BILL ANALYSIS
SB 129
Page 1
PROPOSED CONFERENCE REPORT NO. 1 - August 28, 2000
SB 129 (Peace)
As Amended August 26, 1999
Majority vote
----------------------------------------------------------------
|SENATE: |26-5 |(May 20, 1999) |ASSEMBLY: |53-24|(September 3, |
| | | | | |1999) |
----------------------------------------------------------------
(vote not relevant) (vote not relevant)
SENATE CONFERENCE VOTE : 3-0 ASSEMBLY CONFERENCE VOTE :2-1
----------------------------------------------------------------
|Ayes:|Peace, Johnson, Schiff |Ayes:|Corbett, Jackson |
| | | | |
|-----+-------------------------+-----+--------------------------|
| | |Nays:|McClintock |
| | | | |
----------------------------------------------------------------
Original Committee Reference: JUD.
SUMMARY : Creates the Office of Privacy Protection (office)
within the Department of Consumer Affairs (DCA), the stated
purpose of which is to protect the privacy of individuals'
personal information in a manner consistent with the California
Constitution. Specifically, the conference committee
amendments :
1)Require the office, in carrying out its mission, to identify
consumer problems in the privacy area and facilitate
development of fair information practices, with regard to
public and private entities, consistent with the Information
Practices Act of 1977.
2)Require the office to inform the public of potential options
for protecting the privacy of, and avoiding the misuse of
personal information, and to make recommendations to
organizations for implementation of privacy policies and
practices that promote and protect consumers.
3)Require DCA, in carrying out the mission of the office, to
engage in the following:
a) Receive complaints from individuals concerning the
SB 129
Page 2
compilation, use or disclosure of personal information, and
provide advice, information, and referral to that
individual where appropriate;
b) Provide information to consumers on effective ways of
handling complaints that involve violations of privacy
related laws. DCA shall refer those complaints to local,
state, or federal agencies where appropriate;
c) Assist and coordinate in the training of local, state,
and federal law enforcement agencies regarding identity
theft and other privacy related crimes; and,
d) Develop information and educational programs and
materials to foster public understanding of privacy issues.
4)Authorize the office to promote voluntary, mutually agreed
upon, nonbinding arbitration and mediation of privacy related
disputes, where appropriate
5)Provide that the provisions of this bill relating to the
office shall only be operative for those years in which there
is an appropriation from the General Fund in the Budget Act.
6)Require DCA to report to the Legislature annually, commencing
January 31, 2003, regarding DCA's activities under this
measure.
7)Codify budget control language adopted with this year's budget
requiring each state department and state agency to enact and
maintain a permanent privacy policy in adherence with the
Information Practices Act of 1977.
8)Provides that the permanent policy shall be subject to the
following principles:
a) The purposes for which personally identifiable data are
collected are specified at or prior to the time of
collection, and any subsequent use is limited to the
fulfillment of those purposes;
b) Personal data shall not be disclosed, made available, or
otherwise used for purposes other than those specified by
the department or agency, without the consent of the
consumer; and,
SB 129
Page 3
c) Personally identifiable information shall only be
obtained through lawful means.
EXISTING LAW :
1)Provides in the California Constitution that, among other
rights, all people have an inalienable right to pursue and
obtain privacy.
2)Declares, as part of the Information Practices Act of 1977,
that the right to privacy is a personal and fundamental right
protected by the California Constitution and that all
individuals have a right of privacy in information pertaining
to them.
3)Finds, as part of the Information Practices Act of 1977, that
the right to privacy is being threatened by the indiscriminate
collection, maintenance and dissemination of personal
information and the lack of effective laws and legal remedies
to protect against such practices.
4)Declares, as part of the Information Practices Act of 1977,
that in order to protect the privacy of individuals, it is
necessary that the maintenance and dissemination of personal
information be subject to strict limits.
FISCAL EFFECT : Unknown
COMMENTS : According to the author, "present law does not
adequately impose restrictions on the collection and disclosure
of personal information by government, businesses, or
not-for-profit organizations." Therefore, this conference
report creates an office of privacy protection to ensure that
private and public entities protect the privacy of personal
information. The protection of personal information by private
and public entities shall be performed in a manner consistent
with the California Constitution, which states that all
individuals have an inalienable right to obtain and pursue
privacy. In carrying out its stated mission, the office shall
identify consumer problems in the privacy area and facilitate
development of fair information practices by both public and
private entities. DCA is charged with the responsibility of
developing information and educational programs and materials to
foster public understanding of privacy issues, to receive
SB 129
Page 4
complaints from consumers regarding an entity's compilation or
disclosure of personal information, to provide information to
consumers on how to handle complaints about violations of
privacy laws, and to refer complaints to law enforcement
agencies, where appropriate.
This conference report also seeks to codify budget control
language adopted as part of this year's budget with regard to
the responsibility of state departments and state agencies to
maintain permanent privacy policies in adherence to the
Information Practice Act of 1977, to ensure that state agencies
protect personal information from being disclosed, made
available or otherwise used without the consent of the
individual for purposes other than that for which it was
initially collected. The American Civil Liberties Union (ACLU)
has noted that requiring the adoption of such permanent privacy
policies by all state agencies and departments, the process for
filing complaints with the Office of Privacy Protection, and the
office's processing of those complaints will need to be designed
in a manner that ensures the personal privacy of those
individuals bringing the complaint. The ACLU comments that
regardless of the requirement to adopt a permanent privacy
policy, the office would need to ensure the protection of
personal privacy so as not to discourage people from filing and
pursuing complaints.
Analysis Prepared by : Donna S. Hershkowitz / JUD. / (916)
319-2334
FN: 0007650