Bill Text: CA SB561 | 2019-2020 | Regular Session | Introduced

California Senate Bill 561 (Prior Session Legislation)

Introduced

Bill Title: California Consumer Privacy Act of 2018: consumer remedies.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Failed) 2020-02-03 - Returned to Secretary of Senate pursuant to Joint Rule 56. [SB561 Detail]

Download: California-2019-SB561-Introduced.html

CALIFORNIA LEGISLATURE— 2019–2020 REGULAR SESSION

Senate Bill

No. 561

Introduced by Senator Jackson

February 22, 2019

An act to amend Sections 1798.150 and 1798.155 of the Civil Code, relating to privacy.

LEGISLATIVE COUNSEL'S DIGEST

SB 561, as introduced, Jackson. California Consumer Privacy Act of 2018: consumer remedies.

(1) Existing law, the California Consumer Privacy Act of 2018, beginning on January 1, 2020, grants a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to know what personal information is collected by a business and to have information held by that business deleted, as specified. The act specifically authorizes a consumer whose nonencrypted or nonredacted personal information, as defined, is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business’s failure to maintain reasonable security procedures to institute a civil action for various damages.

This bill would expand a consumer’s rights to bring a civil action for damages to apply to other violations under the act.

(2) Under existing law, a business or third party may seek the opinion of the Attorney General for guidance on how to comply with the act.

This bill would instead specify that the Attorney General may publish materials that provide businesses and others with general guidance on how to comply with the act.

(3) Under existing law, a business, service provider, or other person that violates the act is subject to an injunction and is liable for a civil penalty for each violation, which is assessed and recovered in a civil action by the Attorney General. Existing law specifies that a business is in violation of the act if it fails to cure an alleged violation within 30 days after being notified of alleged noncompliance.

This bill would delete the 30-day period in which to cure after receiving notice of an alleged violation. The bill would also make related and conforming changes to those provisions.

Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO

The people of the State of California do enact as follows:

SECTION 1.

Section 1798.150 of the Civil Code is amended to read:

1798.150.

(a) (1) Any consumer whose rights under this title are violated, or whose nonencrypted or nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:

(A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred ~~and~~ fifty ($750) per consumer per incident or actual damages, whichever is greater.

(B) Injunctive or declaratory relief.

(2) In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant’s misconduct, and the defendant’s assets, liabilities, and net worth.

(b) Actions pursuant to this section may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated. In the event a cure is possible, if within the 30 days the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business. No notice shall be required prior to an individual consumer initiating an action solely for actual pecuniary damages suffered as a result of the alleged violations of this title. If a business continues to violate this title in breach of the express written statement provided to the consumer under this section, the consumer may initiate an action against the business to enforce the written statement and may pursue statutory damages for each breach of the express written statement, as well as any other violation of the title that postdates the written statement.

(c) ~~The cause of action established by this section shall apply only to violations as defined in subdivision (a) and shall not be based on violations of any other section of this title.~~ Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law. This shall not be construed to relieve any party from any duties or obligations imposed under other law or the United States or California Constitution.

SEC. 2.

Section 1798.155 of the Civil Code is amended to read:

1798.155.

(a) ~~Any business or third party may seek the opinion of the~~ The Attorney General ~~for~~ may publish materials that provide businesses and others with general guidance on how to comply with the provisions of this title.

(b) ~~A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance.~~ Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. ~~The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.~~

(c) Any civil penalty assessed for a violation of this title, and the proceeds of any settlement of an action brought pursuant to subdivision (b), shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160 with the intent to fully offset any costs incurred by the state courts and the Attorney General in connection with this title.