Amended in Assembly March 25, 2014

California Legislature—2013–14 Regular Session

Assembly Bill No. 1442

Introduced by Assembly Member Gatto

January 6, 2014

An act to amend Sections 1798.3, 1798.14, begin delete 1798.17, 1798.18, end delete begin insert and end insert 1798.19 begin delete , and 1798.53 end delete of the Civil Code, relating to the Information Practices Act of 1977.

LEGISLATIVE COUNSEL’S DIGEST

AB 1442, as amended, Gatto. The Information Practices Act of 1977: local government.

The Information Practices Act of 1977 begin delete prescribes requirements on state agencies for the maintenance of personal information, as defined, and restricts a state agency from disclosing personal information contained in its records, as specified. The act end delete requires each begin insert state end insert agency to maintain in its records only personal information that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government. begin delete The act makes a person who willfully requests or obtains a record from an agency under false pretenses or who intentionally discloses specific information under certain circumstances guilty of a misdemeanor. The act provides that an intentional violation of its provisions by an officer or employee of an agency constitutes cause for discipline, including termination of employment. The act also provides a civil action against an agency for specified failures under the act. The act prohibits an individual’s name and address from being distributed for commercial purposes, as specified, unless specifically authorized by law. end delete

begin delete

This bill would expand the definition of “agency” to include local governmental entities.

end delete begin delete

The

end delete

begin insert This end insert bill would begin delete generally require an agency end delete begin insert expand that restriction on the maintenance of personal information to apply to a local agency, and would require a state or local agency end insert to destroy personal information begin delete maintained in accordance with the act end delete when the begin insert state or local end insert agency determines begin delete the personal information end delete begin insert it end insert is no longer relevant and necessary to accomplish its purpose. The bill would establish special provisions for a Kindergarten and grades 1 to 12, inclusive, school district regarding begin insert the notification of students, parents, and guardians if it considers a program to gather or maintain student personal information in its records, restrictions on the gathering and maintenance of end insert information begin insert gathered from social media, as defined, and the end insert destruction begin delete and parental notification for end delete begin insert of end insert personal information begin insert gathered from social media end insert on students maintained by the district.

By expanding the duties of local begin delete officials and expanding the definition of a crime, end delete begin insert officials, end insert this bill would impose a state-mandated local program.

begin delete

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

end delete begin delete

This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason.

end delete begin delete

With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

end delete begin insert

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

end insert begin insert

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to these statutory provisions.

end insert

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.

The people of the State of California do enact as follows:

SECTION 1.  

Section 1798.3 of the Civil Code is amended to
read:

1798.3.  

As used in this chapter:

(a)  begin delete The term “personal end delete begin insert “Personal end insert information” means any
information that is maintained by an agency that identifies or
describes an individual, including, but not limited to, his or her
name, social security number, physical description, home address,
home telephone number, education, financial matters, and medical
or employment history. It includes statements made by, or
attributed to, the individual.

(b)  begin delete The term “agency” end delete begin insert “Agency” end insert means every state begin delete or local end delete
office, officer, department, division, bureau, board, commission,
or other state begin delete or local end delete agency, except that begin delete the term agency end delete begin insert “agency end insert begin insert ” end insert
shall not include:

(1) The California Legislature.

(2) Any agency established under Article VI of the California
Constitution.

(3) The State Compensation Insurance Fund, except as to any
records begin delete which end delete begin insert that end insert contain personal information about the
employees of the State Compensation Insurance Fund.

begin insert

(4) A local agency, as defined in subdivision (a) of Section 6252
of the Government Code.

end insert

(c)  begin delete The term “disclose” end delete begin insert “Disclose” end insert means to disclose, release,
transfer, disseminate, or otherwise communicate all or any part of
any record orally, in writing, or by electronic or any other means
to any person or entity.

(d)  begin delete The term “individual” end delete begin insert “Individual” end insert means a natural person.

(e)  begin delete The term “maintain” end delete begin insert “Maintain” end insert includes maintain, acquire,
use, or disclose.

(f)  begin delete The term “person” end delete begin insert “Person” end insert means any natural person,
corporation, partnership, limited liability company, firm, or
association.

(g)  begin delete The term “record” end delete begin insert “Record” end insert means any file or grouping of
information about an individual that is maintained by an agency
by reference to an identifying particular such as the individual’s
name, photograph, finger or voiceprint, or a number or symbol
assigned to the individual.

(h)  begin delete The term “system end delete begin insert “System end insert of records” means one or more
records, which pertain to one or more individuals, which is
maintained by any agency, from which information is retrieved
by the name of an individual or by some identifying number,
begin delete symbol end delete begin insert symbol, end insert or other identifying particular assigned to the
individual.

(i)  begin delete The term “governmental end delete begin insert “Governmental end insert entity,” except as
used in Section 1798.26, means any branch of the federal
government or of the local government.

(j)  begin delete The term “commercial end delete begin insert “Commercial end insert purpose” means any
purpose which has financial gain as a major objective. It does not
include the gathering or dissemination of newsworthy facts by a
publisher or broadcaster.

(k)  begin delete The term “regulatory end delete begin insert “Regulatory end insert agency” means the
Department of Business Oversight, the Department of Insurance,
the Bureau of Real Estate, and agencies of the United States or of
any other state responsible for regulating financial institutions.

begin insert

(l) “Social media” means an electronic service or account, or
electronic content, including, but not limited to, videos, still
photographs, blogs, video blogs, podcasts, instant and text
messages, email, online services or accounts, or Internet Web site
profiles or locations.

end insert

SEC. 2.  

Section 1798.14 of the Civil Code is amended to read:

1798.14.  

(a)  begin insert Nothwithstanding the exception established in
paragraph (4) of subdivision (b) of Section 1798.3, as used in this
section, “agency” includes a local agency, as defined in
subdivision (a) of Section 6252 of the Government Code. end insert

begin insert (b) end insert begin insert   end insert begin insert (1) end insert begin insert   end insert Each agency shall maintain in its records only personal
information that is relevant and necessary to accomplish a purpose
of the agency required or authorized by the California Constitution,
statute, ordinance, or mandated by the federal government, and,
except as provided in begin delete subdivision (b), end delete begin insert subdivisions (c) and (d), end insert
shall destroy the personal information when the agency determines
the personal information is no longer relevant and necessary to
accomplish that purpose.

begin insert

(2) This subdivision does not apply to official records recorded
in the office of a county recorder.

end insert begin insert

(c) A school district for kindergarten or grades 1 to 12,
inclusive, that considers a program to gather or maintain in its
records personal information on any student enrolled in the school
district shall notify students, parents, and guardians and provide
an opportunity for public comment prior to the adoption of such
a program.

end insert begin delete

(b)

end delete

begin insert (d) end insert  A school district for kindergarten or grades 1 to 12, inclusive,
that gathers begin delete and maintains end delete begin insert or maintains, or that contracts to gather
or maintain end insert in its records personal information begin insert gathered from
social media end insert on a student enrolled in the school district begin delete in end delete shall do
the following:

begin insert

(1) Gather or maintain only information that was made publicly
accessible, not to include either:

end insert begin insert

(A) Information that was reposted or otherwise made available
by another party without the express consent of the original author.

end insert begin insert

(B) Any secondary information, including, but not limited to,
geolocation information, derived from content posted to social
media, unless that secondary information itself intentionally was
made publicly accessible.

end insert begin insert

(2) Provide students with access to any personal information
about the student gathered or maintained by the district and
obtained through social media, and the opportunity to correct or
delete erroneous information or information gathered or
maintained in violation of paragraph (1).

end insert begin delete

(1)

end delete

begin insert (3) end insert  Destroy personal information begin insert gathered from social media end insert
maintained in its records within one year of a student turning 18
years of age, or within one year after the student is no longer
enrolled in the school district, whichever is first.

begin delete

(2)

end delete

begin insert (4) end insert  Notify each parent or guardian of the student that personal
information is being gathered begin insert from social media end insert and that any
information maintained in its records with regard to the student
shall be destroyed in accordance with paragraph begin delete (1). end delete begin insert (3). end insert

begin insert

(5) If the school district contracts with a third party to gather
or maintain in the records of the third party personal information
on a student enrolled in the school district, require the third party
to hold all student personal information strictly confidential and
prohibit it from using that information for its own purposes, selling
the information, or sharing the information with any other entity
unless required to do so by law.

end insert

begin delete

SEC. 3.  

Section 1798.17 of the Civil Code is amended to read:

1798.17.  

Each agency shall provide on or with any form used
to collect personal information from individuals the notice specified
in this section. When contact with the individual is of a regularly
recurring nature, an initial notice followed by a periodic notice of
not more than one-year intervals shall satisfy this requirement.
This requirement is also satisfied by notification to individuals of
the availability of the notice in annual tax-related pamphlets or
booklets provided for them. The notice shall include all of the
following:

(a) The name of the agency and the division within the agency
that is requesting the information.

(b) The title, business address, and telephone number of the
agency official who is responsible for the system of records and
who shall, upon request, inform an individual regarding the location
of his or her records and the categories of any persons who use
the information in those records.

(c) The authority, whether granted by statute, regulation,
executive order, or ordinance that authorizes the maintenance of
the information.

(d) With respect to each item of information, whether submission
of such information is mandatory or voluntary.

(e) The consequences, if any, of not providing all or any part
of the requested information.

(f) The principal purpose or purposes within the agency for
which the information is to be used.

(g) Any known or foreseeable disclosures that may be made of
the information pursuant to subdivision (e) or (f) of Section
1798.24.

(h) The individual’s right of access to records containing
personal information that are maintained by the agency.

This section does not apply to any enforcement document issued
by an employee of a law enforcement agency in the performance
of his or her duties wherein the violator is provided an exact copy
of the document, or to accident reports whereby the parties of
interest may obtain a copy of the report pursuant to Section 20012
of the Vehicle Code.

The notice required by this section does not apply to agency
requirements for an individual to provide his or her name,
identifying number, photograph, address, or similar identifying
information, if this information is used only for the purpose of
identification and communication with the individual by the
agency, except that requirements for an individual’s social security
number shall conform with the provisions of the federal Privacy
Act of 1974 (Public Law 93-579).

SEC. 4.  

Section 1798.18 of the Civil Code is amended to read:

1798.18.  

(a) Each agency shall maintain all records, to the
maximum extent possible, with accuracy, relevance, timeliness,
and completeness.

(b) That standard need not be met except when those records
are used to make any determination about the individual. When
an agency transfers a record outside of state or local government,
it shall correct, update, withhold, or delete any portion of the record
that it knows or has reason to believe is inaccurate or untimely.

end delete

begin delete SEC. 5. end delete
begin insert SEC. 3. end insert   

Section 1798.19 of the Civil Code is amended to read:

1798.19.  

Each agency, when it provides by contract for the
operation or maintenance of records containing personal
information to accomplish an agency function, shall cause,
consistent with its authority, begin delete the requirements of end delete this chapter to be
applied to those records. For purposes of Article 10 (commencing
with Section 1798.55), any contractor and any employee of the
contractor, if the contract is agreed to on or after July 1, 1978, shall
be considered to be an employee of an agency. begin insert Except as provided
in Section 1798.14, local government functions mandated by the
state are not deemed agency functions within the meaning of this
section. end insert

begin delete

SEC. 6.  

Section 1798.53 of the Civil Code is amended to read:

1798.53.  

(a) Any person, other than an employee of the state
or of a local government agency acting solely in his or her official
capacity, who intentionally discloses information, not otherwise
public, which they know or should reasonably know was obtained
from personal information maintained by an agency or from
“records” within a “system of records” (as these terms are defined
in the federal Privacy Act of 1974 (5 U.S.C. Sec. 552a)) maintained
by a federal government agency, shall be subject to a civil action,
for invasion of privacy, by the individual to whom the information
pertains.

(b) In any successful action brought under this section, the
complainant, in addition to any special or general damages
awarded, shall be awarded a minimum of two thousand five
hundred dollars ($2,500) in exemplary damages as well as
attorney’s fees and other litigation costs reasonably incurred in
the suit.

(c) The right, remedy, and cause of action set forth in this section
shall be nonexclusive and is in addition to all other rights, remedies,
and causes of action for invasion of privacy, inherent in Section
1 of Article I of the California Constitution.

SEC. 7.  

No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution for certain
costs that may be incurred by a local agency or school district
because, in that regard, this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the
Government Code, or changes the definition of a crime within the
meaning of Section 6 of Article XIII B of the California
Constitution.

However, if the Commission on State Mandates determines that
this act contains other costs mandated by the state, reimbursement
to local agencies and school districts for those costs shall be made
pursuant to Part 7 (commencing with Section 17500) of Division
4 of Title 2 of the Government Code.

end delete

begin insert

begin insert SEC. 4. end insert   

end insert begin insert

If the Commission on State Mandates determines that
this act contains costs mandated by the state, reimbursement to
local agencies and school districts for those costs shall be made
pursuant to Part 7 (commencing with Section 17500) of Division
4 of Title 2 of the Government Code.

end insert