Bill Text: CA AB886 | 2015-2016 | Regular Session | Amended
Bill Title: Transportation service network provider: passenger privacy.
Sponsorship: Partisan Bill (Democrat 1)
Status: (Failed) 2016-02-01 - From committee: Filed with the Chief Clerk pursuant to Joint Rule 56. [AB886 Detail]
Download: California-2015-AB886-Amended.html
BILL NUMBER: AB 886 AMENDED
BILL TEXT
AMENDED IN ASSEMBLY JANUARY 4, 2016
AMENDED IN ASSEMBLY MARCH 26, 2015
INTRODUCED BY Assembly Member Chau
FEBRUARY 26, 2015
An act to amend Section Sections 5431 and
5437 of , and to add Section 5437.5 to, the
Public Utilities Code, relating to transportation.
LEGISLATIVE COUNSEL'S DIGEST
AB 886, as amended, Chau. Transportation service network provider:
passenger privacy.
The Passenger Charter-Party Carriers' Act prohibits a
transportation network company from disclosing personally
identifiable information of a passenger, except as provided
with certain exceptions, including when the passenger
knowingly consents or pursuant to a legal obligation . A
violation of the act is a crime.
This bill would prohibit a transportation service network
provider, as defined, from requesting or requiring personally
identifiable data, as defined, of a passenger unless the information
is used for certain purposes, including establishing, maintaining,
and updating a customer's account. The bill would require the
transportation service network provider to provide an accountholder
with an opportunity to cancel or terminate an account. The bill would
require a transportation service network provider to destroy or
dispose of all personally identifiable data in a secure manner when
the information is no longer needed for the purposes for which it was
collected or when an accountholder cancels or terminates his or her
account. Because a violation of these provisions would be a crime,
this bill would impose a state-mandated local program.
This bill would modify the knowing consent exception to the
prohibition against disclosure of personally identifiable information
by requiring the affirmative consent of a passenger through an
opt-in selection that is separate from and not conditioned on various
other transactions between the passenger and the transportation
network company. The bill would modify the legal obligation exception
to the prohibition against disclosure of personally identifiable
information by instead providing for disclosure pursuant to law,
regulation, or court order. The bill would define personally
identifiable information. By changing the definition of a crime, this
bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that no reimbursement is required by this
act for a specified reason.
Vote: majority. Appropriation: no. Fiscal committee: yes.
State-mandated local program: yes.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 5431 of the Public
Utilities Code is amen ded to read:
5431. (a) As used in this article, a "transportation network
company" is an organization, including, but not limited to, a
corporation, limited liability company, partnership, sole proprietor,
or any other entity, operating in California that provides
prearranged transportation services for compensation using an
online-enabled application or platform to connect passengers with
drivers using a personal vehicle.
(b) As used in this article, "participating driver" or "driver" is
any person who uses a vehicle in connection with a transportation
network company's online-enabled application or platform to connect
with passengers.
(c) As used in this article, "transportation network company
insurance" is a liability insurance policy that specifically covers
liabilities arising from a driver's use of a vehicle in connection
with a transportation network company's online-enabled application or
platform.
(d) As used in this article, "personally identifiable information,"
with respect to a transportation network company passenger, shall
include electronic communication information, as defined by
subdivision (d) of Section 1546 of the Penal Code, electronic device
information, as defined by subdivision (g) of Section 1546 of the
Penal Code, and subscriber information, as defined by subdivision (l)
of Section 1546 of the Penal Code, and the social security number,
physical characteristics, or financial information of the passenger.
SECTION 1. SEC. 2. Section 5437 of
the Public Utilities Code is amended to read:
5437. (a) A transportation network company shall not disclose to
a third party any personally identifiable information of a
transportation network company passenger unless one of the following
applies:
(1) The customer knowingly consents.
passenger affirmatively consents through an opt-in selection. Consent
shall be distinct from any transaction or service provided, and
shall be acquired in a format that is separate from the financial
transaction for services. Consent shall not be required by the
transportation network company as a co ndition of
accepting or processing a transaction, as a condition of
creating a user account, if a user account is required by the
transportation network company, or as a condition of downloading or
installing a mobile application.
(2) Pursuant to a legal obligation. law,
regulation, or court order.
(3) The disclosure is to the commission in order to investigate a
complaint filed with the commission against a transportation network
company or a participating driver and the commission treats the
information under confidentiality protections.
(b) This section does not apply to personally identifiable
information of a transportation network passenger collected pursuant
to Section 5437.5.
(b) Nothing in this section shall prohibit a transportation
network company from sharing any personally identifiable information
of a transportation network company passenger for the detection,
investigation, or prevention of fraud, theft, identity theft, or
other criminal activity if the personally identifiable information is
used solely for those purposes by recipients of the personally
identifiable information.
SEC. 2. Section 5437.5 is added to the Public
Utilities Code, to read:
5437.5. (a) For purposes of this section, the following terms
mean the following:
(1) "Personally identifiable data" means any of the following:
(A) Information that identifies, relates to, describes, or is
capable of being associated with, a particular individual, including,
but not limited to, his or her name, signature, social security
number, physical characteristics, address, email address, telephone
number, bank account number, credit card number, debit card number,
or any other financial information.
(B) Information describing or concerning the duration of the
transportation service provided, the location and route of the
service provided, and the monetary exchange associated with the
service provided.
(C) Information relating to the mobile device or computer used to
arrange transportation related services, including Internet protocol
address (MAC), media access control address, device applications, and
geolocational information.
(2) "Transportation service network provider" means any
corporation, limited liability company, partnership, sole proprietor,
or any other entity, operating in California, including,
notwithstanding Section 5353, any entity that provides taxicab
transportation services, that provides prearranged transportation
service for compensation using an online-enabled application or
platform to connect to passengers.
(b) (1) When rendering transportation services, a transportation
service network provider shall not request or require any personally
identifiable data of a passenger or accountholder unless the
information is required to complete a transaction for the
transportation service being provided or for the detection,
investigation, or prevention of fraud, identity and other theft, or
other criminal activity, and the personally identifiable data is used
solely for those purposes.
(2) The transportation service network provider shall not disclose
any personally identifiable data collected pursuant to this
subdivision to any other person, firm, partnership, association, or
corporation unless it is required to do so by state or federal law,
or is contractually obligated to share the information with a
financial entity to complete the transaction, or for the detection,
investigation, or prevention of fraud, identity or other theft, or
other criminal activity.
(c) (1) A transportation service network provider may request or
require a consumer to establish an account as a condition of the
transportation service and may require a customer to provide
personally identifiable data to establish, maintain, and update the
account if the information collected is used solely for those
purposes.
(2) A transportation service network provider shall provide an
accountholder with an opportunity to cancel or terminate the account
at which time the transportation service network provider shall
destroy or dispose of all personally identifiable data it required
for the account in a secure manner.
(d) A transportation service network provider shall destroy or
dispose of all personally identifiable data it acquires pursuant to
this section in a secure manner after the information is no longer
needed for the purposes authorized under this section.
(e) (1) A transportation service network provider that violates
this section shall be subject to a civil penalty not to exceed two
hundred fifty dollars ($250) for the first violation and one thousand
dollars ($1,000) for each subsequent violation.
(2) The civil penalty shall be assessed and collected in a civil
action brought by any aggrieved person, the Attorney General, or by a
district attorney or city attorney of the jurisdiction in which an
aggrieved person resides.
(3) The court shall direct the recovery of full costs, including
attorneys' fees, to the prevailing party.
(f) (1) The Attorney General, or district attorney or city
attorney with appropriate jurisdiction, may bring an action in the
superior court in the name of the People of the State of California
to enjoin a violation of this section.
(2) Upon notice of not less than five days to a transportation
service network provider, the Attorney General, district attorney, or
city attorney may seek to temporarily restrain and preliminary
enjoin a violation of this section.
(3) If the court determines that the transportation service
network provider has violated this section, the court may restrain or
enjoin the violation without requiring proof that any person has
been damaged by the violation.
(4) In an action brought pursuant to this subdivision, if the
court finds that a transportation service network provider has
violated this section, the court may direct the transportation
service network provider to pay the costs incurred by the Attorney
General, district attorney, or city attorney.
(g) The court may consolidate an action for the assessment and
collection of civil penalties with an action for injunctive relief
brought pursuant to subdivision (f).
SEC. 3. No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution because
the only costs that may be incurred by a local agency or school
district will be incurred because this act creates a new crime or
infraction, eliminates a crime or infraction, or changes the penalty
for a crime or infraction, within the meaning of Section 17556 of the
Government Code, or changes the definition of a crime within the
meaning of Section 6 of Article XIII B of the California
Constitution.
