CALIFORNIA LEGISLATURE— 2021–2022 REGULAR SESSION

Assembly Bill
No. 859

Introduced by Assembly Members Irwin and Wicks

February 17, 2021

An act to add Chapter 2 (commencing with Section 1798.78.1) to Title 1.8 of Part 4 of Division 3 of the Civil Code, relating to privacy.


LEGISLATIVE COUNSEL'S DIGEST


AB 859, as introduced, Irwin. Mobility devices: personal information.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.
Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified.
This bill would authorize a public agency, defined as a state or local public entity that issues a permit to an operator for mobility services or that otherwise regulates an operator, to require an operator to periodically submit to the public agency anonymized trip data and the operator’s mobility devices operating in the geographic area under the public agency’s jurisdiction and provide specified notice of that requirement to the operator. The bill would authorize a public agency to share anonymized trip data with a contractor, agent, or other public agency only if specified conditions are met, including that the purpose of the sharing is to assist the public agency in the promotion and protection of transportation planning, integration of mobility options, and road safety. The bill would prohibit a public agency from sharing trip data with a contractor or agent.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Chapter 2 (commencing with Section 1798.78.1) is added to Title 1.8 of Part 4 of Division 3 of the Civil Code, to read:
CHAPTER  2. Personal Information of Users of Mobility Devices

1798.78.1.
 As used in this chapter:
(a) “Aggregated” means that the data reflects average information, including trip length, trip duration, approximate trip, and location of no less than five separate trips by no less than five separate users.
(b) “Anonymized trip data” means data pertaining to a trip taken by a user that has been aggregated and deidentified.
(c) (1) “Deidentified” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular user or trip.
(2) Information shall not be deemed to be deidentified if it is provided to a recipient that does not meet all of the following criteria:
(A) The recipient has implemented technical safeguards that prohibit reidentification of the user or trip to which the information pertains.
(B) The recipient has implemented processes that specifically prohibit reidentification of the information.
(C) The recipient has implemented processes to prevent unauthorized access, inadvertent release, or public disclosure of deidentified information.
(D) The recipient does not attempt to reidentify the information.
(d) (1) “Mobility device” means any transportation device or vehicle, including, but not limited to, a bicycle, electric bicycle, dockless bicycle, electric scooter, vehicle utilized on the online-enabled application or platform of a transportation network company, as defined by Section 5431 of the Public Utilities Code, autonomous vehicle, and any other device or vehicle by which a person can be propelled, moved, or drawn that is displayed, offered, or placed for rent in any public area or public right-of-way.
(2) A mobility device does not include a device made available to the public by a public agency, including through contractors or agents of that public agency.
(e) “Operational data” means data, that is neither trip data nor anonymized trip data, pertaining to the location of a stationary mobility device owned or controlled by the operator that is not engaged by users or on a trip.
(f) “Operator” means a person or entity that makes mobility devices generally available to the public, including through an online-enabled technology application service, website, or system.
(g) “Public agency” means a state or local public entity that issues a permit to an operator for mobility services or that otherwise regulates an operator.
(h) “Trip data” means data, that is not anonymized trip data, pertaining to a trip taken by a user, including, but not limited to, GPS data, an address, time or date stamp, and route data that have not been aggregated and deidentified.
(i) “User” means a rider of a mobility device or accountholder of an operator.

1798.78.2.
 (a) Notwithstanding any other law, a public agency may require an operator to periodically submit to the public agency anonymized trip data regarding the operator’s mobility devices operating in the geographic area under the public agency’s jurisdiction.
(b) If a requirement pursuant to subdivision (a) exists, the public agency shall give the operator reasonable notice of that requirement and sufficient time to aggregate and deidentify any anonymized trip data to be submitted.

1798.78.3.
 (a) A public agency may share anonymized trip data with a contractor, agent, or other public agency only if all of the following are true:
(1) The purpose of the sharing is to assist the public agency in the promotion and protection of transportation planning, integration of mobility options, and road safety, including the safety of riders, operators, pedestrians, and motorists.
(2) A trip included in the data that is being submitted has not ended within the previous 24 hours.
(3) Any recipient of the anonymized trip data is expressly prohibited by contract from using or disclosing the anonymized trip data for any commercial purpose.
(b) A public agency shall not share trip data with a contractor or agent.

1798.78.4.
 (a) Trip data is personal information, as defined in Section 1798.140.
(b) A public agency shall not obtain trip data except as provided by Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.

SEC. 2.

 The addition by this act of Section 1798.78.4 to the Civil Code does not constitute a change in, but is declaratory of, existing law.