1798.100. - (a) A consumer shall have the right to request that a business that collects a consumer’s personal information disclose to1798.105. - (a) A consumer shall have the right to request that a business delete any personal information about the consumer which1798.110. - (a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose1798.115. - (a) A consumer shall have the right to request that a business that sells the consumer’s personal information, or that1798.120. - (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the1798.125. - (a) (1) A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under1798.130. - (a) In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, in a form that is reasonably accessible1798.135. - (a) A business that is required to comply with Section 1798.120 shall, in a form that is reasonably accessible to1798.140. - For purposes of this title:1798.145. - (a) The obligations imposed on businesses by this title shall not restrict a business’s ability to:1798.150. - (a) (1) Any consumer whose nonencrypted or nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision1798.155. - Any business or third party may seek the opinion of the Attorney General for guidance on how to comply with1798.160. - (a) A special fund to be known as the “Consumer Privacy Fund” is hereby created within the General Fund in1798.175. - This title is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers’ personal1798.180. - This title is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws1798.185. - (a) On or before January 1, 2020, the Attorney General shall solicit broad public participation to adopt regulations to further1798.190. - If a series of steps or transactions were component parts of a single transaction intended from the beginning to be1798.192. - Any provision of a contract or agreement of any kind that purports to waive or limit in any way a1798.194. - This title shall be liberally construed to effectuate its purposes.1798.196. - This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is1798.198. - (a) Subject to limitation provided in subdivision (b), this title shall be operative January 1, 2020.
(c) A business that receives a verifiable request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records and direct any service providers to delete the consumer’s personal information from their records.
(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:
(d) “Business purpose” means the use of personal information for the business’ or a service provider’s operational purposes, or other notified purposes, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(5) Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
(k) “Health insurance information” means a consumer’s insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the consumer, or any information in the consumer’s application and claims history, including any appeals records, if the information is linked or reasonably linkable to a consumer or household, including via a device, by a business or service provider.
(C) The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purposes if both of the following conditions are met: services that the service provider performs on the business’ behalf, provided that the service provider also does not sell the personal information.
(ii) The service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose.
(v) “Service provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business, or as otherwise permitted by this title, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract with the business.
(3) Cooperate with law enforcement agencies concerning conduct or activity that the business, service provider, or third party reasonably and in good faith believes may violate federal, state, or local law.
(h) A business that discloses personal information to a service provider shall not be liable under this title if the service provider receiving the personal information uses it in violation of the restrictions set forth in the title, provided that, at the time of disclosing the personal information, the business does not have actual knowledge, or reason to believe, that the service provider intends to commit such a violation. A service provider shall likewise not be liable under this title for the obligations of a business for which it provides services as set forth in this title.
(a) A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be liable for a civil penalty as provided in Section 17206 of the Business and Professions Code in a civil action brought in the name of the people of the State of California by the Attorney General. The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.
(b) Notwithstanding Section 17206 of the Business and Professions Code, any person, business, or service provider that intentionally violates this title may be liable for a civil penalty of up to seven thousand five hundred dollars ($7,500) for each violation.
