Bill Text: CA SB1395 | 2021-2022 | Regular Session | Amended
Bill Title: California Defense Community Infrastructure Program.
Spectrum: Partisan Bill (Republican 9-0)
Status: (Introduced - Dead) 2022-05-19 - May 19 hearing: Held in committee and under submission. [SB1395 Detail]
Download: California-2021-SB1395-Amended.html
Amended
IN
Senate
March 16, 2022 |
Introduced by Senator Bates |
February 18, 2022 |
LEGISLATIVE COUNSEL'S DIGEST
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020 (CPRA of 2020), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would make nonsubstantive changes to the provision regarding the deletion of personal information described above, as reenacted and amended by the CPRA of 2020.
Digest Key
Vote:Bill Text
The people of the State of California do enact as follows:
SECTION 1.
Article 5.5 (commencing with Section 65052) is added to Chapter 1.5 of Division 1 of Title 7 of the Government Code, to read:Article 5.5. California Defense Community Infrastructure Program
65052.
(a) The California Defense Community Infrastructure Program is hereby established and shall be administered by the office in accordance with this article.65052.1.
The office, with input and assistance from the Governor’s Military Council, shall grant funds to local agencies for all of the following purposes:65052.2.
(a) In establishing eligibility criteria for awarding funds, the office shall use project criteria similar to the project criteria used for the federal Defense Community Infrastructure Program (10 U.S.C. Sec. 2391).65052.3.
(a) The Military Council shall rank proposed projects based on criteria established by the program and shall forward those recommendations to the office to award grants based on the funds available.65052.4.
The office may, upon approval by the Department of Finance, award grants pursuant to this article without regard to fiscal year only for the purposes specified in this article.65052.5.
The sum of fifty million dollars ($50,000,000) is hereby appropriated from the General Fund to the office for purposes of the program. Any funds remaining unencumbered after three years shall revert to the General Fund.Consumers’ Right to Delete Personal Information
(a)A consumer shall have the right to request that a business delete personal information about the consumer that the business has collected from the consumer.
(b)A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s rights to request the deletion of the consumer’s personal information.
(c)(1)A business that receives a verifiable consumer request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records, notify any service providers or contractors to delete the consumer’s personal information from their records, and notify all third parties to whom the business has sold or shared the personal information to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort.
(2)The business may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a consumer who has submitted a deletion request from being sold, for compliance with laws or for other purposes, solely to the extent permissible under this title.
(3)A service provider or contractor shall cooperate with the business in responding to a verifiable consumer request, and at the direction of the business, shall delete, or enable the business to delete and shall notify any of its own service providers or contractors to delete personal information about the consumer collected, used, processed, or retained by the service provider or the contractor. The service provider or contractor shall notify any service providers, contractors, or third parties who may have accessed personal information from or through the service provider or contractor, unless the information was accessed at the direction of the business, to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort. A service provider or contractor shall not be required to comply with a deletion request submitted by the consumer directly to the service provider or contractor to the extent that
the service provider or contractor has collected, used, processed, or retained the consumer’s personal information in its role as a service provider or contractor to the business.
(d)A business, or a service provider or contractor acting pursuant to its contract with the business, another service provider, or another contractor, shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is reasonably necessary for the business, service provider, or contractor to maintain the consumer’s personal information in order to do any of the following:
(1)Complete the transaction for which the personal information was collected, fulfill the terms
of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business’ ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.
(2)Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
(3)Debug to identify and repair errors that impair existing intended functionality.
(4)Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
(5)Comply with the
California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
(6)Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.
(7)Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the
consumer provided the information.
(8)Comply with a legal obligation.