Amended in Senate April 8, 2014

Amended in Senate March 26, 2014

Senate Bill No. 1348

Introduced by Senator DeSaulnier

February 21, 2014

An act to add Chapter 22.3 (commencing with Section 22590) begin delete toDivision end delete begin insert to Division end insert 8 of the Business and Professions Code, relating to personal information.

LEGISLATIVE COUNSEL’S DIGEST

SB 1348, as amended, DeSaulnier. Online data brokers: sale of personal information: notice.

Existing law protects the privacy of personal information, including customer records, and requires a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, in order to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

Existing law requires an operator of a commercial Internet Web site or online service that collects personally identifiable information through the Internet about consumers residing in California who use or visit its commercial Internet Web site or online service to conspicuously post its privacy policy on its Internet Web site or online service and to comply with that policy.

This bill would require an online data broker, as defined, that sells to a 3rd party the personal information of any resident of California, to allow begin delete an individual end delete begin insert a subject individual, as defined, end insert to review his or her personal information, either pursuant to a written request or by means of an electronic search through a secure online system. The bill would require an online data broker begin insert , unless prohibited by federal law, end insert to conspicuously post an opt-out notice on its Internet Web site, as specified, that would provide specific instructions for permanently removing personal information from the online data broker’s database by making a written demand requesting to have the information permanently removed. The bill would require an online data broker that receives a written demand from begin delete an end delete begin insert a subject end insert individual pursuant to these provisions begin insert , unless prohibited by federal law, end insert to remove the begin insert subject end insert individual’s personal information from public display on the Internet within 10 days of delivery of the written demand, and to take specified additional steps to ensure that the information is not reposted.

begin insert This bill would also make it unlawful for an online data broker to solicit or accept the payment of a fee or other consideration to review or permanently remove personal information from the online data broker’s database, and would authorize a subject individual to bring a civil action against any person in violation of these provisions. The bill’s provisions would apply only to information collected, assembled, or maintained by an online data broker on and after January 1, 2015, except under designated circumstances. end insert

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Chapter 22.3 (commencing with Section 22590)
is added to Division 8 of the Business and Professions Code, to
read:

 

Chapter  22.3. Online Data Brokers

 

22590.  

The following definitions apply to this chapter:

(a) “Conspicuously post,” with respect to an opt-out notice,
means to post through any of the following:

(1) An Internet Web page on which the actual opt-out notice is
posted if the Internet Web page is the homepage or first significant
page after entering the Internet Web site.

(2) An icon that hyperlinks to an Internet Web page on which
the actual opt-out notice is posted, if the icon is located on the
homepage or the first significant page after entering the Internet
Web site, and if the icon contains the term “opt out” or “opt-out.”
The icon shall also use a color that contrasts with the background
color of the Internet Web page or is otherwise distinguishable.

(3) A text link that hyperlinks to an Internet Web page on which
the actual opt-out notice is posted, if the text link is located on the
homepage or first significant page after entering the Internet Web
site, and if the text link does one of the following:

(A) Includes the term “opt out” or “opt-out.”

(B) Is written in capital letters equal to or greater in size than
the surrounding text.

(C) Is written in larger type than the surrounding text, or in
contrasting type, font, or color to the surrounding text of the same
size, or set off from the surrounding text of the same size by
symbols or other marks that call attention to the language.

(4) Any other functional hyperlink that is so displayed that a
reasonable person would notice it begin insert and understand it to hyperlink
to the actual opt-out notice end insert .

(b) “Online data broker” means a commercial entity that collects,
assembles, or maintains personal information concerning
individuals residing in California who are not customers or
employees of that entity, for the purposes of selling the personal
information begin delete or providing a third party with access to the
information end delete begin insert over the Internet to a third party end insert .

(c) “Personal information” means any information that identifies,
relates to, describes, or is capable of being associated with, a
particular individual, including, but not limited to, his or her name,
signature, social security number, physical characteristics or
description, address, telephone number, passport number, driver’s
license or state identification card number, insurance policy
number, education, employment, employment history, bank account
number, credit card number, debit card number, or any other
financial information, medical information, or health insurance
information. “Personal information” does not include begin delete publicly
available end delete information that is lawfully made available to the general
public from federal, state, or local government records.

(d) “Publicly post” or “publicly display” means to intentionally
communicate or otherwise make available to the general public.

(e) “Subject individual” means the person to whom personal
information pertains.

begin insert

(f) “Written” means documentation in writing, and includes
facsimile, telegraphic, and other forms of electronic
communication.

end insert

begin delete 22592. end delete
begin insert 22591. end insert   

An online data broker that sells begin delete or provides to a third
party the end delete personal information of any resident of California begin insert to a
third party end insert , shall permit begin delete an end delete begin insert a subject end insert individual to review his or
her personal information that has been collected, assembled, or
maintained by the online data broker, either by submitting a written
request or by means of an electronic search through a secure online
system.

begin delete 22594. end delete
begin insert 22592. end insert   

(a) (1)  begin delete An end delete begin insert Unless prohibited by federal law, an end insert online
data broker shall conspicuously post an opt-out notice on its
Internet Web site, which shall include specific instructions for
permanently removing personal information from the online data
broker’s database, by making a written demand requesting to have
the information removed.

(2) If begin delete an end delete begin insert a subject end insert individual makes a written demand to remove
his or her personal information from an online data broker’s
database pursuant to this subdivision, the online data broker shall
permanently remove begin delete an end delete begin insert the subject end insert individual’s personal
information from its database, in accordance with subdivision (b).

(b) (1)  begin delete An end delete begin insert Unless prohibited by federal law, an end insert online data
broker that receives a written demand from begin delete an end delete begin insert a subject end insert individual
pursuant to this section shall remove the begin insert subject end insert individual’s
personal information from public display on the Internet within
10 days of delivery of the written demand, and shall begin delete continue to end delete
ensure that this information is not reposted on the same Internet
Web site, a subsidiary site, or any other Internet Web site begin insert owned,
controlled, or end insert maintained by the online data broker receiving the
written demand.

(2) After receiving begin delete the end delete begin insert a subject end insert individual’s written demand,
the online data broker shall not transfer begin delete an end delete begin insert the subject end insert individual’s
personal information to any other person, business, or association
through any other medium.

begin insert

begin insert 22593. end insert   

(a) It is unlawful for an online data broker to solicit
or accept the payment of a fee or other consideration to review or
permanently remove personal information from the online data
broker’s database.

(b) Each payment solicited or accepted in violation of this
section constitutes a separate violation.

end insert begin insert

begin insert 22594. end insert   

In addition to any other sanction, penalty, or remedy
provided by law, a subject individual may bring a civil action in
any court of competent jurisdiction against any person in violation
of this chapter for damages in an amount equal to the greater of
one thousand dollars ($1,000) per violation or the actual damages
suffered by the subject individual as a result, along with costs,
reasonable attorney’s fees, and any other legal or equitable relief.

end insert begin insert

begin insert 22595. end insert   

(a) This chapter shall only apply to personal
information that is collected, assembled, or maintained by an
online data broker after January 1, 2015.

(b) Notwithstanding subdivision (a), this chapter shall apply to
information collected, assembled, or maintained by an online data
broker prior to January 1, 2015, if the data broker collected,
assembled, or maintained the information in violation of any law
or regulation.

end insert