AB1337 - Information Practices Act of 1977.

Amended IN Senate June 01, 2026 Amended IN Assembly May 23, 2025 Amended IN Assembly April 08, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1337 Introduced by Assembly Member Ward February 21, 2025 An act to amend amend, repeal, and add Sections 1798.3, 1798.16, 1798.17, 1798.19, 1798.20, 1798.24, 1798.24b, 1798.25, 1798.26, 1798.27, 1798.29, 1798.44, 1798.55, 1798.57, and 1798.68 of the Civil Code, relating to information privacy. LEGISLATIVE COUNSEL'S DIGEST AB 1337, as amended, Ward. Information Practices Act of 1977. Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. Existing law exempts from the provisions of the act counties, cities, any city and county, school districts, municipal corporations, districts, political subdivisions, and other local public agencies, as specified. This bill would would, beginning January 1, 2028, recast those provisions to, among other things, remove that exemption for local agencies, and would revise and expand the definition of “personal information.” The bill would make other technical, nonsubstantive, and conforming changes. Because the bill would expand the duties of local officials, this bill would impose a state-mandated local program. Existing law requires an agency to provide on or with any form used to collect personal information from individuals an initial notice that includes specified information, followed by a periodic notice of not more than one-year intervals, as provided. This bill would make changes to that notice requirement, including requiring periodic notice at least once every three years. Existing law requires an agency to establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information and instruct those persons with respect to specified rules relevant to the act. This bill would provide that the above-described rules of conduct shall be subject to any limitations or conditions set forth in any applicable collective bargaining agreement, and would prohibit an agency from using records containing personal information for any purpose or purposes other than the purpose or purposes for which that personal information was collected, except as required or authorized by state or local law. Existing law prohibits an agency from disclosing any personal information in a manner that would link the information disclosed to the individual to whom it pertains, except under specified circumstances. This bill would revise the circumstances that may allow the disclosure of personal information in a manner that could link the information disclosed to the individual to whom it pertains, including by authorizing disclosure for specified purposes related to real property, social safety net programs, and medical information, and would make conforming changes. Existing law makes an intentional violation of any provision of the act, or of any rules or regulations adopted under the act, by an officer or employee of any agency a cause for discipline, including termination of employment. This bill would also make a negligent violation of the act a cause for discipline. Existing law provides that the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of the act, that is not otherwise permitted by law, is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains. This bill would remove the requirement that the wrongful disclosure result in economic loss or personal injury. Because the bill would expand the scope of an existing crime by deleting this condition, the bill would impose a state-mandated local program. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason. With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Section 1798.3 of the Civil Code is amended to read: 1798.3. As used in this chapter: (a) (1) The term “personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular is maintained by an agency that identifies or describes an individual, including, but not limited to, all of the following: the individual’s name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual. (A) Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier. (B) Vehicle registration information, including license plate numbers. (C) The contents of an individual’s mail, email, and text messages unless the agency is the intended recipient of the communication. (D) Characteristics of protected classifications. (E) Racial or ethnic origin, citizenship or immigration status, religious beliefs, political positions or affiliations, or union membership. (F) Biometric information. (G) Genetic data. (H) Precise geolocation data. (I) Audio, electronic, visual, thermal, olfactory, or similar information. (J) Insurance policy numbers. (K) Neural data. (L) Information concerning an individual’s health. (M) Information concerning an individual’s gender, sex life, or sexual orientation. (2) “Personal information” may exist in various formats, including, but not limited to, all of the following: (A) Physical formats, including paper documents, printed images, vinyl records, or videotapes. (B) Digital formats, including text, image, audio, or video files. (C) Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information. (b) The term “agency” means every state and local office, officer, department, division, bureau, board, commission, or other state agency, except that the term agency shall not include: (1) The California Legislature. (2) Any agency established under Article VI of the California Constitution. (3) The State Compensation Insurance Fund, except as to any records that contain personal information about the employees of the State Compensation Insurance Fund. (4) A local agency, as defined in Section 7920.510 of the Government Code. (c) The term “disclose” means to disclose, release, transfer, disseminate, or otherwise communicate all or any part of any record orally, in writing, or by electronic or any other means to any person or entity. (d) The term “individual” means a natural person. (e) The term “maintain” includes maintain, acquire, use, or disclose. (f) The term “person” means any natural person, corporation, partnership, limited liability company, firm, or association. (g) The term “record” means any file or grouping of personal information about an individual that is maintained by an agency. agency by reference to an identifying particular such as the individual’s name, photograph, finger or voice print, or a number or symbol assigned to the individual. (h) The term “system of records” means one or more records, which pertain to one or more individuals, which is maintained by any agency, from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual. (i) The term “governmental entity,” except as used in Section 1798.26, means any branch of the federal government or of the local government. (h) (j) The term “commercial purpose” means any purpose that has financial gain as a major objective. It does not include the gathering or dissemination of newsworthy facts by a publisher or broadcaster. (i) (k) The term “regulatory agency” means the Department of Financial Protection and Innovation, the Department of Insurance, the Bureau of Real Estate, and agencies of the United States or of any other state responsible for regulating financial institutions. (j) The term “precise geolocation data” means any data that is derived from a device and that is used or intended to be used to locate an individual within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. (k) The term “neural data” means information that is generated by measuring the activity of an individual’s central or peripheral nervous system, and that is not inferred from nonneural information. (l) This section shall remain in effect only until January 1, 2028, and as of that date is repealed. SEC. 2. Section 1798.3 is added to the Civil Code, to read: 1798.3. As used in this chapter: (a) (1) The term “personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, all of the following: (A) Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier. (B) Vehicle registration information, including license plate numbers. (C) The contents of an individual’s mail, email, and text messages unless the agency is the intended recipient of the communication. (D) Characteristics of protected classifications. (E) Racial or ethnic origin, citizenship or immigration status, religious beliefs, political positions or affiliations, or union membership. (F) Biometric information. (G) Genetic data. (H) Precise geolocation data. (I) Audio, electronic, visual, thermal, olfactory, or similar information. (J) Insurance policy numbers. (K) Neural data. (L) Information concerning an individual’s health. (M) Information concerning an individual’s gender, sex life, or sexual orientation. (2) “Personal information” may exist in various formats, including, but not limited to, all of the following: (A) Physical formats, including paper documents, printed images, vinyl records, or videotapes. (B) Digital formats, including text, image, audio, or video files. (C) Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information. (b) The term “agency” means every state and local office, officer, department, division, bureau, board, commission, or other state agency, except that the term agency shall not include: (1) The California Legislature. (2) Any agency established under Article VI of the California Constitution. (3) The State Compensation Insurance Fund, except as to any records that contain personal information about the employees of the State Compensation Insurance Fund. (c) The term “disclose” means to disclose, release, transfer, disseminate, or otherwise communicate all or any part of any record orally, in writing, or by electronic or any other means to any person or entity. (d) The term “individual” means a natural person. (e) The term “maintain” includes maintain, acquire, use, or disclose. (f) The term “person” means any natural person, corporation, partnership, limited liability company, firm, or association. (g) The term “record” means any file or grouping of personal information that is maintained by an agency. (h) The term “commercial purpose” means any purpose that has financial gain as a major objective. It does not include the gathering or dissemination of newsworthy facts by a publisher or broadcaster. (i) The term “regulatory agency” means the Department of Financial Protection and Innovation, the Department of Insurance, the Bureau of Real Estate, and agencies of the United States or of any other state responsible for regulating financial institutions. (j) The term “precise geolocation data” means any data that is derived from a device and that is used or intended to be used to locate an individual within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. (k) The term “neural data” means information that is generated by measuring the activity of an individual’s central or peripheral nervous system, and that is not inferred from nonneural information. (l) This section shall become operative on January 1, 2028. SEC. 2. SEC. 3. Section 1798.16 of the Civil Code is amended to read: 1798.16. (a) Whenever an agency collects personal information, the agency shall maintain the source or sources of the information, unless the source is the data subject or has received a copy of the source document, including, but not limited to, the name of any source who is an individual acting in their own private or individual capacity. If the source is an agency, branch of the federal government, governmental entity, or other organization, such as a corporation or association, this requirement can be met by maintaining the name of the agency, branch of the federal government, governmental entity, or organization, as long as the smallest reasonably identifiable unit of that agency, branch of the federal government, governmental entity, or organization is named. (b) On or after July 1, 2001, unless otherwise authorized by the Department of Information Technology pursuant to Executive Order No. D-3-99, whenever an agency electronically collects personal information, as defined by Section 11015.5 of the Government Code, the agency shall retain the source or sources or any intermediate form of the information, if either are created or possessed by the agency, unless the source is the data subject that has requested that the information be discarded or the data subject has received a copy of the source document. (c) The agency shall maintain the source or sources of the information in a readily accessible form so as [Text truncated for display. Full text available on Congress.gov.]