Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA) , generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. Existing law, the Early Learning Personal Information Protection Act (ELPIPA) , generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes. This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator's site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system. This bill would also enact the Higher Education Student Information Protection Act (HESIPA) , which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027. This bill would authorize a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed, and would require a person bringing that action to furnish a copy of the complaint to the Attorney General within 10 days after filing the action.
Under existing law, a county elections official is required to prepare a certified statement of the results of an election and submit it to the county board of supervisors within 30 days of the election. This bill would make it a felony, punishable by imprisonment for 16 months or 2 or 3 years, to seize or cause or assist in the seizure of ballots, election records, or certified voting technology before election results are certified by the elections official. The bill would also make it a felony punishable by imprisonment for 2, 3, or 4 years for any person with authority to direct another person subject to their supervision or authority to seize ballots, election records, or certified voting technology before election results are certified. By creating new crimes, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute.
Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law generally regulates artificial intelligence, including the Transparency in Frontier Artificial Intelligence Act, which, among other things related to the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches certain safety-related items. Existing law defines "artificial intelligence" as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This bill would require the Government Operations Agency to, no later than January 1, 2029, establish an AI Auditor Registry on the agency's internet website allowing AI auditors to register with the agency and allowing natural persons to report misconduct by a registered AI auditor, and require the agency to fix annual registration fees, as specified. The bill would, commencing January 1, 2029, prohibit an unregistered person from offering, selling, or conducting a covered AI audit, as defined, and would require the agency to, among other things, issue a unique registration number to each registered AI auditor and publish information provided by a registered AI auditor on the agency's internet website. The bill would require the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services. The bill would authorize the agency to adopt regulations that are reasonably necessary to effectuate the purposes of the bill. This bill would require an AI auditor that registers with the agency to provide specified information to the agency and would impose various requirements on a registered AI auditor that conducts a covered AI audit, including, among other things, providing the auditee with a report that includes a signed and dated statement indicating that the audit was conducted according to the provisions of this bill. This bill would require a registered AI auditor to adhere to various standards of independence, objectivity, and integrity, including not seeking, soliciting, negotiating for, or accepting employment with an auditee while participating in the audit and not conducting a covered AI audit if the auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor's independence or objectivity. The bill would prohibit a registered AI auditor from preventing an employee from engaging in, or from retaliating against an employee who has engaged in, specified whistleblower activity. The bill would authorize the agency to investigate alleged violations of the bill, as specified, and provide that a violation constitutes grounds for removal from the registry and referral to the Attorney General or other appropriate enforcement authority. This bill would create the AI Auditors' Registration Fund within the State Treasury, to be administered by the agency, and would require that all moneys collected or received by the agency pursuant to the above-described provisions be deposited into the fund to be available, upon appropriation by the Legislature, to administer the above-described provisions. Existing law establishes the California Board of Accountancy, which is within the Department of Consumer Affairs, and requires the board to license and regulate accountants in this state. This bill would exempt a registered AI auditor licensed or authorized to practice public accountancy and a firm holding a permit to practice public accountancy issued by the California Board of Accountancy, as specified, from complying with certain requirements related to reporting information to the agency and standards of independence, objectivity, and integrity under the bill if certain requirements are met. The bill would require the Government Operations Agency to, if the agency determines that a certified public accountant, public accountant, or accounting firm in good standing has violated this bill, notify the accountant or firm and the California Board of Accountancy in writing, and would require the board to investigate the complaint and provide the agency with a report of its findings and any resulting action.
The California Fair Employment and Housing Act establishes the Civil Rights Department within the Business, Consumer Services, and Housing Agency and requires the department to, among other things, bring civil actions to enforce the act. Existing law requires, on or before September 1, 2024, the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. This bill would generally regulate the development and deployment of an automated decision system (ADS) used to make consequential decisions, as defined. The bill would define "automated decision system" to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is designed or used to assist or replace human discretionary decisionmaking and materially impacts natural persons. This bill would require a developer of a covered ADS, as defined, to take certain actions, including providing a potential deployer instructions explaining how the covered ADS should be used by the deployer to make or facilitate a consequential decision. This bill would require a deployer of a covered ADS to take certain actions, including provide certain disclosures to a subject of a consequential decision made or facilitated by the covered ADS that results in an adverse outcome, as defined, and provide the subject with an opportunity to appeal the outcome of the consequential decision, as prescribed. This bill would authorize the Attorney General to bring a specified civil action for noncompliance.
Existing law makes it a misdemeanor for any person having charge of a completed vote by mail ballot to interfere with a ballot's return to the local elections official. This bill would additionally make it a misdemeanor for any person having charge of a vote by mail ballot to interfere, as defined, with a ballot's delivery to a voter. The bill would make it a felony for a person with authority to direct one or more persons subject to their supervision or authority to interfere with a ballot's return to the local elections official or delivery to a voter. By expanding the scope of an existing crime, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute.
Existing law generally regulates classes of insurance, including life and disability insurance. Existing law prohibits an insurer from requiring a test for the presence of a genetic characteristic for the purpose of determining insurability, except as specified. If an insurer requests an applicant to take a genetic characteristic test, existing law requires the insurer to obtain the applicant's written informed consent and to notify the applicant of the test result. Existing law prohibits a life or disability income insurer from requiring a genetic characteristic test if the results of the test would be used to determine eligibility for specified health care coverage. Existing law prescribes civil penalties for an insurer who discloses the results of a test for a genetic characteristic requested by the insurer. This bill would repeal those provisions and would instead prohibit a life or disability insurer from canceling, limiting, or denying coverage, among other actions, based on a test for the presence or absence of a genetic characteristic. The bill would authorize a life or disability insurer to base an underwriting decision on a test for the presence or absence of a genetic characteristic if specified criteria are met. The bill would, except as provided, prohibit a life or disability insurer from requiring, requesting, or soliciting genetic information, using genetic test results, or considering a person's decisions or actions relating to genetic testing in any manner for an insurance purpose. The bill would additionally impose civil penalties for the use of genetic information or genetic characteristics in a manner inconsistent with these provisions, as specified, and other civil penalties for any violation of these provisions. The bill would also prohibit the use or disclosure of an individual's full genome. Existing law, the Insurance Information and Privacy Protection Act, prohibits an insurance institution, agent, or insurance-support organization from seeking specified information in connection with an insurance transaction or preparing or requesting an investigative consumer report about an individual for an insurance application, except as specified. Existing law prohibits an insurance institution or agent from basing an adverse underwriting decision on specified information. Existing law prohibits an insurance institution, agent, or insurance-support organization from utilizing a form or statement that authorizes disclosure of personal or privileged information as its disclosure form, unless the form or statement meets specified criteria. This bill would prohibit an insurance institution, agent, or insurance-support organization from seeking information in connection with an insurance transaction concerning, or prohibit an insurance institution or agent from basing an adverse underwriting decision on, an individual's genetic information or full genome, unless specified criteria are met. The bill would prohibit an insurance institution, agent, or insurance-support organization from preparing or requesting an investigative consumer report that seeks an individual's genetic information or full genome. This bill would state the intent of the Legislature that, notwithstanding any other law, these provisions shall not be interpreted to authorize the use or disclosure of an individual's full genome. This bill would incorporate additional changes to Sections 791.07, 791.11, and 791.12 of the Insurance Code proposed by SB 354 to be operative only if this bill and SB 354 are enacted and this bill is enacted last.
The California Constitution authorizes the Legislature to exempt from taxation, in whole or in part, property that is used exclusively for religious, hospital, or charitable purposes, and is owned or held in trust by a nonprofit entity. Pursuant to that authority, existing law provides for a welfare exemption under which property used exclusively for an exempt purpose and owned and operated by specified entities, including foundations, limited liability companies, or corporations meeting certain statutory requirements is exempt from taxation. This bill would specify that for the purposes of the welfare exemption provisions above, "property used exclusively for religious, hospital, scientific, or charitable purposes" shall not include property, or any portion thereof, operated as a detention facility, as defined. The bill would declare that the above provision is declarative of, and not a change in, existing law.
Existing law prohibits a person, other than a provider of electronic or wire communication service for specified purposes, from installing or using a pen register or a trap and trace device, as those terms are defined, without first obtaining a court order. Existing law authorizes a person who has been injured by a violation of that prohibition to bring an action against the person who committed the violation to enjoin and restrain the violation, as well as to bring an action for monetary damages, as specified. This bill would instead authorize only the Attorney General to bring that action for a violation of the above-described provision if the action is alleged to arise from conduct occurring on an internet website, online application, or mobile application. The bill would provide that this limitation applies retroactively to any pending claim in an action commenced within 2 years before the operative date of the bill. The bill would declare the severability of its provisions.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information that is collected by a business, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. Existing law, the Insurance Information and Privacy Protection Act, establishes privacy standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, and insurance-support organizations. The Insurance Information and Privacy Protection Act imposes various monetary penalties for violations of the act and makes a person who knowingly and willfully obtains information about an individual from an insurance institution, agent, or insurance-support organization under false pretenses guilty of a misdemeanor. On and after July 1, 2028, this bill would revise the Insurance Information and Privacy Protection Act to establish new standards for the processing and sharing of consumers' personal information by insurance licensees, surplus line insurers, reinsurers, and third-party service providers. The bill would authorize processing or sharing of a consumer's personal information for specified purposes, including sharing in connection with an insurance transaction. The bill would require a licensee, surplus line insurer, reinsurer, or third-party service provider to provide a clear and conspicuous privacy notice presented as a stand-alone document that includes specified information to a consumer within a specified period of time, and would prohibit the sharing of a consumer's personal information unless it is reasonably necessary and proportionate to achieve specified purposes related to an insurance transaction or another purpose that is fully disclosed to the consumer and to which the consumer has consented. The bill would also require a licensee to provide a privacy rights notice, as specified, to each consumer with whom the licensee has an ongoing business relationship. The bill would require a licensee, surplus line insurer, reinsurer, or third-party service provider to obtain a consumer's consent to take specified actions, and would set forth the means by which consent is obtained. The bill would authorize a licensee, surplus line insurer, or reinsurer to retain personal information, as specified, and would require a licensee, surplus line insurer, or reinsurer to develop a written records retention policy and schedule. The bill would require a licensee, surplus line insurer, or reinsurer to provide specified information to a consumer if it makes an adverse underwriting decision, and would provide a process by which a consumer may access, correct, amend, or delete any personal information about the consumer in the possession of the licensee, surplus line insurer, reinsurer, or its third-party service providers. The bill would require a contract between a licensee, surplus line insurer, or reinsurer and a third-party service provider to govern the processing and sharing of personal information performed on behalf of the licensee, surplus line insurer, or reinsurer. The bill would prohibit retaliation against a consumer because the consumer exercised or attempted to exercise their rights under the act. The bill would prohibit public disclosure of specified systems, processes, policies, procedures, and plans that are disclosed to the Insurance Commissioner. The bill would also make technical and conforming changes. This bill would authorize a penalty of at least $5,000, not to exceed $1,000,000 in the aggregate for multiple violations of the act. The bill would increase the fine if a cease and desist order is violated to at least $15,000 for each violation, and would increase a fine to at least $50,000 for each violation if the commissioner finds the violations to be a general business practice. Under the bill, a person who knowingly and willfully obtains information about a consumer from a licensee, surplus line insurer, reinsurer, or third-party service provider under false pretenses would be guilty of a misdemeanor, punishable by a fine of up to $50,000, imprisonment in a county jail for up to 6 months, or both, thus expanding the applicability of a crime and imposing a state-mandated local program. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. This bill would incorporate additional changes to Sections 791.07, 791.11, and 791.12 of the Insurance Code proposed by AB 1798 to be operative only if this bill and AB 1798 are enacted and this bill is enacted last. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
(1) The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury punishable as a misdemeanor. Existing law deems a business that offers a mental health digital service or reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a provider of health care subject to the requirements of the CMIA. The bill would additionally deem a business that offers a health care chatbot, as defined, to a consumer for the above-described purposes to be a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program. (2) Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information, as defined, to ensure that those communications include both a disclaimer that indicates to the patient that a communication was generated by generative artificial intelligence, as specified, and clear instructions describing how a patient may contact a human health care provider, employee, or other appropriate person, except as specified. This bill would require a health facility, clinic, physician's office, or office of a group practice to take reasonable steps to ensure that a licensed health care professional, acting within their scope of practice, retains the ability to exercise independent professional judgment in their care of a patient whenever that care is informed by the output of a clinical decision support system, as defined. The bill would prohibit a health facility, clinic, physician's office, or office of a group practice from using or deploying a tool, system, or device that includes artificial intelligence to independently perform any clinical function that is required by law to be performed by a person with a professional license. The bill would make a violation of these provisions by a physician subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. The bill would also authorize the appropriate professional licensing board to pursue an injunction or restraining order to enforce these provisions to the extent that a violation constitutes the practice of a health care profession without a license. The bill would specify that these provisions do not apply to the use of automated decision systems for documentation and communication that does not involve the application of professional judgment, including automated messages to inform patients of updates to their health records. (3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
