Under existing law, the residence address, telephone number, and email address of a registered voter is confidential, except that under certain circumstances a county elections official must provide that information to any candidate for federal, state, or local office, to any committee for or against any initiative or referendum measure, and to any person for election, scholarly, journalistic, political, or governmental purposes. This bill would exempt the residence address, telephone number, and email address of a federal, state, or local elected official or candidate from that disclosure requirement, except that the information may be disclosed for journalistic or governmental purposes under specified conditions. The bill would require the Secretary of State to provide each county elections official with a list identifying each federal and state elected official or candidate residing in the county, require the county elections official to add each local elected official or candidate to that list, and require the county elections official to make the elected official or candidate's information confidential within 5 business days. The bill would require the county elections official to exclude the elected official or candidate's confidential information when producing any list, roster, or index. The bill would require an elected official or candidate to contact their county elections official to ensure their voter registration record has been made confidential. The bill would authorize an elected official or candidate to opt out of making their residence address, telephone number, and email address confidential. By adding new duties for county elections officials, this bill would create a state-mandated local program. This bill would incorporate additional changes to Section 2194 of the Elections Code proposed by AB 827 to be operative only if this bill and AB 827 are enacted and this bill is enacted last. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law requires the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center. Existing law states that the center's mission is to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. Existing law requires the center to serve as the central organizing hub of state government's cybersecurity activities and coordinate information sharing with specified entities, including local, state, and federal agencies. This bill would require the California Cybersecurity Integration Center to develop, on or before January 1, 2027, in consultation with the Office of Information Security and the Government Operations Agency, a California AI Cybersecurity Collaboration Playbook, as specified, to facilitate information sharing across the cyber and artificial intelligence communities and to strengthen collective cyber defenses against emerging threats. The bill would require the center to review federal requirements, standards, and industry best practices, as specified, and to use those resources to inform the development of the California AI Cybersecurity Collaboration Playbook. Except as specified, the bill would provide that any information related to cyber threat indicators or defensive measures for a cybersecurity purpose shared in accordance with the California AI Cybersecurity Collaboration Playbook is confidential and would prohibit that information from being disclosed, except as specified. The bill would also make findings and declarations related to its provisions. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
The California Consumer Financial Protection Law requires the Commissioner of Financial Protection and Innovation to prepare and publish on the Department of Financial Protection and Innovation's internet website an annual report detailing actions taken during the prior year under the law and requires the report to include information on actions taken with respect to, among other things, the activities of the Financial Technology Innovation Office. This bill would additionally require the report to include information on actions taken with respect to the Office of the Ombuds.
Existing law authorizes the operation of an autonomous vehicle on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle operated if specified requirements are satisfied. Existing law prohibits the operation of an autonomous vehicle on public roads until the manufacturer submits an application to the Department of Motor Vehicles, as specified, and that application is approved. A violation of the Vehicle Code or a local ordinance adopted pursuant to that code is an infraction. This bill would prohibit the delivery of commercial goods, as defined, directly to a residence or to a business for its use or retail sale through the operation of an autonomous vehicle without a human safety operator on any highway within the State of California. The bill would make a first violation of this provision subject to a $10,000 administrative fine and a $25,000 administrative fine for subsequent violations. The bill would authorize the department to suspend or revoke the permit of an autonomous vehicle manufacturer for repeated violations of this provision. The bill would require the department to submit a report to the Legislature evaluating the performance of autonomous vehicle technology and its impact on public safety and employment, as specified. This bill would require all relevant state agencies, including, among others, the Department of Transportation and the State Air Resources Board, to provide information to the department to research this report. The bill would prohibit the department from issuing a deployment permit for the use of an autonomous vehicle to deliver commercial goods without a human safety operator until a later enacted statute authorizes the issuance of a permit for that purpose. The bill would also make certain findings and declarations related to these provisions.
Existing law generally regulates artificial intelligence, including by requiring the Office of Emergency Services to, as appropriate, perform a risk analysis of potential threats posed by the use of generative artificial intelligence to California's critical infrastructure, including those that could lead to mass casualty events. This bill would require the Attorney General to establish and maintain a specified program to build internal expertise in artificial intelligence, including its applications, risks, regulatory implications, and civil rights impacts. The bill would require, on or before July 1, 2027, and annually thereafter, the Attorney General to submit a public report to the Legislature describing the program, key developments in artificial intelligence law and policy, and recommendations for additional state oversight or safeguards.
Existing law makes it unlawful for any person to use a bot to communicate or interact with another person in this state online with the intent to mislead the other person about its artificial identity for the purposes of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person using the bot discloses that it is a bot. Existing law defines a "bot" as an automated online account where all or substantially all of the actions or posts of that account are not the result of a person. This bill would require a person who uses a bot to autonomously communicate with another to ensure that the bot discloses to any person with whom the bot communicates when the bot first communicates with the person that the bot is a bot and not a human being, answers truthfully any query from a person regarding its identity as a bot or a human, and refrains from attempting to mislead a person regarding its identity as a bot. The bill would redefine "bot" to mean an automated online account or application that a reasonable person could believe is a human being and with respect to which substantially all of the actions or posts of that account or application are the outputs of generative artificial intelligence, as defined. The bill would exempt from its provisions a person who uses a bot that is required to comply with a more prescriptive disclosure scheme. This bill would authorize the Attorney General, a district attorney, a county counsel, a city attorney, or a city prosecutor to bring a civil action to punish noncompliance, as prescribed.
Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified. This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office's chief to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature's intent that the bill's provisions be implemented in a manner consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.
Existing law creates the California Computer Science Coordinator as a position within the State Department of Education to provide statewide coordination in, among other things, implementing the computer science content standards and leading the implementation of the Computer Science Strategic Implementation Plan, as provided. This bill would establish the California Computer Science Demonstration Grant Program for specified purposes, including increasing the number of public high schools offering a computer science course to increase pupil access to computer science education and increasing the computer science course access of pupils eligible for free or reduced-priced meals and pupils that are underrepresented in the field of computer science. The bill would also establish the California Computer Science Demonstration Grant Program Working Group that includes the coordinator and nonprofit organizations and private industry stakeholders with relevant expertise and experience in computer science education. The bill would authorize only public high schools that do not offer computer science courses to be eligible to voluntarily participate in the grant program. The bill would require the funding entity or funding entities, as defined, to administer the grant program. If there are multiple funding entities, the bill, among other things, would require each funding entity to determine how the funds that it contributes to the grant program will be spent, provided that expenditure aligns with the grant program's purposes, and require the funding entities to coordinate implementation of the grant program. The bill would require the funding entities, in coordination with the working group, to select the public high schools to participate in the grant program, as provided. The bill would require the grant program to be funded through contributions, gifts, grants, in-kind donations, and donations from the funding entity or funding entities, and would specify the allowable uses of those funds. The bill would require the funding entity or funding entities, in coordination with the working group, to evaluate the effectiveness of the grant program and submit an interim report to certain legislative committees on or before August 1, 2027, and a final report on or before July 1, 2028, as specified. The bill would repeal the grant program's provisions as of January 1, 2029. The bill would separately require the department, on or before June 30, 2028, and annually thereafter, to publicly post specified computer science course-related data on its internet website, as specified.
Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions. Existing law authorizes a government entity to access electronic device information by means of physical interaction or electronic communication with the device in certain circumstances, including, pursuant to the specific consent of the authorized possessor of the device or if the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to a person requires access to the information. Existing law requires a government entity that obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, within 3 court days after obtaining the electronic information, to file with the appropriate court an application for a warrant or order setting forth the facts giving rise to the emergency. Existing law requires the court to promptly rule on the application and to destroy all information obtained upon a finding that the facts did not give rise to an emergency or upon rejecting the application on any other ground. This bill would additionally authorize a government entity to access electronic device information with the specific consent of an individual who locates a tracking or surveillance device, as defined, and the device is reasonably believed to have been used to track or record the individual without their permission. The bill would require a government entity that obtains information through this method, within 3 court days after obtaining the electronic information, to follow the above process for applying for a warrant or order from a court by setting forth the facts that describe the circumstances and would require the court to promptly rule on the application and order the immediate destruction of all information obtained upon a finding that the facts were not as described. Existing law authorizes an individual whose information is targeted by a warrant, order, or other legal process, or other specified recipients of a warrant, that is inconsistent with the act or the California or United States Constitution, to petition the issuing court to void or modify the warrant, order, or process, or to order the destruction of any information obtained in violation of the act or the California or United States Constitution. This bill would recast the provisions described above to authorize an individual whose information is sought or obtained by a government entity in a manner that is inconsistent with the act or the California or United States Constitution, or other specified recipients of a warrant, order, legal process, request, or demand seeking the individual's information, to petition a court to void or modify the warrant, order, other legal process, request, or demand to order the destruction of the information.
