Business: collection and disclosures of consumer personal information.

Existing law, the California Consumer Privacy Act of 2018, beginning on January 1, 2020, grants a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to know the categories of personal information, and the specific pieces of personal information, that a business collects about the consumer. Existing law imposes certain responsibilities on the Attorney General in connection with the act, including creating regulations and providing guidance on how to comply with the act. The act establishes various exceptions on the obligations of a business under these provisions including by providing that the act does not restrict a business's ability to, among other things, comply with federal, state, or local laws. This bill would specify that the act also does not restrict a business's ability comply with any rules or regulations adopted pursuant to and in furtherance of state or federal laws. The bill would establish an exception to the act for a business that provides a consumer's personal information to a government agency solely for the purposes of carrying out a government program, if specified requirements are met. The bill would also establish an exception to the act for a business that sells the personal information of a consumer who has opted-out of the sale of the consumer's personal information to another person for the sole purpose of detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, if the business and the person do not further sell that information for any other purpose. The bill would repeal the above provisions on January 1, 2024.