Personal information: precise geolocation data: data collection.

Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer's personal information, including geolocation data. Existing law also provides a consumer with the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer's sensitive personal information to certain prescribed uses, and defines "sensitive personal information" to mean, among other things, a consumer's precise geolocation. Existing law requires an operator and an end-user of an automated license plate recognition (ALPR) system, as defined, to, among other things, maintain reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified. Existing law requires a public agency, as defined, that operates or intends to operate an ALPR system to provide an opportunity for public comment, as specified, before implementing the program. Existing law prohibits a public agency from selling, sharing, or transferring ALPR information except to another public agency, and only as otherwise permitted by law. This bill would require a public agency that collects precise geolocation data to maintain reasonable security procedures and practices to protect precise geolocation data from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified. The bill would define precise geolocation data as any data that is derived from a device and that is used or intended to be used to locate a person within a radius equal to or less than 1,850 feet around that person. The bill would require a public agency that collects or intends to collect precise geolocation data to provide an opportunity for public comment, as specified, before collection begins. The bill would prohibit a public agency from selling, sharing, or transferring precise geolocation data except to comply with a lawful court order. This bill would also require a public agency that collects precise geolocation data to obtain lawful permission to collect precise geolocation data prior to the collection of that precise geolocation data and maintain that permission for the duration of the collection of the precise geolocation data. The bill would provide that lawful permission includes any collection in conformity with the California Electronic Communications Privacy Act, a subpoena, court order, or search warrant for the particular device from which precise geolocation data is derived, or consent, as defined, of the person who possesses the device from which precise geolocation data is derived. By imposing new duties on public agencies, which include local jurisdictions, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.