BILL NUMBER: SB 682 AMENDED BILL TEXT
AMENDED IN SENATE MARCH 31, 2005
INTRODUCED BY Senator Simitian
FEBRUARY 22, 2005
An act to add Article 4 (commencing with Section 1798.9) to Chapter 1 of Title 1.8 of Part 4 of Division 3 of the Civil Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
SB 682, as amended, Simitian. Identity Information Protection Act of 2005.
Existing law, the Information Practices Act of 1977, regulates the
collection and disclosure of personal information regarding
individuals by state agencies, except as specified. The intentional
disclosure of medical, psychiatric, or psychological information in
violation of the disclosure provisions of the act is punishable as a
misdemeanor if the wrongful disclosure results in economic loss or
personal injury to the individual to whom the information pertains.
This bill would enact the Identity Information Protection Act of
2005. The act would prohibit identity
identification documents created, mandated, purchased,
or issued by various public entities from containing a
contactless integrated circuit or other device that can broadcast
personal information or enable personal information to be scanned
remotely , except as specified . Because
Because the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of the Information Practices Act of 1977 , which would include this act, is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains, and because the scanning or attempted scanning of a person's identification document without his or her knowledge would be punishable as a misdemeanor, this bill would create a new crime, thereby imposing a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: yes.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. This act shall be known and may be cited as the Identity Information Protection Act of 2005.
SEC. 2. The Legislature hereby finds and declares all of the following:
(a) The right to privacy is a personal and fundamental right protected by Section 1 of Article I of the California Constitution and by the United States Constitution. All individuals have a right of privacy in information pertaining to them.
(b) Easy access to the information found on drivers' licenses and other similar
identityidentification documents facilitates the crime of identity theft, a crime that is a major concern in California. More than 39,000 Californians reported being victims of this crime in 2003.(c) This state has previously recognized the importance of protecting the confidentiality and privacy of an individual's personal information contained in
identityidentification documents such as drivers' licenses.(d) The inclusion in
identityidentification documents of contactless integrated circuits or other devices that broadcast data or enable data to be scanned secretly and remotely will greatly magnify the potential risk to individual privacy, safety, and economic well-being that can occur from unauthorized interception and use of personal information. The inclusion of those devices will also make it possible for any person or entity with access to a reader to engage in the secret tracking of Californians on an unprecedented scale.
SEC. 3. Article 4 (commencing with Section 1798.9) is added to Chapter 1 of Title 1.8 of Part 4 of Division 3 of the Civil Code , to read:
Article 4. Identity Documents
1798.9.
(a)For purposes of this article, the following definitions shall apply:"Contactless(a) "Contactless integrated circuit" means a data carrying unit, such as an integrated circuit or computer chip that can be read remotely.
(b) "Identity" means any name, number, or data transmission that may be used alone or in conjunction with any other information, to identify a specific individual.
(c) "Identity document" means any document that an individual uses to establish his or her identity that contains one or more items of personal information. Identity documents(b) "Identification document" means any document containing personal information that an individual uses alone or in conjunction with any other information to establish his or her identity. Identification documents specifically include, but are not limited to, the following:
(1) Driver's licenses or identification cards. (2) Identification cards for employees or contractors. (3) Identification cards issued by educational institutions. (4) Health insurance or benefit cards. (5) Benefit cards issued in conjunction with any government-supported aid program. (6) Licenses, certificates, registration, or other means to engage in a business or profession regulated by the California Business and Professions Code. (7) Library cards issued by any public library.
(d)(c) "Personal information" includes any of the following: an individual's name, address, telephone number, e-mail address, date of birth, race, religion, ethnicity, nationality, photograph, fingerprint or other biometricimage of the individualidentification , social security number, or any other unique personal identifier or number.
(e)(d) "Remotely" means that no physical contact between the integrated circuit or device and a reader is necessary in order to transmit data.
1798.10. No identity document created, mandated, or issued by the state, county, or municipal government, or subdivision or agency thereof shall contain a contactless integrated circuit or other device that can broadcast personal information or enable personal information to be scanned remotely.1798.10. No identification document created, mandated, purchased, or issued by a state, county, or municipal government, or subdivision or agency thereof shall contain a contactless integrated circuit or other device that can broadcast personal information or enable personal information to be scanned remotely, except as follows:
(a) The identification document is to be used on a toll road or bridge for the specific purpose of collecting funds for the use of that road or bridge, such as FastTrak.
(b) The identification document is to be given to a person who is incarcerated in the state prison or a county jail, or housed in a mental health facility, pursuant to a court order after having been charged with a crime, or to a person pursuant to court-ordered electronic monitoring.
(c) The identification document is to be given to a child four years of age or younger who is in the custodial care of a government-operated hospital, clinic, or other medical facility.
(d) The identification document is part of a contactless integrated system used by a state, county, or municipal government, or subdivision or agency thereof that is operational and in use no later than December 31, 2005.
(e) The Legislature determines through legislation that an exception allowing the inclusion of a contactless integrated circuit or other device is necessary to meet a compelling state interest and that there exists no means less intrusive to the individual's privacy and security that would achieve that compelling state interest.
1798.10.5. An identification document described in subdivisions (a) to (e), inclusive, of Section 1798.10 shall not contain, transmit, or enable the remote scanning of, any personal information other than a unique personal identifier number.
1798.11. The issuing entity of an identification document described in subdivision (a), (d), or (e) of Section 1798.10 shall communicate in writing to the person to whom the document is issued, all of the following:
(a) That the identification document contains a circuit or device that can broadcast a unique personal identifier number or enable that number to be scanned remotely without his or her knowledge.
(b) That countermeasures exist, such as shield devices, to help one control the risk that his or her unique personal identifier number will be broadcast or scanned remotely without his or her knowledge.
(c) The location of all scanners and readers used or intended to be used by the issuing authority or by any other entity known to that authority to read the unique personal identifier number on the identification document.
1798.11.5. The exception described in subdivisin (d) of Section 1798.10 shall remain in effect only until January 1, 2011.
1798.12. A person or entity that remotely scans or attempts to remotely scan a person's identification document without the knowledge of that person may be punished, upon conviction, by imprisonment in a county jail for up to one year. The court may also impose a fine of not less than one thousand dollars ($1,000) and no more than five thousand dollars ($5,000), or may impose both imprisonment and fine.
SEC. 4. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.