Recent weeks have seen a flurry of legislative activity in  California in the privacy space. On September 29, Governor Jerry Brown signed into law two bills regarding student privacy. On September 30, he signed into law eight bills addressing privacy concerns related to invasion of privacy, distribution of unauthorized images, and data collection and security. 

Student Privacy

SB 1177 prohibits the creation and distribution of “profiles” of minor students. Furthermore, it prohibits K-12 websites and applications from using information they gather to target advertisements at the K-12 audience. The law requires website or app operators to have policies in place to promote compliance. The enactment of AB 1584 allows schools to contract with third parties for the maintenance of student records, but requires those contracts to include certain provisions, including details of security measures and a clarification that the records belong to the school.

Invasion of Privacy

The newly enacted AB 1256 expands liability for “invasion of privacy” by clarifying the type of activity protected from unwarranted capturing of images or photographs, and also would establish zones of privacy around schools and medical facilities. AB 2306 expands the definition of “invasion of privacy” by eliminating the existing physical trespass requirement. The change would render illegal the use of drones and other electronic devices to capture images of individuals in their homes. AB 1356 amends current law to include surveillance as behavior that could establish stalking. Furthermore, this bill allows plaintiffs to plead “substantial emotional distress” as an alternative to the existing standard of “reasonable fear.”

Distribution of Unauthorized Images

AB 2643 allows plaintiffs to file a civil suit for damages against a defendant who posted intimate photos or videos of the plaintiff without consent. Previously, defendants were only subject to a criminal action. SB 1255 expands the criminal prohibition on posting unauthorized intimate images to include images taken by the subject (also known as “selfies”).

Data Collection and Dissemination

AB 928 requires state agencies to maintain and conspicuously post a privacy policy, and to include in such policies provisions that address the relevance and purpose of data collection and the prohibition on sharing data without consent. AB 1710 (discussed in September’s issue of The Download) requires that companies that offer free identity theft protection to notify consumers whose personal information has been breached of  that offer, if the breach has exposed certain types of sensitive information. SB 828 prohibits the State of California from aiding the federal government in data collection that the state knows to be illegal or unconstitutional.