Personal information.

(1) Existing law, the California Consumer Privacy Act of 2018, operative January 1, 2020, grants a consumer various rights in connection with a business, as defined, that collects the consumer's personal information. The act defines various terms for these purposes. The act excludes publicly available information, as defined, from the definition of personal information and excludes both consumer information that is deidentified, as defined, and aggregate consumer information, as defined, from the definition of publicly available. Thus, the act does not exclude, as publicly available information, any consumer information that is either deidentified or aggregated. This bill would, instead, exclude consumer information that is deidentified or aggregate consumer information from the definition of personal information. (2) The act prohibits a business from discriminating against the consumer for exercising any of the consumer's rights under the act, except that a business may offer a different price, rate, level, or quality of goods or services to a consumer if the differential treatment is reasonably related to value provided to the consumer by the consumer's data. This bill would, instead, prohibit a business from discriminating against the consumer for exercising any of the consumer's rights under the act, except if the differential treatment is reasonably related to value provided to the business by the consumer's data. (3) The act requires a business to make certain disclosures to consumers regarding a consumer's rights under the act in a specified manner. This bill would require a business to disclose to consumers, as specified, that a consumer has the right to request the specific pieces of information and the categories of information the business has collected about that consumer as well as the fact that a consumer has the right to request that the business delete that information, as specified. (4) The act authorizes a consumer whose nonencrypted or nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business' violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information to institute a civil action, as specified. This bill would, instead, authorize a consumer whose nonencrypted and nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business' violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information to institute a civil action, as specified. The bill would exempt, subject to a specified condition, from all of the provisions of the title, except for the provision described above related to a business' failure to protect personal information from unauthorized access, any activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by specified parties, including a consumer reporting agency, as defined. The bill would, until January 1, 2021, similarly exempt personal information reflecting a written or verbal communication or a transaction between the business and the consumer, as specified, within the context of the business conducting due diligence or providing or receiving a product or service, as specified. The bill would make conforming and nonsubstantive changes to these and other provisions of the act and would also correct several cross-references. This bill would incorporate additional changes to Section 1798.130 of the Civil Code proposed by AB 25 and AB 1564 to be operative only if either or both of those bills are enacted and this bill is enacted last. This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by AB 874 to be operative only if either or both of those bills are enacted and this bill is enacted last. This bill would incorporate additional changes to Section 1798.145 of the Civil Code proposed by AB 25 and AB 1146 to be operative only if either or both of those bills are enacted and this bill is enacted last.