Bill Text


Bill PDF |Add To My Favorites | print page

AB-886 Transportation service network provider: passenger privacy.(2015-2016)

SHARE THIS: share this bill in Facebook share this bill in Twitter
AB886:v97#DOCUMENT

Amended  IN  Assembly  January 04, 2016
Amended  IN  Assembly  March 26, 2015

CALIFORNIA LEGISLATURE— 2015–2016 REGULAR SESSION

Assembly Bill
No. 886

Introduced by Assembly Member Chau

February 26, 2015

An act to amend Section Sections 5431 and 5437 of, and to add Section 5437.5 to, the Public Utilities Code, relating to transportation.


LEGISLATIVE COUNSEL'S DIGEST


AB 886, as amended, Chau. Transportation service network provider: passenger privacy.
The Passenger Charter-Party Carriers’ Act prohibits a transportation network company from disclosing personally identifiable information of a passenger, except as provided with certain exceptions, including when the passenger knowingly consents or pursuant to a legal obligation. A violation of the act is a crime.

This bill would prohibit a transportation service network provider, as defined, from requesting or requiring personally identifiable data, as defined, of a passenger unless the information is used for certain purposes, including establishing, maintaining, and updating a customer’s account. The bill would require the transportation service network provider to provide an accountholder with an opportunity to cancel or terminate an account. The bill would require a transportation service network provider to destroy or dispose of all personally identifiable data in a secure manner when the information is no longer needed for the purposes for which it was collected or when an accountholder cancels or terminates his or her account. Because a violation of these provisions would be a crime, this bill would impose a state-mandated local program.

This bill would modify the knowing consent exception to the prohibition against disclosure of personally identifiable information by requiring the affirmative consent of a passenger through an opt-in selection that is separate from and not conditioned on various other transactions between the passenger and the transportation network company. The bill would modify the legal obligation exception to the prohibition against disclosure of personally identifiable information by instead providing for disclosure pursuant to law, regulation, or court order. The bill would define personally identifiable information. By changing the definition of a crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: YES  

The people of the State of California do enact as follows:


SECTION 1.

 Section 5431 of the Public Utilities Code is amended to read:

5431.
 (a) As used in this article, a “transportation network company” is an organization, including, but not limited to, a corporation, limited liability company, partnership, sole proprietor, or any other entity, operating in California that provides prearranged transportation services for compensation using an online-enabled application or platform to connect passengers with drivers using a personal vehicle.
(b) As used in this article, “participating driver” or “driver” is any person who uses a vehicle in connection with a transportation network company’s online-enabled application or platform to connect with passengers.
(c) As used in this article, “transportation network company insurance” is a liability insurance policy that specifically covers liabilities arising from a driver’s use of a vehicle in connection with a transportation network company’s online-enabled application or platform.
(d) As used in this article, “personally identifiable information,” with respect to a transportation network company passenger, shall include electronic communication information, as defined by subdivision (d) of Section 1546 of the Penal Code, electronic device information, as defined by subdivision (g) of Section 1546 of the Penal Code, and subscriber information, as defined by subdivision (l) of Section 1546 of the Penal Code, and the social security number, physical characteristics, or financial information of the passenger.

SECTION 1.SEC. 2.

 Section 5437 of the Public Utilities Code is amended to read:

5437.
 (a) A transportation network company shall not disclose to a third party any personally identifiable information of a transportation network company passenger unless one of the following applies:
(1) The customer knowingly consents. passenger affirmatively consents through an opt-in selection. Consent shall be distinct from any transaction or service provided, and shall be acquired in a format that is separate from the financial transaction for services. Consent shall not be required by the transportation network company as a condition of accepting or processing a transaction, as a condition of creating a user account, if a user account is required by the transportation network company, or as a condition of downloading or installing a mobile application.
(2) Pursuant to a legal obligation. law, regulation, or court order.
(3) The disclosure is to the commission in order to investigate a complaint filed with the commission against a transportation network company or a participating driver and the commission treats the information under confidentiality protections.

(b)This section does not apply to personally identifiable information of a transportation network passenger collected pursuant to Section 5437.5.

(b) Nothing in this section shall prohibit a transportation network company from sharing any personally identifiable information of a transportation network company passenger for the detection, investigation, or prevention of fraud, theft, identity theft, or other criminal activity if the personally identifiable information is used solely for those purposes by recipients of the personally identifiable information.

SEC. 2.Section 5437.5 is added to the Public Utilities Code, to read:
5437.5.

(a)For purposes of this section, the following terms mean the following:

(1)“Personally identifiable data” means any of the following:

(A)Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics, address, email address, telephone number, bank account number, credit card number, debit card number, or any other financial information.

(B)Information describing or concerning the duration of the transportation service provided, the location and route of the service provided, and the monetary exchange associated with the service provided.

(C)Information relating to the mobile device or computer used to arrange transportation related services, including Internet protocol address (MAC), media access control address, device applications, and geolocational information.

(2)“Transportation service network provider” means any corporation, limited liability company, partnership, sole proprietor, or any other entity, operating in California, including, notwithstanding Section 5353, any entity that provides taxicab transportation services, that provides prearranged transportation service for compensation using an online-enabled application or platform to connect to passengers.

(b)(1)When rendering transportation services, a transportation service network provider shall not request or require any personally identifiable data of a passenger or accountholder unless the information is required to complete a transaction for the transportation service being provided or for the detection, investigation, or prevention of fraud, identity and other theft, or other criminal activity, and the personally identifiable data is used solely for those purposes.

(2)The transportation service network provider shall not disclose any personally identifiable data collected pursuant to this subdivision to any other person, firm, partnership, association, or corporation unless it is required to do so by state or federal law, or is contractually obligated to share the information with a financial entity to complete the transaction, or for the detection, investigation, or prevention of fraud, identity or other theft, or other criminal activity.

(c)(1)A transportation service network provider may request or require a consumer to establish an account as a condition of the transportation service and may require a customer to provide personally identifiable data to establish, maintain, and update the account if the information collected is used solely for those purposes.

(2)A transportation service network provider shall provide an accountholder with an opportunity to cancel or terminate the account at which time the transportation service network provider shall destroy or dispose of all personally identifiable data it required for the account in a secure manner.

(d)A transportation service network provider shall destroy or dispose of all personally identifiable data it acquires pursuant to this section in a secure manner after the information is no longer needed for the purposes authorized under this section.

(e)(1)A transportation service network provider that violates this section shall be subject to a civil penalty not to exceed two hundred fifty dollars ($250) for the first violation and one thousand dollars ($1,000) for each subsequent violation.

(2)The civil penalty shall be assessed and collected in a civil action brought by any aggrieved person, the Attorney General, or by a district attorney or city attorney of the jurisdiction in which an aggrieved person resides.

(3)The court shall direct the recovery of full costs, including attorneys’ fees, to the prevailing party.

(f)(1)The Attorney General, or district attorney or city attorney with appropriate jurisdiction, may bring an action in the superior court in the name of the People of the State of California to enjoin a violation of this section.

(2)Upon notice of not less than five days to a transportation service network provider, the Attorney General, district attorney, or city attorney may seek to temporarily restrain and preliminary enjoin a violation of this section.

(3)If the court determines that the transportation service network provider has violated this section, the court may restrain or enjoin the violation without requiring proof that any person has been damaged by the violation.

(4)In an action brought pursuant to this subdivision, if the court finds that a transportation service network provider has violated this section, the court may direct the transportation service network provider to pay the costs incurred by the Attorney General, district attorney, or city attorney.

(g)The court may consolidate an action for the assessment and collection of civil penalties with an action for injunctive relief brought pursuant to subdivision (f).

SEC. 3.

 No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.