California Consumer Privacy Act of 2018.

(1) Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, grants consumers various rights with regard to their personal information held by businesses, including the right to request a business to disclose specific pieces of personal information it has collected and to have information held by that business deleted, as specified. The act requires a business to disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The act prohibits a business from requiring a consumer to create an account with the business in order to make a verifiable consumer request. This bill would provide an exception to that prohibition by authorizing a business to require authentication of the consumer that is reasonable in light of the nature of the personal information requested in order to make a verifiable consumer request. However, the bill would authorize a business to require a consumer to submit a verifiable consumer request through an account that the consumer maintains with the business if the consumer maintains an account with that business. (2) The act also authorizes a consumer to bring a private civil action, as specified, against a business that violates its duty to implement reasonable security procedures and practices if that failure results in a consumer's personal information being subject to unauthorized access and exfiltration, theft, or disclosure. The act also requires a business that collects a consumer's personal information to, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. This bill would exempt, until January 1, 2021, from all provisions of the act, except the private civil action provision and the obligation to inform the consumer as to the categories of personal information to be collected as described above, information collected from a natural person by a business in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business, as specified. This bill would make various other nonsubstantive changes. This bill would incorporate additional changes to Section 1798.130 of the Civil Code proposed by AB 1355 and AB 1564 to be operative only if either or both of those bills are enacted and this bill is enacted last. This bill would incorporate additional changes to Section 1798.145 of the Civil Code proposed by AB 1146 and AB 1355 to be operative only if either or both of those bills are enacted and this bill is enacted last.