SEC. 24.
Section 1798.199.10 et seq. are added to the Civil Code to read as follows:
1798.199.10 Establishment of California Privacy Protection Agency
(a) 1There is hereby establishedin state government the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act. 2The Agency shall be governed by a five-member board, including the Chair. 3The Chair and one member of the board shall be appointed by the Governor. 4The Attorney General, Senate Rules Committee, and Speaker of the Assembly shall each appoint one member. 5These appointments should be made from among Californians with expertise in the areas of privacy, technology, and consumer rights.
(b) The initial appointments to the Agency shall be made within 90 days of the effective date of the Act adding this section.
1798.199.15.
Members of the Agency board shall:
(a) have qualifications, experience and skills, in particular in the areas of privacy and technology, required to perform the duties of the Agency and exercise its powers;
(b) maintain the confidentiality of information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure is required by the Public Records Act;
(c) remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from another;
(d) refrain from any action incompatible with their duties and engaging in any incompatible occupation, whether gainful or not, during their term;
(e) have the right of access to all information made available by the Agency to the Chair;
(f) be precluded, for a period of one year after leaving office, from accepting employment with a business that was subject to an enforcement action or civil action under this Title during the member’s tenure or during the five-year period preceding the member’s appointment; and
(g) be precluded for a period of two years after leaving office, from acting, for compensation, as an agent or attorney for, or otherwise representing any other person in a matter pending before the Agency if the purpose is to influence an action of the Agency.
1798.199.20.
Members of the Agency board, including the Chair, shall serve at the pleasure of their appointing authority but shall serve for no longer than eight consecutive years.
1798.199.25.
For each day on which they engage inofficial duties, members of the Agency board shall be compensated at the rate of one hundred dollars ($100), adjusted biennially to reflect changes in the cost of living, and shall be reimbursed for expenses incurred in performance of their official duties.
1798.199.30.
1The Agency board shall appoint an executive director who shall act in accordance with Agency policies and regulations and with applicable law. 2The Agency shall appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and shall fix the compensation of employees and prescribe their duties. 3The Agency may contract for services that cannot be provided by its employees.
1798.199.35.
The Agency board may delegate authority to the Chair or the executive director to act in the name a f the Agency between meetings of the Agency, except with respect to resolution of enforcement actions and rulemaking authority.
1798.199.40.
The Agency shall perform the following functions:
(a) Administer, implement, and enforce through administrative actions, Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code.
(b) On and after the earlier of July l , 2021, or within six months of the Agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185 to carry out the purposes and provisions of the California Consumer Privacy Act, including regulations specifying record keeping requirements for businesses to ensure compliance with this title.
(c) Through the implementation of this title, protect the fundamental privacy rights of natural persons with respect to the use of their personal information.
(d) Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the Agency pursuant to paragraph (15) of subdivision (a) of Section 1798.185 while ensuring that data security is not compromised.
(e) Provide guidance to consumers regarding their rights under this title.
(f) Provide guidance to businesses regarding their duties and responsibilities under this title, and appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance with this title pursuant to regulations adopted pursuant to paragraph (18) of subdivision (a) of Section 1798.185.
(g) Provide technical assistance and advice to the Legislature, upon request, with respect to privacy-related legislation.
(h) Monitor relevant developments relating to the protection of personal information, and in particular, the development of information and communication technologies and commercial practices.
(i) Cooperate with other agencies with jurisdiction over privacy laws and with data processing authorities in California, other states, territories, and countries to ensure consistent application of privacy protections.
(j) Establish a mechanism pursuant to which persons doing business in California that do not meet the definition of business set forth in paragraphs (1), (2), or (3) of subdivision (d) of section 1798.140 may voluntarily certify that they are in compliance with this title, as set forth in paragraph (4) of subdivision (d) of Section 1798.140, and make a list of such entities available to the public.
(k) Solicit, review, and approve applications for grants to the extent funds are available pursuant to paragraph (2) of subdivision (b) of Section 1798.160.
(l) Perform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdiction, and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.
1798.199.45.
1Upon the sworn complaint of any person or on its own initiative, the Agency may investigate possible violations of this title relating to any business, service provider, contractor, or person. 2The Agency may decide not to investigate a complaint or decide to provide a business with a time-period to cure the alleged violation. 3In making a decision not to investigate or provide more time to cure, the Agency may consider: (a) the lack of intent to violate this title; and (b) voluntary efforts undertaken by the business, service provider, contractor, or person to cure the alleged violation prior to being notified by the Agency of the complaint. 4The Agency shall notify in writing the person who made the complaint of the action, If any, the Agency has taken or plans to take on the complaint, together with the reasons for such action or non-action.
1798.199.50.
1No finding of probable cause to believe this title has been violated shall be made by the Agency unless, at least 30 days prior to the Agency’s consideration of the alleged violation, the business, service provider, contractor, or person alleged to have violated this title is notified of the violation by service of process or registered mall with return receipt requested, provided with a summary of the evidence, and informed of their right to be present in person and represented by counsel at any proceeding of the Agency held for the purpose of considering whether probable cause exists for believing the person violated this title. 2Notice to the alleged violator shall be deemed made on the date of service, the date the registered mail receipt is signed, or if the registered mail receipt is not signed, the date returned by the post office. 3A proceeding held for the purpose of considering probable cause shall be private unless the alleged violator flies with the Agency a written request that the proceeding be public.
1798.199.55.
(a) 1When the Agency determines there is probable cause for believing this title has been violated, It shall hold a hearing to determine if a violation has or violations have occurred. 2Notice shall be given and the hearing conducted in accordance with the Administrative Procedure Act (Chapter 5 (commencing with Section 11500), Part 1, Division 3, Title 2, Government Code). 3The Agency shall have all the powers granted by that chapter. If the Agency determines on the basis of the hearing conducted pursuant to this subdivision that a violation or violations have occurred, it shall issue an order that may require the violator to do all or any of the following:
(b) If two or more persons are responsible for any violation or violations, they shall be Jointly and severally liable.
1798.199.60.
Whenever the Agency rejects the decision of an administrative law judge made pursuant to Section 11517 of the Government Code, the Agency shall state the reasons in writing for rejecting the decision.
1798.199.65.
The Agency may subpoena witnesses, compel their attendance and testimony, administer oaths and affirmations, take evidence and require by subpoena the production of any books, papers, records or other items material to the performance of the Agency’s duties or exercise of its powers, Including but not limited to its power to audit a business’s compliance with this title.
1798.199.70.
No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.
(a) The service of the probable cause hearing notice, as required by Section 1798.199.50, upon the person alleged to have violated this title shall constitute the commencement of the administrative action.
(b) 1If the person alleged to have violated this title engages in the fraudulent concealment of his or her acts or identity, the five-year period shall be tolled for the period of the concealment. 2For purposes of this subdivision, fraudulent concealment” means the person knows of material facts related to their duties under this title and knowingly conceals them in performing or omitting to perform those duties, for the purpose of defrauding the public of information to which it is entitled under this title.
(c) If, upon being ordered by a superior court to produce any documents sought by a subpoena in any administrative proceeding under this title, the person alleged ta have violated this title fails to produce documents in response to the order by the date ordered to comply therewith, the five-year period shall be tolled for the period of the delay from the date of filing of the motion to compel until the date the documents are produced.
1798.199.75.
(a) 1In addition to any other available remedies, the Agency may bring a civil action and obtain a judgment in superior court for the purpose of collecting any unpaid administrative fines imposed pursuant to this title after exhaustion of Judicial review of the Agency’s action. 2The action may be filed as a small claims, limited civil, or unlimited civil case, depending on the Jurisdictional amount. 3The venue for this action shall be in the county where the administrative fines were imposed by the Agency. In order to obtain a judgment in a proceeding under this section, the Agency shall show, following the procedures and rules of evidence as applied in ordinary civil actions, all of the following:
(b) A civil action brought pursuant to subdivision (a) shall be commenced within four years after the date on which the administrative fines were imposed.
1798.199.80.
(a) If the time for Judicial review of a final Agency order or decision has lapsed, or if all means of Judicial review of the order or decision have been exhausted, the Agency may apply to the clerk of the court for a judgment to collect the administrative fines imposed by the order or decision, or the order as modified in accordance with a decision on Judicial review.
(b) 1The application, which shall include a certified copy of the order or decision, or the order as modified in accordance with a decision on judicial review, and proof of service of the order or decision, constitutes a sufficient showing to warrant issuance of the judgment to collect the administrative fines. 2The clerk of the court shall enter the Judgment immediately in conformity with the application.
(c) An application made pursuant to this section shall be made to the clerk of the superior court in the county where the administrative fines were imposed by the Agency.
(d) A Judgment entered in accordance with this section has the same force and effect as, and is subject to all the provisions of law relating to, a judgment in a civil action and may be enforced in the same manner as any other Judgment of the court in which it is entered.
(e) The Agency may bring an application pursuant to this section only within four years after the date on which all means of judicial review of the order or decision have been exhausted.
(f) The remedy available under this section is in addition to those available under any other law.
1798.199.85.
Any decision of the Agency with respect to a complaint or administrative fine shall be subject to Judicial review in an action brought by an interested party to the complaint or administrative fine and shall be subject to an abuse of discretion standard.
1798.199.90.
(a) Any business, service provider, contractor, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General, The court may consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty.
(b) Any civil penalty recovered by an action brought by the Attorney General for a violation of this title, and the proceeds of any settlement of any said action, shall be deposited in the Consumer Privacy Fund.
(c) 1The Agency shall, upon request by the Attorney General, stay an administrative action or investigation under this title to permit the Attorney General to proceed with an investigation or civil action, and shall not pursue an administrative action or investigation, unless the Attorney General subsequently determines not to pursue an investigation or civil action. 2The Agency may not limit the authority of the Attorney General to enforce this title.
(d) No civil action may be filed by the Attorney General under this Section for any violation of this title after the Agency has issued a decision pursuant to Section 1798.199.85 or an order pursuant to Section 1798.199.55 against that person for the same violation.
(e) This section shall not affect the private right of action provided for in Section 1798.150.
1798.199.95.
(a) 1There is hereby appropriated from the General Fund of the state to the Agency the sum of five million dollars ($5,000,000) during the fiscal year 2020-2021, and the sum of ten million dollars ($10,000,000) adjusted for cost-of-living changes, during each fiscal year thereafter, for expenditure to support the operations of the Agency pursuant to this title. 2The expenditure of funds under this appropriation shall be subject to the normal administrative review given to other state appropriations. 3The Legislature shall appropriate such additional amounts to the Commission and other agencies as may be necessary to carry out the provisions of this title.
(b) The Department of Finance, in preparing the state budget and the Budget Bill submitted to the Legislature, shall include an item for the support of this title, which item shall indicate all of the following: (1) the amounts to be appropriated to other agencies to carry out their duties under this title, which amounts shall be in augmentation of the support items of such agencies; and (2) the additional amounts required to be appropriated by the Legislature to the Agency to carry out the purposes of this title, as provided for in this section; and (3) in parentheses, for informational purposes, the continuing appropriation during each fiscal year of ten million dollars ($10,000,000), adjusted for cost-of-living changes made pursuant to this section.
(c) 1The Attorney General shall provide staff support to the Agency until such time as the Agency has hired its own staff. 2The Attorney General shall be reimbursed by the Agency for these services.
1798.199.100.
1The Agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. 2A business shall not be required by the Agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation.