- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
Established of California Privacy Protection Agency
1798.199.10 (a) There is hereby establishes in state government the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018. The agency shall be governed by a five-member board, including the chairperson. The chairperson and one member of the board shall be appointed by the Governor. The Attorney General, Senate Rules Committee, and Speaker of the Assembly shall each appoint one member. These appointments should be made from among Californians with expertise in the areas of privacy, technology, and consumer rights.
(b) The initial appointments to the agency shall be made within 90 days of the effective date of the act adding this section.
S.E.C. 24.2. Section 1798.199.15 is added to the Civil Code, to read:
1798.199.15. Members of the agency board shall:
(a) Have qualifications, experience, and skills, in particular in the areas of privacy and technology, required to perform the duties of the agency and exercise its power.
(b) Maintain the confidentiality of information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure Is required by the Public Records Act.
(c) Remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from another.
(d) Refrain from any action incompatible with their duties and engaging in any incompatible occupation, whether gainful or not, during their term.
(e) Have the right of access to all information made available by the agency to the chairperson.
(f) Be precluded, for a period of one year after leaving office, from accepting employment with a business that was subject to an enforcement action or civil action under this title during the member’s tenure or during the five-year period preceding the member’s appointment.
(g) Be precluded for a period of two years after leaving office from acting, for compensation, as an agent or attorney for, or otherwise representing, any other person in a matter pending before the agency lithe purpose is to influence an action of the agency.
S.E.C. 24.3. Section 1798.199.20 is added to the Civil Code, to read:
1798.199.20. Members of the agency board including the chairperson shall serve at the pleasure their appointment authority but shall serve for no longer than eight consecutive years.
S.E.C. 24.4. Section 1798.199.25 is added to the Civil Code, to read:
1798.199.25. For each day on which they engage in official duties, members of the agency board shall be compensated at the rate of one hundred dollars ($100), adjusted biennially to reflect changes in the cost of living, and shall be reimbursed for expenses incurred in performance of their official duties.
S.E.C. 24.5. Section 1798.199.30 is added to the Civil Code, to read:
1798.199.30. The agency board shall appoint an executive director who shall act in accordance with agency policies and regulations and with applicable law. The agency shall appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and shall fix the compensation of employees and prescribe their duties. The agency may contract for services that cannot be provided by its employees.
S.E.C. 24.6. Section 1798.199.35 is added to the Civil Code, to read:
1798.199.35. The agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority.
S.E.C. 24.7. Section 1798.199.40 is added to the Civil Code, to read:
1798.199.40. The agency shall perform the following functions:
(a) Administer, implement, and enforce through administrative actions, this title.
(b) On and after the earlier of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185 to carry out the purposes and provisions of the California Consumer Privacy Act of 2018, including regulations specifying record keeping requirements for businesses to ensure compliance with this title.
(c) Through the Implementation of this title, protect the fundamental privacy rights of natural persons with respect to the use of their personal information?
(d) Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale, and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the agency pursuant to paragraph (15) of subdivision (a) of Section 1798.185 while ensuring that data security is not compromised.
(e) Provide guidance to consumers regarding their rights under this title.
(f) Provide guidance to businesses regarding their duties and responsibilities under this title, and appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance with this title pursuant to regulations adopted pursuant to paragraph (18) of subdivision (a) of Section 1798.185.
(g) Provide technical assistance and advice to the Legislature, upon request, with respect to privacy-related legislation.
(h) Monitor relevant developments relating to the protection of personal information and in particular, the development of information and communication technologies and commercial practices.
(i) Cooperate with other agencies with Jurisdiction over privacy laws and with data processing authorities in California, other states, territories, and countries to ensure consistent application of privacy protections.
(j) Establish a mechanism pursuant to which persons doing business in California that do not meet the definition of business set forth in paragraph (1), (2), or (3) of subdivision (d) of section 1798.140 may voluntarily certify that they are in compliance with this title, as set forth in paragraph (4) of subdivision (d) of Section 1798.140, and make a list of those entities available to the public.
(k) Solicit, review, and approve applications for grants to the extent funds are available pursuant to paragraph (2) of subdivision (b) of Section 1798.16a
(j) Perform all other acts necessary or appropriate in the exercise of its power, authority, and Jurisdiction and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.
SEC. 24.8. Section 1798.199.45 is added to the Civil Code, to read:
1798.199.45 (a) Upon the sworn complaint of any person or on Its own initiative, the agency may investigate possible violations of this title relating to any business, service provider, contractor, or person. The agency may decide not to investigate a complaint or decide to provide a business with a timeperiod to cure the alleged violation. In making a decision not to investigate or provide more time to cure, the agency may consider the following:
(a) (1) lack of intent to violate this title;.
(2) Voluntary efforts undertaken by the business, service provider, contractor, or person to cure the alleged violation prior to being notified by the agency of the complaint.
(b) The Agency shall notify in writing the person who made the complaint of the action, if any, the Agency has taken or plans to take on the complaint, together with the reasons for that action or nonaction.
SEC 24.9 Section 1798.199.50 is added to the Civil Code, to read:
1798.199.50 No finding of probable cause to believe this title has been violated shall be made by the agency unless, at least 30 days prior to the agency’s consideration of the alleged violation, the business, service provider, contractor, or person alleged to have violated this title is notified of the violation by service of process or registered mall with return receipt requested, provided with a summary of the evidence, and informed of their right to be present in person and represented by counsel at any proceeding of the agency held for the purpose of considering whether probable cause exists for believing the person violated this title. Notice to the alleged violator shall be deemed made on the date of service, the date the registered mall receipt is signed, or if the registered mall receipt is not signed, the date returned by the post office. A proceeding held for the purpose of considering probable cause shall be private unless the alleged violator files with the agency a written request that the proceeding be public.
SEC. 24.10 Section 1798.199.55 is added to the Civil Code, to read:
1798.199.55. (a) When the agency determines there is probable cause for believing this title has been violated, it shall hold a hearing to determine if a violation has or violations have occurred. Notice shall be given and the hearing conducted in accordance with the Administrative Procedure Act (Chapter 5 (commencing with Section 11500), Part 1, Division Title 2, Government Code). The agency shall have all the powers granted by that chapter. If the agency determines on the basis of the hearing conducted pursuant to this subdivision that a violation or violations have occurred, it shall issue an order that may require the violator to do all or any of the following:
(1) Cease and desist violation of this title.
(2) Subject to Section 1798.155, pay an administrative fine of up to two thousand five hundred dollars ($2,500) for each violation, or up to seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers to the Consumer Privacy Fund within the General Fund of the state. When the agency determines that no violation has occurred, it shall publish a declaration so stating.
(b) If two or more persons are responsible for any violation or violations, they shall be jointly and severally liable.
SEC. 24.11. Section 1798.199.60 is added to the Civil Code, to read:
1798.199.60, Whenever the agency rejects the decision of an administrative law judge made pursuant to Section 11517 of the Government Code, the agency shall state the reasons in writing for rejecting the decision.
SEC. 24.12. Section 1798.199.65 is added to the Civil Code, to read:
1798.199.65. The agency may subpoena witnesses, compel their attendance and testimony, administer oaths and affirmations, take evidence and require by subpoena the production of any books, papers, records, or other items material to the performance of the agency’s dutiesor exercise of its powers, including, but not limited to, its power to audit a business’ compliance with this title.
SEC. 24.12. Section 1798.199.70 is added to the Civil Code, to read:
1798.199.70. No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.
(a) The service of the probable cause hearing notice, as required by Section 1798.199.50, upon the person alleged to have violated this title shall constitute the commencement of the administrative action.
(b) if the person alleged to have violated this title engages in the fraudulent concealment of a person’s acts or identity, the five-year period shall be tolled for the period of the concealment. For purposes of this subdivision, “fraudulent concealment” means the person knows of material facts related to the person’s duties under this title and knowingly conceals them in performing duties for the purpose of defrauding the public of information to which it is entitled under this title.
(c) If, upon being ordered by a superior court to produce any documents sought by a subpoena in any administrative proceeding under this title, the person alleged to have violated this title fails to produce documents in response to the order by the date ordered to comply therewith, the five-year period shall be tolled for the period of the delay from the date of filing of the motion to compel until the date the documents are produced.
SEC. 24.14. Section 1798.799.75 is added to the Civil Code, to read:
1798.199.75. (a) in addition to any other available remedies, the agency may bring a civil action and obtain a judgment in superior court for the purpose of collecting any unpaid administrative fines imposed pursuant to this title after exhaustion of judicial review of the agency’s action. The action may be filed as a small claims, limited civil, or unlimited civil case depending on the jurisdictional amount. The venue for this action shall be in the county where the administrative fines were imposed by the agency. In order to obtain a judgment in a proceeding under this section, the agency shall show, following the procedures and rules of evidence as applied in ordinary civil actions, all of the following:
(1) That the administrative fines were imposed following the procedures set forth in this title and implementing regulations.
(2) That the defendant or defendants in the action were notified, by actual or constructive notice, of the imposition of the administrative fines.
(3) That a demand for payment has been made by the agency and full payment has not been received.
(b) A civil action brought pursuant to subdivision (a) shall be commenced within four years after the date on which the administrative fines were Imposed.
SEC. 24.15. Section 1798.199.80 is added to the Civil Code, to read:
1798.199.80. (a) if the time for judicial review of a final agency order or decision has lapsed, or if all means of judicial review of the order or decision have been exhausted, the agency may apply to the clerk of the court for a judgment to collect the administrative fines Imposed by the order or decision, or the order as modified in accordance with a decision on judicial review.
(b) The application, which shall include a certified copy of the order or decision, or the order as modified In accordance with a decision on judicial review, and proof of service of the order or decision, constitutes a sufficient showing to warrant issuance of the judgment to collect the administrative fines. The clerk of the court shall enter the judgment immediately in conformity with the application.
(c) An application made pursuant to this section shall be made to the clerk of the superior court in the county where the administrative fines were imposed by the agency.
(d) A judgment entered in accordance with this section has the same force and effect as, and is subject to all the provisions.of law relating to,,a judgment in a civil action and may be enforced in the same manner as any other judgment of the court in which it is entered.
(e) The agency may bring an application pursuant to this section only within four years after the date on which all means of judicial review of the order or decision have been exhausted.
(f) The remedy available under this section is in addition to those available under any other law.
SEC. 24.16 Section 1798.199.85 is added to the Civil Code, to read:
1798.199.85. Any decision of the agency with respect to a complaint or administrative fine shall be subject to judicial review in an action brought by an interested party to the complaint or administrative fine and shall be subject to an abuse of discretion standard.
SEC. 24.17. Section 1798.199.90 is added to the Civil Code, to read:
1798.199.90; (a) Any business, service provider, contractor, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 2798.185, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty.
(b) Any civil penalty recovered by an action brought by the Attorney General for a violation of this title, and the proceeds of any settlement of any said action, shall be deposited in the Consumer Privacy Fund.
(c) The agency shall, upon request by the Attorney General, stay an administrative action or investigation under this title to permit the Attorney General to proceed with an investigation or civil action and shall not pursue an administrative action or investigation, unless the Attorney General subsequently determines not to pursue an investigation or civil action. The agency may not limit the authority of the Attorney General to enforce this title.
(d) No civil action may be filed by the Attorney General under this section for any violation of this title after the agency has issued a decision pursuant to Section 1798.199.85 or an order pursuant to Section 1798.199.55 against that person for the same violation.
(e) This section shall not affect the private right of action provided for in Section 1798.150.
SEC. 24.18 Section 1798.199.95 is added to the Civil Code, to read:
1798.199.95. (a) There is hereby appropriated from the General Fund of the state to the agency the sum of five million dollars ($5,000,000) during the fiscal year 2020-2021, and the ” sum of ten million dollars ($10,000,000) adjusted for cost-of-living changes, during each fiscal year thereafter, for expenditure to support the operations of the agency pursuant to this title. The expenditure of funds under this appropriation shall be subject to the normal administrative review given to other state appropriations. The Legislature shall appropriate those additional amounts to the Commission and other agencies as may be necessary to carry out the provisions of this title.
(b) The Department of Finance, in preparing the state budget and the Budget Act bill submitted to the Legislature, shall include an item for the support of this that shall indicate all of the following:
(1) The amounts to be appropriated to other agencies to carry out their duties under this title, which amounts shall be in augmentation of the support items of those and agencies.
(2) The additional amounts required to be appropriated by the Legislature to the agency to carry out the purposes of this title, as provided for in this section.
(3) In parentheses, for informational purposes, the continuing appropriation during each fiscal year of ten million dollars ($10,000,000), adjusted for cost-of-living changes made pursuant to this section.
(c) The Attorney General shall provide staff support to the agency until the agency has hired its own staff. The Attorney General shall be reimbursed by the agency for these services.
SEC. 24.19 Section 1798.199.100 is added to the Civil Code, to read:
1798.199.100. The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation.
SEC. 25. Amendment.
(a) The provisions of this act may be amended after its approval by the voters by a statute that Is passed by a vote of a majority of the members of each house of the Legislature and signed by the Governor, provided that those amendments are consistent with and further the purpose and intent of this act as set forth in Section 3, including amendments to the exemptions in Section 1798.145 if the laws upon which the exemptions are based are amended to enhance privacy and are consistent with and further the purposes and intent of this act and amendments to address decision of a state or federal court holding that a provision of the act is unconstitutional or preempted by federal law, provided that any further amendments to legislation that addresses a court holding shall be subject to this subdivision.
(b) Notwithstanding Section 1798.199.25, the Legislature may authorize additional compensation for members of the California Consumer Privacy Agency, if it determines that it is necessary to carry out the agency’s functions, by a statute that is passed by a vote of a majority of the members of each house of the Legislature and signed by the Governor.
(c) This section applies to all statutes amended or reenacted as part of this act, and all provisions of those statutes, regardless of whether this act makes any substantive change thereto.
(d) The provisions of this act shall prevail over any conflicting legislation enacted after January 1, 2020. Any amendments to this act or any legislation that conflicts with any provision of this act shall be null and void upon passage of this act by the voters, regardless of the code in which it appears. Legislation shall be considered “conflicting” for purposes of this subdivision, unless the legislation is consistent with and furthers the purpose and intent of this act as set forth in Section 3.
SEC. 26. Severability.
If any provision of this measure, or part of this measure, or the application of any provision or part to any person or circumstances, is for any reason held to be invalid, the remaining provisions, or applications of provisions, shall not be affected, but shall remain in full force and effect, and to this end the provisions of this measure are severable. If a court were to find in a final, unreviewable judgment that the exclusion of one or more entities or activities from the applicability of the act renders the act unconstitutional, those exceptions should be severed and the act should be made applicable to the entities or activities formerly exempt from the act it is the intent of the voters that this act would have been enacted regardless of whether any invalid provision had been included or any invalid application had been made.
SEC. 27. Conflicting Initiatives.
(a) In the event that this measure and another measure addressing consumer privacy shall appear on the same statewide ballot, the provisions of the other measure or measures shall be deemed to be in conflict with this measure, in the event that this measure receives a greater number of affirmative votes than a measure deemed to be in conflict with it, the provisions of this measure shall prevail in their entirety, and the other measure or measures shall be null and void,
(b) If this measure is approved by the voters but superseded by law by any other conflicting measure approved by voters at the same election, and the conflicting ballot measure is later held invalid, this measure shall be self-executing and given full force and effect.
SEC. 28. Standing.
Notwithstanding any other provision of law, if the state or any of its officials fall to defend the constitutionality of this act , following its approval by the voters, any other government agency of this state shall have the authority to intervene in any court action challenging the constitutionality of this act for the purpose of defending its constitutionality, whether that action is initate or federal trial court, on appeal, or on discretionary review by the Supreme Court of California or the Supreme Court of the United States. The reasonable fees and costs of defending the action shall be a charge on funds appropriated to the Department of Justice, which shall be satisfied promptly,
SEC. 29. Construction.
This act shall be liberally construed to effectuate its purposes.
SEC. 30. Savings Clause.
This act is intended to supplement federal and state law, where permissible, but shall not apply if that application is preempted by, or in conflict with, federal law, or the California Constitution. The provisions of the act relating to children under 16 years of age shall only apply recL roA to the extent not in conflict with the federal Children’s Online Privacy Protection Act.
SEC. 31. Effective and Operative Dates.
(a) This act shall become effective as provided in subdivision (a) of Section 10 of Article II of the California Constitution. Except as provided in subdivision (b), this act shall become operative January 1, 2023, and with the exception of the right of access, shall only apply to personal information collected by a business on or after January 1, 2022;
(b) Subdivisions (m) and (n) of Section 1798.145, Sections 1798.160, 1798.185, Sections 1798.199.10 through 1798.199.40, inclusive and Section 1798.199.95, shall become operative on the effective date of the act.
(c) The provisions of the California Consumer Privacy Act of 2018, amended by this act, shall remain in full force and effect and shall be enforceable until the same provisions of this act become operative and enforceable.