Information Practices Act of 1977: personal information.

Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to certain state agencies with regard to their collection, storage, and disclosure of personal information. Existing law defines personal information, for these purposes, to mean any information maintained by an agency that identifies or describes an individual, including, among other things, financial matters, and medical or employment history. Under existing law, a person who willfully requests or obtains any record containing personal information from an agency under false pretenses is guilty of a misdemeanor. This bill would revise the definition of personal information to mean any information that identifies, relates to, describes, or is capable of being associated with a particular individual, including, among other things, any other financial information, medical information, or health insurance information. Because the bill would expand the definition of a crime, the bill would impose a state-mandated local program. Existing law prohibits an individual's name and address from being distributed for commercial purposes, sold, or rented by an agency, as defined, unless that action is specifically authorized by law. This bill would instead prohibit personal information, as defined, from being distributed, sold, or rented by an agency for any purpose that has financial gain unless that action is specifically authorized by law. The bill would make other nonsubstantive conforming changes. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.