AB 870

This bill generally requires controllers of consumers' personal data to provide

a consumer with copies of the consumer's personal data processed by the controller.

Under the bill, a “controller” is a person that alone or jointly with others

determines the purposes and means of the processing of personal data. The bill

defines “personal data” as information relating to a consumer that allows the

consumer to be identified other than information lawfully made available from

federal, state, or local government records.

The bill requires a controller, when collecting personal data from a consumer,

to inform the consumer that it is collecting personal data and to provide the consumer

with certain other information. Additionally, if a controller intends to process a

consumer's personal data and the controller did not collect the personal data from

the consumer, the controller must, within one month of obtaining the personal data,

identify itself to the consumer and provide the consumer with certain information,

such as the purposes for which the controller intends to process the personal data and

where the controller obtained the personal data.

Also, under the bill, if a controller processes a consumer's personal data, the

controller must provide a copy of the personal data to a consumer who requests a

copy. The controller must also provide the consumer with certain other information,

including the purposes for which the controller processes the personal data, the

categories of the personal data that the controller processes, and the persons to

whom the controller discloses the personal data. If a consumer requests a copy of

personal data electronically, the controller must provide the copy and requested

information in a commonly used electronic form, unless the consumer requests

otherwise. A controller is not required to provide a consumer with a copy of the

consumer's personal data 1) if providing the copy would adversely affect the rights

of others; 2) if the controller processes a consumer's personal data out of necessity

in performing a task for the public interest; or 3) if the personal data is certain health,

financial, or other personal information, including information restricted by federal

law.

The bill also requires a controller to notify the Department of Justice if the

controller is aware of a personal data breach involving consumer personal data it

maintains and the data breach is likely to result in a risk to the rights and freedoms

of consumers. The notification must describe the nature of the personal data breach

and provide certain additional information. Also, if the personal data breach is likely

to result in a high risk to the rights and freedoms of consumers, a controller generally

must notify the consumers whose personal data is involved in the personal data

breach. The bill also requires a processor to notify a controller about a personal data

breach of personal data that it maintains on behalf of the controller.

Under the bill, the attorney general may investigate violations and bring

actions for enforcement. A controller who violates the bill's personal data breach