1798.100. - (a) A consumer shall have the right to request that a business that collects a consumer’s personal information disclose to1798.105. - (a) A consumer shall have the right to request that a business delete any personal information about the consumer which1798.110. - (a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose1798.115. - (a) A consumer shall have the right to request that a business that sells the consumer’s personal information, or that1798.120. - (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the1798.125. - (a) (1) A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under1798.130. - (a) In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, in a form that is reasonably accessible1798.135. - (a) A business that is required to comply with Section 1798.120 shall, in a form that is reasonably accessible to1798.140. - For purposes of this title:1798.145. - (a) The obligations imposed on businesses by this title shall not restrict a business’s ability to:1798.150. - (a) (1) Any consumer whose nonencrypted or nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision1798.155. - Any business or third party may seek the opinion of the Attorney General for guidance on how to comply with1798.160. - (a) A special fund to be known as the “Consumer Privacy Fund” is hereby created within the General Fund in1798.175. - This title is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers’ personal1798.180. - This title is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws1798.185. - (a) On or before January 1, 2020, the Attorney General shall solicit broad public participation to adopt regulations to further1798.190. - If a series of steps or transactions were component parts of a single transaction intended from the beginning to be1798.192. - Any provision of a contract or agreement of any kind that purports to waive or limit in any way a1798.194. - This title shall be liberally construed to effectuate its purposes.1798.196. - This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is1798.198. - (a) Subject to limitation provided in subdivision (b), this title shall be operative January 1, 2020.
(f) The unauthorized disclosure of personal information and the loss of privacy can have devastating effects for individuals, ranging from financial fraud, identity theft, and unnecessary costs to personal time and finances, to destruction of property, harassment, reputational damage, emotional stress, and even potential physical harm.
(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:
(2) Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable request, but this shall not extend the business’s duty to disclose and deliver the information within 45 days of receipt of the consumer’s request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45day period. The disclosure shall cover the 12month period preceding the business’s receipt of the verifiable request and shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business shall not require the consumer to create an account with the business in order to make a verifiable request.
(d) “Business purpose” means the use of personal information for the business’ or a service provider’s operational purposes, or other notified purposes, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(9) Subjected by the business conducting the research to additional security controls limit access to the research data to only those individuals in a business as are necessary to carry out the research purpose.
(C) The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purposes if both of the following conditions are met: services that the service provider performs on the business’ behalf, provided that the service provider also does not sell the personal information.
(ii) The service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose.
(1) A time period for a business to respond to any verified consumer request may be extended by up to 90 additional days where necessary, taking into account the complexity and number of the requests. The business shall inform the consumer of any such extension within 45 days of receipt of the request, together with the reasons for the delay.
(d) It is the intent of the Legislature that the percentages specified in subdivision (c) be adjusted as necessary to ensure that any civil penalties assessed for a violation of this title fully offset any costs incurred by the state courts and the Attorney General in connection with this title, including a sufficient amount to cover any deficit from a prior fiscal year.
(3) Establishing any exceptions necessary to comply with state or federal law, including, but not limited to, those relating to trade secrets and intellectual property rights, within one year of passage of this title and as needed thereafter.
(6) Establishing rules, procedures, and any exceptions necessary to ensure that the notices and information that businesses are required to provide pursuant to this title are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer, including establishing rules and guidelines regarding financial incentive offerings, within one year of passage of this title and as needed thereafter.
(b) The Attorney General may adopt additional regulations as necessary to further the purposes of this title.
