California Consumer Privacy Act of 2018.

(1) Existing law, the California Consumer Privacy Act of 2018, beginning on January 1, 2020, grants consumers various rights with regard to their personal information held by businesses, including the right to know what categories of personal information and the specific pieces a business collects and to have information held by that business deleted, as specified. Existing law imposes certain responsibilities on the Attorney General in connection with the act, including creating regulations and providing guidance on how to comply with the act. The act excludes from the definition of personal information consumer information that is deidentified, or aggregate consumer information. The act defines "deidentified" to mean information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, provided that a business using deidentified information has implemented technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, has implemented business processes specifically prohibiting reidentification of the information to prevent inadvertent release, and makes no attempt to reidentify the information. This bill would revise the definition of "deidentified" to instead mean information that does not identify, and is not reasonably linkable, directly or indirectly, to a particular consumer, provided that the business makes no attempt to reidentify the information and takes reasonable technical and administrative measures designed to ensure that the data is deidentified, publicly commits to maintain and use the data in a deidentified form, and contractually prohibits recipients of the data from trying to reidentify it. (2) Existing law defines "personal information," as, among other information, that which is capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household. This bill would instead specify that personal information includes, but is not limited to, specified information that, among other things, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household. (3) Existing law specifies that the act is not to be construed to require a business to reidentify or otherwise link information that is not maintained in a manner that would be considered personal information. This bill would revise this language to delete the reference to information that is not maintained in "a manner that would be considered personal information." The bill would instead refer to information that is not maintained as personal information. The bill would make additional conforming changes to these provisions.