Existing law establishes the Office of Elections Cybersecurity within the Secretary of State's office to coordinate efforts between the Secretary of State and local elections officials to reduce the likelihood and severity of cyber incidents and to monitor and counteract false or misleading information regarding the electoral process. Existing law requires the Office of Elections Cybersecurity, among other things, to develop best practices for protecting against threats to election cybersecurity in consultation with federal, state, and local agencies and private organizations. This bill would also authorize the office to consult with academic researchers for that purpose. The bill would require the office to assess whether additional state resources are needed to replace election cybersecurity resources previously provided by the federal government.
Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill, beginning on July 1, 2027, would prohibit an employer, as defined, from using an ADS to perform certain functions and would limit the purposes for and way in which an ADS may be used. The bill would, when an employer primarily uses an ADS to make a disciplinary or termination decision, authorize an employee to request, and require an employer to provide, a description of the employee's own data primarily used by an ADS to make a disciplinary or termination decision, as specified. The bill would require an employer that primarily relied upon an ADS to make a disciplinary or termination decision to provide the affected employee with a written postuse notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any employee for taking certain actions asserting their rights under the bill. The bill would authorize the Labor Commissioner to enforce the bill's provisions and also authorize a public prosecutor to bring a civil enforcement action, as specified. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty per violation. This bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would provide that it does not prohibit the use of an automated decision system relating to the development of aircraft for use in the national airspace or the development of products or services for national security, military, space, or defense purposes, if the use of an automated decision system is reasonably necessary to comply with the federal statute, the federal regulation, or the binding federal contract, as specified. The bill would include a statement that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. This bill would declare that its provisions are severable.
(1) Existing law authorizes the operation of an autonomous vehicle on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle operated if specified requirements are satisfied. Existing law prohibits the operation of an autonomous vehicle on public roads until the manufacturer submits an application to the Department of Motor Vehicles (department) , as specified, and that application is approved. Existing law requires the department to adopt regulations setting forth requirements for the submission and approval of an application, including, among other things, any testing, equipment, and performance standards the department concludes are necessary to ensure the safe operation of autonomous vehicles on public roads, as specified. Existing law requires manufacturers of autonomous vehicles that operate without a human operator physically present in the vehicle, except as provided, to comply with certain requirements, including, among other things, to maintain a dedicated emergency response telephone line that is available for emergency response officials and to equip each autonomous vehicle with a 2-way voice communication device that enables emergency response officials who are near the vehicle to communicate effectively with a remote human operator, as specified. Under existing law, an "emergency response official" includes, but is not limited to, emergency dispatchers, peace officers, as specified, and first responders. This bill would require manufacturers of autonomous vehicles to maintain communications capacity sufficient to support the maximum number of concurrent remote assistance or teleoperations sessions, as specified. The bill would require remote drivers to be located within the United States and hold a driver's license that is valid for operation in California, is of the appropriate class, and includes any required endorsements. The bill would require an autonomous vehicle manufacturer to ensure, through its staffing and assignments, that local incident technicians are immediately dispatched upon notification, electronically or otherwise, of a crash or other incident or upon receiving a request from an emergency response official or 911 dispatch center. The bill would, in the event of a fleetwide emergency or system failure that may create a traffic hazard or impeded emergency response, require an autonomous vehicle manufacturer to immediately notify affected local jurisdictions, including emergency dispatch, of the location and status of their fleet and deploy local incident technicians, where appropriate, whenever affected vehicles cannot be remotely recovered. The bill would require the department, on or before July 1, 2028, to adopt guidelines establishing reasonable response times for local incident technicians to be present at the scene upon the request of an emergency response official or 911 dispatch center. The bill would expand the definition of "emergency response official" for these purposes to also include traffic control, traffic enforcement, and parking enforcement personnel from a public agency in an applicable jurisdiction. The bill would require autonomous vehicle manufacturers, for an autonomous vehicle that operates as a commercial vehicle and that is not equipped with manual controls for completing the dynamic driving task, to ensure that remote assistants or remote drivers have the ability to place the autonomous vehicle in neutral to allow an emergency response official to move the vehicle, cause the autonomous vehicle to move as directed by an emergency response official, or turn off the vehicle and have it remain stationary until otherwise directed by an emergency response official. The bill would require autonomous vehicle manufacturers to maintain data on response times of local incident technicians and responses to fleetwide emergencies or system failures, emergency events, immobilizations, obstructions, crashes, and requests from emergency response officials. The bill would require autonomous vehicle manufacturers to provide this data to the department quarterly and would require the department to publish summary statistics on its internet website, as specified. The bill would authorize the department to share records with the Public Utilities Commission to support regulatory oversight of autonomous vehicle passenger service operations. The bill would specify that a violation of the above provisions is not a crime. The bill would authorize a city attorney or county counsel to bring a civil action on behalf of a city, county, or city and county to enforce specified violations of the above provisions. The bill would authorize a court to impose specified civil penalties payable to the jurisdiction bringing the action, as specified. (2) Existing law establishes the Commission on Peace Officer Standards and Training (POST) within the Department of Justice and requires the commission to develop guidelines and implement courses of instruction regarding specified topics, including, among others, racial profiling, handling domestic violence, and human trafficking. This bill would require POST to develop uniform guidelines and requirements for, and to provide approval of, the training and written guidance required to be provided by autonomous vehicle manufacturers. The bill would authorize POST to impose fees sufficient to cover the reasonable regulatory costs associated with administering these provisions. The bill would require POST to implement a course or courses of instruction for voluntary training of law enforcement officers, as defined, on autonomous vehicles that operate as commercial vehicles as it relates to public safety and to develop related uniform minimum guidelines for voluntary use by California law enforcement agencies, as specified. The bill would require the course or courses, learning and performance objectives, training standards, and guidelines to be developed in consultation with appropriate groups and individuals that have an interest and expertise in the field of the operation of autonomous vehicles, as specified. (3) The bill would make its provisions operative July 1, 2028.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information, as defined, about the consumer to limit its use, as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, except as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law prohibits a person from using a bot, as defined, to mislead another person about the bot's artificial identity to incentivize the purchase or sale of goods or services, among other things. Existing law requires an operator of a companion chatbot, as defined, to provide a disclosure regarding the companion chatbot's artificial identity if a reasonable person interacting with the companion chatbot would be misled to believe that the person is interacting with a human. This bill would prohibit a large private business, as defined, from representing that a customer service chatbot is a human. The bill would also require the large private business to provide certain disclosures if a reasonable person interacting with the chatbot would be misled to believe they are interacting with a human. This bill would require a large private business to provide a customer service feature allowing customers to contact a customer service agent during its regular business hours, as defined. This bill would require, except as specified, large private businesses to make a good faith effort to connect a customer to an agent within 15 minutes after a request for human customer service is made, or schedule an appointment with the customer, as specified. For online chatbot customer service platforms and telephonic customer service platforms, the bill would require a large private business to make a good faith effort to limit initial and cumulative telephonic hold times, and would require certain large private businesses to post prescribed contact information on their internet website. The bill would authorize a public prosecutor to enforce these provisions, and would make a large private business that violates these provisions liable for a penalty of up to $5,000 for an initial violation, and $10,000 for each subsequent violation. The bill would waive its requirements due to unforeseen circumstances beyond the reasonable control of a large private business or extraordinary or emergency situations, and would exempt a large private business that provides services subject to, and is in compliance with, specified public utilities law. The bill would further exempt exclusive business lines and communications by a hospital, as specified, and a consumer reporting agency, as prescribed. The bill would define terms for these purposes.
Existing law establishes various healing arts boards within the Department of Consumer Affairs that license and regulate various healing arts licensees. Existing laws, including the Licensed Marriage and Family Therapist Act, the Educational Psychologist Practice Act, the Clinical Social Worker Practice Act, and the Licensed Professional Clinical Counselor Act, make a violation of those acts a crime. Existing law regulates the use of artificial intelligence, as defined. Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information to ensure those communications include a disclaimer that indicates to the patient that a communication was generated by artificial intelligence and instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. This bill would regulate the use of artificial intelligence in connection with providing or facilitating psychotherapy services, as defined. The bill, among other things, would authorize an individual, corporation, or entity that provides or facilitates psychotherapy services to use artificial intelligence tools or systems only to assist in providing administrative or supplementary support in psychotherapy services, as specified. The bill would prohibit an individual, corporation, or entity from using artificial intelligence to record or transcribe psychotherapeutic communications or sessions or to triage or screen a person for the need for psychotherapy services unless the patient or client or their authorized representative is informed that artificial intelligence will be used and the purpose of the artificial intelligence tool or system, and the patient or client or their authorized representative provides consent, as specified. The bill would prohibit an individual, corporation, or entity from advertising or otherwise purporting to offer psychotherapy services when the services are provided through the use of companion chatbots. The bill would prohibit an individual, corporation, or entity from allowing artificial intelligence to perform certain acts, including making therapeutic decisions or detecting emotions or mental states, as specified, without review and approval by a licensed professional. The bill would make a violation of the bill's provisions subject to the jurisdiction of the appropriate health care professional licensing board or enforcement agency, as specified, and would authorize those boards and enforcement entities to pursue any remedies authorized by law. Existing law, the Confidentiality of Medical Information Act, generally restricts the persons and entities to whom, and the purposes for which, a health care provider, health care service plan, or contractor may release a patient's medical information. The Confidentiality of Medical Information Act additionally imposes certain disclosure requirements for the release of medical information that specifically relates to the patient's participation in outpatient treatment with a psychotherapist. In this regard, the act prohibits a health care provider, health care service plan, or contractor from releasing that information to persons or entities who have requested that information and who are otherwise authorized by specified laws to receive that information, unless the requester makes certain written disclosures to the patient and to the provider of health care, health care service plan, or contractor, as specified. Those disclosures include, among other things, the specific intended uses of the information, and the length of time during which the information will be kept before being destroyed or disposed of, as specified. Existing law makes a violation of those provisions that result in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would require the use of artificial intelligence in patient or client records for psychotherapy services to comply with the confidentiality requirements of the above-described provision of the Confidentiality of Medical Information Act and would prohibit a company or entity from sharing, selling, storing, or training their models on any data obtained from psychotherapy in a manner inconsistent with any applicable law. By expanding the scope of existing crimes, the bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Under existing law, a county elections official is required to prepare a certified statement of the results of an election and submit it to the county board of supervisors within 30 days of the election. This bill would make it a felony, punishable by imprisonment for 16 months or 2 or 3 years, to seize or cause or assist in the seizure of ballots, election records, or certified voting technology before election results are certified by the elections official. The bill would also make it a felony punishable by imprisonment for 2, 3, or 4 years for any person with authority to direct another person subject to their supervision or authority to seize ballots, election records, or certified voting technology before election results are certified. By creating new crimes, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute.
The California Fair Employment and Housing Act establishes the Civil Rights Department within the Business, Consumer Services, and Housing Agency and requires the department to, among other things, bring civil actions to enforce the act. Existing law requires, on or before September 1, 2024, the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. This bill would generally regulate the development and deployment of an automated decision system (ADS) used to make consequential decisions, as defined. The bill would define "automated decision system" to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is designed or used to assist or replace human discretionary decisionmaking and materially impacts natural persons. This bill would require a developer of a covered ADS, as defined, to take certain actions, including providing a potential deployer instructions explaining how the covered ADS should be used by the deployer to make or facilitate a consequential decision. This bill would require a deployer of a covered ADS to take certain actions, including provide certain disclosures to a subject of a consequential decision made or facilitated by the covered ADS that results in an adverse outcome, as defined, and provide the subject with an opportunity to appeal the outcome of the consequential decision, as prescribed. This bill would authorize the Attorney General to bring a specified civil action for noncompliance.
Existing law makes it a misdemeanor for any person having charge of a completed vote by mail ballot to interfere with a ballot's return to the local elections official. This bill would additionally make it a misdemeanor for any person having charge of a vote by mail ballot to interfere, as defined, with a ballot's delivery to a voter. The bill would make it a felony for a person with authority to direct one or more persons subject to their supervision or authority to interfere with a ballot's return to the local elections official or delivery to a voter. By expanding the scope of an existing crime, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute.
Existing law generally regulates classes of insurance, including life and disability insurance. Existing law prohibits an insurer from requiring a test for the presence of a genetic characteristic for the purpose of determining insurability, except as specified. If an insurer requests an applicant to take a genetic characteristic test, existing law requires the insurer to obtain the applicant's written informed consent and to notify the applicant of the test result. Existing law prohibits a life or disability income insurer from requiring a genetic characteristic test if the results of the test would be used to determine eligibility for specified health care coverage. Existing law prescribes civil penalties for an insurer who discloses the results of a test for a genetic characteristic requested by the insurer. This bill would repeal those provisions and would instead prohibit a life or disability insurer from canceling, limiting, or denying coverage, among other actions, based on a test for the presence or absence of a genetic characteristic. The bill would authorize a life or disability insurer to base an underwriting decision on a test for the presence or absence of a genetic characteristic if specified criteria are met. The bill would, except as provided, prohibit a life or disability insurer from requiring, requesting, or soliciting genetic information, using genetic test results, or considering a person's decisions or actions relating to genetic testing in any manner for an insurance purpose. The bill would additionally impose civil penalties for the use of genetic information or genetic characteristics in a manner inconsistent with these provisions, as specified, and other civil penalties for any violation of these provisions. The bill would also prohibit the use or disclosure of an individual's full genome. Existing law, the Insurance Information and Privacy Protection Act, prohibits an insurance institution, agent, or insurance-support organization from seeking specified information in connection with an insurance transaction or preparing or requesting an investigative consumer report about an individual for an insurance application, except as specified. Existing law prohibits an insurance institution or agent from basing an adverse underwriting decision on specified information. Existing law prohibits an insurance institution, agent, or insurance-support organization from utilizing a form or statement that authorizes disclosure of personal or privileged information as its disclosure form, unless the form or statement meets specified criteria. This bill would prohibit an insurance institution, agent, or insurance-support organization from seeking information in connection with an insurance transaction concerning, or prohibit an insurance institution or agent from basing an adverse underwriting decision on, an individual's genetic information or full genome, unless specified criteria are met. The bill would prohibit an insurance institution, agent, or insurance-support organization from preparing or requesting an investigative consumer report that seeks an individual's genetic information or full genome. This bill would state the intent of the Legislature that, notwithstanding any other law, these provisions shall not be interpreted to authorize the use or disclosure of an individual's full genome. This bill would incorporate additional changes to Sections 791.07, 791.11, and 791.12 of the Insurance Code proposed by SB 354 to be operative only if this bill and SB 354 are enacted and this bill is enacted last.
