Precise geolocation information., the official text

An act to add Section 1798.122 to the Civil Code, relating to privacy.

LEGISLATIVE COUNSEL'S DIGEST

Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use, as prescribed. Existing law defines “sensitive personal information” to mean, among other things, personal information that reveals a consumer’s precise geolocation. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would require a business that collects precise geolocation information to prominently display, when information is being collected, a notice to the consumer whose information is being collected that states certain information related to the collection of the information and its use by the business, including the goods or services requested by the consumer for which the business is collecting, processing, or disclosing the geolocation information and a description of how the business will process the geolocation information to carry out those purposes.
This bill would prohibit a business that collects precise geolocation information from, among other things, retaining the information longer than necessary to provide the goods or services requested by the consumer or longer than one year after the consumer’s last intentional interaction with the business, whichever is earlier.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The people of the State of California do enact as follows:

SECTION 1.
Section 1798.122 is added to the Civil Code, to read:
1798.122.
(a) A business that collects precise geolocation information shall prominently display, when precise geolocation information is being collected, a notice to the consumer whose precise geolocation information is being collected that states all of the following:
(1) The fact that the consumer’s precise geolocation information is being collected.
(2) The name of the business collecting the consumer’s precise geolocation information.
(3) A telephone number and an internet website through which the consumer can obtain more information.
(4) The type of precise geolocation information collected, including the precision of the information.
(5) The goods or services requested by the consumer for which the business is collecting, processing, or disclosing the precise geolocation information and a description of how the business will process the precise geolocation information to carry out those purposes.
(6) Any disclosures of the precise geolocation information necessary to provide the goods or services requested by the consumer and the identities of the third parties to whom the precise geolocation information could be disclosed.
(b) A business that collects precise geolocation data shall not do any of the following:
(1) (A) Except as provided in subparagraph (B), collect or process precise geolocation information more than necessary to provide the goods or services requested by the consumer.
(B) (i) A business may collect or process precise geolocation information that is necessary to respond to security incidents, fraud, harassment, malicious or deceptive activities, or any illegal activity targeted at, or involving, the controller or processor or its services or to investigate, report, or prosecute those responsible for any of those actions.
(ii) Precise geolocation information collected and processed under this subparagraph shall not be retained for longer than 30 days.
(2) Retain precise geolocation information longer than necessary to provide the goods or services requested by the consumer or longer than one year after the consumer’s last intentional interaction with the business, whichever is earlier.
(3) Sell, trade, or lease precise geolocation information to a third party.
(4) Disclose precise geolocation information to a state or local government agency or official unless the agency or official serves the business or service provider of the business with a valid court order issued by a California court or a court order from another jurisdiction that is consistent with California’s laws, including, but not limited to, both of the following:
(A) The Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(B) A foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(5) Disclose precise geolocation information to a federal government agency unless required to do so by federal law.

SEC. 2.
The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.