California Consumer Privacy Act of 2018.

Existing law, the California Consumer Privacy Act of 2018, commencing on January 1, 2020, grants a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to request a business to delete any personal information about the consumer collected by the business, and requires the business to comply with a verifiable consumer request to that effect, unless it is necessary for the business or service provider, defined as an entity processing information on behalf of a business, to maintain the customer's personal information in order to carry out specified acts. The act requires a business that collects personal information about a consumer to disclose, on its Internet Web site or in its online privacy policy or policies, the consumer's right to delete that personal information. Under existing law, the act does not apply to protected health information that is collected by a covered entity, as specified. This bill would additionally provide an exception to the requirements of the act for medical information or protected health information that is collected by a covered entity or business associate, for a provider of health care or a covered entity to the extent the information relates to health care services, and for information collected as part of a clinical trial, as specified. The bill would define various terms for these purposes.