AB2021 - California Consumer Privacy Act of 2018: whistleblower complaints.

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 2021 Introduced by Assembly Member Schiavo February 17, 2026 An act to amend Sections 1798.155, 1798.160, and 1798.199.55 of, and to add Sections 1798.141, 1798.199.101, 1798.199.102, 1798.199.103, 1798.199.104, and 1798.199.105 to, the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGEST AB 2021, as introduced, Schiavo. California Consumer Privacy Act of 2018: whistleblower complaints. The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The CCPA law makes a business, service provider, contractor, or other person that violates the CCPA liable for an administrative fine, as provided. The CCPA creates the Consumer Privacy Fund in the State Treasury and makes moneys in the fund available upon appropriation by the Legislature. Existing law requires 95% of any administrative fine assessed, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Subfund, which is created within the Consumer Privacy Fund. The CCPA law requires the funds to be used exclusively by the agency in carrying out its duties under the CCPA. The CCPA requires the other 5% of any administrative fine, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Grant Subfund, also within the Consumer Privacy Fund, to be used exclusively by the agency to administer and distribute grants to promote and protect consumer privacy, as provided. This bill would authorize a person to submit to the agency, a whistleblower complaint, as defined, and would make the whistleblower eligible for an award if the agency designates a complaint for administrative enforcement and certain requirements are met. The bill would require an eligible whistleblower to receive at least 15% but not more than 33% of the fines collected through an administrative enforcement action or settlement, calculated after the allocation to Consumer Privacy Grant Subfund described above. The bill would require the agency to consider certain factors in determining the amount of the award. The bill would additionally authorize the agency to assess an administrative penalty against a person who violates the CCPA in an amount to cover the reasonable attorney’s fees of the whistleblower. This bill would create the Consumer Privacy Whistleblower Subfund within the Consumer Privacy Fund and would require the funds awarded by the agency to a whistleblower or for attorney’s fees to be deposited into the Consumer Privacy Whistleblower Subfund. The bill would make those funds available, upon appropriation by the Legislature, for payment to the whistleblower or the whistleblower’s attorney, as appropriate. This bill would require the whistleblower, in order to be eligible for a whistleblower award, to meet certain requirements, including that the whistleblower be represented by an attorney and declare under penalty of perjury that the information submitted with the whistleblower complaint is true and correct to the best of the whistleblower’s knowledge and belief. The bill would authorize a person to submit a whistleblower complaint anonymously, subject to certain conditions, including that the whistleblower’s attorney certify, under penalty of perjury, that the attorney has taken certain actions, including verifying the whistleblower’s identity. The bill would make a whistleblower’s identify confidential, except as provided, and would exempt disclosure of the whistleblower’s identify from the California Public Records Act. By requiring the declarations under penalty of perjury described above, the bill would create new crimes and, thus, impose a state-mandated local program. Under the bill, an employee, contractor, or agent would be entitled to bring a civil action to seek specified relief and damages if the employee, contractor, or agent is subject to specified forms of discrimination in the terms and conditions of their employment because of lawful acts done by the employee, contractor, agent, or associated others in furtherance of a whistleblower complaint or administrative enforcement action under the bill or other efforts to stop one or more violations of the CCPA. The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified. This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Section 1798.141 is added to the Civil Code, to read: 1798.141. In addition to the definitions listed in Section 1798.140, the following definitions apply for purposes of this title: (a) “Original information” means information that is all of the following: (1) Derived from the whistleblower’s independent knowledge or independent analysis. (2) Not already known to the California Privacy Protection Agency from any other source, unless the whistleblower is the original source of the information. (3) (A) Not exclusively derived from any of the following: (i) A governmental report, hearing, audit, or investigation. (ii) Allegations made in a judicial hearing. (iii) Allegations made in or from the news media, including from social media. (B) This paragraph does not apply if the whistleblower was the original source of the information disclosed pursuant to clauses (i) to (iii), inclusive, of subparagraph (A). (b) “Original source” means an individual who meets either of the following requirements: (1) Prior to a public disclosure, the individual voluntarily disclosed to the state, the agency, or a political subdivision of the state the information on which the allegations or transactions in the whistleblower complaint are based. (2) The individual has knowledge that is independent of, and materially adds to, the publicly disclosed allegations or transactions, and has voluntarily provided the information to the state, the agency, or a political subdivision of the state before submitting a whistleblower complaint under this title. (c) “Whistleblower” means a person who submits a whistleblower complaint to the California Privacy Protection Agency containing original information relating to a violation of this title. (d) “Whistleblower complaint” means a written submission from a whistleblower, through the whistleblower’s attorney, that includes substantially all material evidence and information that the whistleblower possesses regarding a violation of this title. SEC. 2. Section 1798.155 of the Civil Code is amended to read: 1798.155. Administrative Enforcement (a) Any business, service provider, contractor, or other person that violates this title shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age, as adjusted pursuant to subdivision (d) of Section 1798.199.95, in an administrative enforcement action brought by the California Privacy Protection Agency. (b) (1) Ninety-five (A) Except as provided in subparagraph (B), 95 percent of any administrative fine assessed for a violation of this title, and of the proceeds of any settlement of an action brought pursuant to subdivision (a), shall be deposited into the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b) of Section 1798.160, and shall be used exclusively by the California Privacy Protection Agency in carrying out its duties under this title. (B) The amount deposited into the Consumer Privacy Subfund pursuant to subparagraph (A) shall be reduced by any amount awarded by the California Privacy Protection Agency to a whistleblower pursuant to subdivision (b) of Section 1798.199.102. (2) Five percent of any administrative fine assessed for a violation of this title, and of the proceeds of any settlement of an action brought pursuant to subdivision (a), shall be deposited into the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160. SEC. 3. Section 1798.160 of the Civil Code is amended to read: 1798.160. Consumer Privacy Fund (a) (1) A special fund to be known as the “Consumer Privacy Fund” is hereby created within the General Fund in the State Treasury, and is available upon appropriation by the Legislature. (2) Funds in the Consumer Privacy Fund and all subfunds within the fund shall be used exclusively for the purposes described in this section and shall not be subject to appropriation or transfer by the Legislature for any other purpose. Any interest and earnings from the fund and all subfunds within the fund shall be transferred on an annual basis to the State Treasury to be available in the General Fund for appropriation by the Legislature. (b) (1) The Consumer Privacy Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision. (2) Ninety-five (A) Except as provided in subparagraph (B), 95 percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Subfund and shall be used exclusively by the California Privacy Protection Agency in carrying out its duties under this title. (B) The amount deposited into the Consumer Privacy Subfund pursuant to subparagraph (A) shall be reduced by any amount determined by the California Privacy Protection Agency to be awarded to a whistleblower pursuant to subdivision (b) of Section 1798.199.102. (c) (1) The Attorney General Consumer Privacy Enforcement Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Attorney General Consumer Privacy Enforcement Subfund shall be used exclusively for the purposes described in this subdivision. (2) Ninety-five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Attorney General Consumer Privacy Enforcement Subfund and shall be used exclusively by the Attorney General in carrying out its duties under this title. (d) The Consumer Privacy Grant Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision. (1) (A) Five percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund. (B) Five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund. (2) (A) Funds deposited into the Consumer Privacy Grant Subfund shall be used exclusively by the California Privacy Protection Agency to administer and distribute grants to promote and protect consumer privacy, educate children in the area of online privacy, and fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches. (B) Subject to subparagraph (A), the California Privacy Protection Agency shall make grants from the Consumer Privacy Grant Subfund by distributing one-third of the amount allocated for grant funding in the subfund to each of the following grant recipients: (i) Nonprofit organizations to promote and protect consumer privacy. (ii) Nonprofit organizations and public agencies, including school districts, to educate children in the area of online privacy. (iii) State and local law enforcement agencies to fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches. (3) (A) The California Privacy Protection Agency shall begin administering the grant program described in paragraph (2) when the amount of funds in the Consumer Privacy Grant Subfund exceeds three hundred thousand dollars ($300,000). (B) In a fiscal year in which the amount of funds in the Consumer Privacy Grant Subfund is equal to or less than three hundred thousand dollars ($300,000), the funds shall remain in the Consumer Privacy Grant Subfund until the total funds exceed three hundred thousand dollars ($300,000). (e) (1) The Consumer Privacy Whistleblower Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. (2) The funds determined by the California Privacy Protection Agency to be awarded to a whistleblower pursuant subdivision (b) of Section 1798.199.102, and any administrative penalty for attorney’s fees assessed pursuant to subdivision (d) of Section 1798.199.102, shall be deposited into the Consumer Privacy Whistleblower Subfund and shall be available, upon appropriation by the Legislature, for payment to the whistleblower or the whistleblower’s attorney, as appropriate. (e) (f) Any remaining funds in the Consumer Privacy Fund and subfunds within the fund that were not appropriated as part of the 2025 Budget Act shall be [Text truncated for display. Full text available on Congress.gov.]