Information Practices Act of 1977.

Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. Existing law exempts from the provisions of the act counties, cities, any city and county, school districts, municipal corporations, districts, political subdivisions, and other local public agencies, as specified. This bill would, beginning January 1, 2025, recast those provisions to include, among other things, genetic information, IP address, online browsing history, and location information, if reasonably capable of identifying or describing an individual, within the definition of "personal information," and revise the definition of "regulatory agency" to include the Financial Industry Regulatory Authority, for the act's purposes. The bill would make other technical, nonsubstantive, and conforming changes. Existing law requires an agency to establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information and instruct those persons with respect to specified rules relevant to the act. This bill would require that those rules established by the agency be consistent with applicable provisions of the State Administrative Manual and the State Information Management Manual. The bill would prohibit an agency from using records containing personal information for any purpose or purposes other than the purpose or purposes for which that personal information was collected or generated, except as required by state or federal law. Existing law prohibits an agency from disclosing any personal information in a manner that would link the information disclosed to the individual to whom it pertains, except under specified circumstances. Existing law requires an agency, for disclosures of specified records, to keep an accurate accounting of the date, nature, and purpose of the disclosure, and the name, title, and business address of the person or agency to whom the disclosure was made. This bill would revise the circumstances that may allow the disclosure of personal information in a manner that links or reasonably could link the information disclosed to the individual to whom it pertains, define "privacy board" for these purposes, and would make conforming changes. The bill would also revise the circumstances and types of records that would require agencies to keep an accurate accounting of the disclosure of that record. Existing law makes an intentional violation of any provision of the act, or of any rules or regulations adopted under the act, by an officer or employee of any agency a cause for discipline, including termination of employment. This bill would also make a negligent violation of the act a cause for discipline, and would specify that the relevant discipline may be up to and including termination. Existing law provides that the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of the act, that is not otherwise permitted by law, is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains. This bill would, for a violation to be punishable as a misdemeanor, require that the disclosure be known or should be known to be in violation of the disclosure provisions, and remove the requirement that the wrongful disclosure result in economic loss or personal injury. Because the bill would expand the scope of an existing crime by deleting this condition, the bill would impose a state-mandated local program. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.