job title or other designation of the
27employees who are authorized to use, or access information
28
collected through the use of, cellular communications interception
29technology. The policy shall identify the training requirements
30necessary for those authorized employees.
31(C) A description of how the local agency will monitor its own
32use of cellular communications interception technology to ensure
33the accuracy of the information collected and compliance with all
34applicable laws, including laws providing for process and time
35period system audits.
36(D) The existence of a memorandum of understanding or other
37agreement with another local agency or any other party for the
38shared use of cellular communications interception technology or
39the sharing of information collected through its use, including the
40identity of signatory parties.
P4 1(E) The purpose of, process for, and restrictions on, the sharing
2of information gathered through the use of cellular communications
3interception technology with other local agencies and persons.
4(F) The length of time information gathered through the use of
5cellular communications interception technology will be retained,
6and the process the local agency will utilize to determine if and
7when to destroy retained information.
8(c) begin deleteNo end deletebegin insert(1)end insertbegin insert end insertbegin insertExcept as provided in paragraph (2), a end insertlocal agency
9begin delete mayend deletebegin insert
shall notend insert acquire cellular communications interception
10technology unless approved by its legislative body by adoption,
11at a regularly scheduled public meeting held pursuant to the Ralph
12M. Brown Act (Chapter 9 (commencing with Section 54950) of
13Part 1 of Division 2 of Title 5 of the Government Code), of a
14resolution or ordinance authorizing that acquisitionbegin delete or useend delete and the
15usage and privacy policy required by this section.
16(2) Notwithstanding paragraph (1), the county sheriff shall not
17acquire cellular communications interception technology unless
18the sheriff provides public notice of the acquisition, which shall
19be posted conspicuously on his or her department’s Internet Web
20site,
and his or her department has a usage and privacy policy
21required by this section.
22(d) In addition to any other sanctions, penalties, or remedies
23provided by law, an individual who has been harmed by a violation
24of this section may bring a civil action in any court of competent
25
jurisdiction against a person who knowingly caused that violation.
26The court may award a combination of any one or more of the
27following:
28(1) Actual damages, but not less than liquidated damages in the
29amount of two thousand five hundred dollars ($2,500).
30(2) Punitive damages upon proof of willful or reckless disregard
31of the law.
32(3) Reasonable attorney’s fees and other litigation costs
33reasonably incurred.
34(4) Other preliminary and equitable relief as the court determines
35to be appropriate.
O
95