AB 872

This bill establishes various requirements on controllers that process

consumers' personal data. Under the bill, a “controller” is a person that alone or

jointly with others determines the purposes and means of the processing of personal

data. The bill defines “personal data” as information relating to a consumer that

allows the consumer to be identified other than information lawfully made available

from federal, state, or local government records.

Under the bill, a controller may not process a consumer's personal data unless

certain conditions apply, such as if the consumer consents, if processing is necessary

to perform a contract the controller has with a consumer, if processing is necessary

to comply with a legal obligation, or if processing is conducted to detect a security

incident or to protect against fraudulent or illegal activity. The bill requires that

consent to process personal data must be obtained from a consumer by a statement

or clear affirmative action; that the consumer be able to withdraw consent at any

time; and that consent to process a consumer's personal data may not be required as

a condition of using a service provided by the controller. Additionally, the bill limits

the processing of personal data that reveals a consumer's racial or ethnic origin,

political opinions, religious or philosophical beliefs, or trade union membership;

genetic data; biometric data; personal data concerning a consumer's health; and

personal data concerning a consumer's sex life or sexual orientation. Under the bill,

a controller may process those types of personal data only if certain conditions apply,

including 1) if the processing is conducted for a purpose to which the consumer

consents; 2) if the processing is necessary to comply with a legal obligation; 3) if the

processing is conducted by a political, philosophical, or religious nonprofit

organization that processes only personal data of members, former members, or

persons who have regular contact with the organization; or 4) if the processing is

necessary for certain public interest reasons.

The bill also allows consumers to request that a controller restrict the

processing of the consumer's personal data, and the controller may store but not

otherwise process the personal data if certain conditions apply, such as the following:

1) if the controller has no legitimate ground to process the personal data that

overrides the consumer's request; or 2) if processing the personal data is unlawful.

The controller generally must notify other controllers to which the controller

discloses the consumer's personal data, unless notification is impossible or involves

unreasonable effort, and those controllers generally must not process, other than by

storing, the personal data. A controller may continue processing a consumer's

personal data under the bill under certain conditions, including 1) if the consumer

consents; 2) if processing occurs for important public interest reasons under federal,

state, or local law; or 3) if processing occurs to protect the rights of another person.

Also, under the bill, controllers and processors must maintain records of

processing of personal data that contain certain information including the purpose