California Consumer Privacy Act of 2018.

The California Consumer Privacy Act of 2018 grants, commencing on January 1, 2020, a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to request disclosure of, and have access to, the categories and specific pieces of information that a business collects about the consumer. The act grants a consumer a right to request a business to delete any personal information about the consumer collected by the business and requires a business to do so upon receipt of a verified request, except as specified. The act grants a consumer the right to opt-out of the sale of personal information. The act prohibits a business from discriminating because of the exercise of these rights, provided that this prohibition does not prevent a business from charging a different price or rate, or giving a different level of goods or services, if the difference is related to the value of the consumer's data, as specified. The act prescribes definitions for these purposes, including "business purpose," "personal information," and "sell." The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The act authorizes a consumer whose personal information, as specified, is subject to theft or disclosure resulting from a business's failure to implement and maintain reasonable security procedures to bring a civil action and prescribes various requirements in this regard. Existing law also authorizes the Attorney General to bring a civil action for a violation of the act and grants a business an opportunity to cure a violation within 30 days of notice. Existing law imposes other responsibilities on the Attorney General in connection with the act, including the creation of regulations and providing guidance on how to comply with the act. This bill would revise and recast the California Consumer Privacy Act of 2018. Among other things, the bill would prohibit a business from sharing a consumer's personal information unless the consumer has authorized that sharing and would prescribe various business requirements in connection with this new "right to opt-in consent." The bill would generally prohibit any discrimination against a consumer based on the exercise of the right to opt-in or other rights, including charging different prices for goods or services. The bill would require a business that collects personal information to limit its use and retention of personal information to what is reasonably necessary to provide a service or conduct an activity, as specified, subject to certain exceptions. The bill would broaden the duties of businesses regarding requirements connected with disclosure, access, and deletion of consumer information. The bill would redefine "business purpose," "personal information," "sell," "research," and other terms. The bill would eliminate certain exceptions to the obligations imposed on a business in connection with its provisions. This bill would expand the enforcement provisions currently granted to the Attorney General to apply to county district attorneys and city attorneys, among others, and would eliminate the opportunity of a business to cure a violation within 30 days. The bill would provide that the California Consumer Privacy Act of 2018 would be operative January 1, 2021, and revise the preemption of local rules and regulations currently in effect as of that date to apply to provisions that are in conflict with the act. The bill would make a variety of other technical and conforming changes.