99130.
(a) The University of California, the California State University, the California Community Colleges, any private or independent institution of higher education, and any campus or research institution that is a part of, managed by, or affiliated with any of those segments, shall, prior to entering into a contract with a federal intelligence agency, determine whether the proposed contract would involve the analysis or processing of personally identifiable information. If the institution determines that this is the case, it shall require the federal intelligence agency to disclose whether the personally identifiable information was collected with the
knowledge of the individuals to whom it pertains.(b) An institution described in subdivision (a) shall require a proposed contract to be approved at an open and public meeting of the institution’s governing board and shall disclose the type of research and information sought by the federal intelligence agency, if the proposed contract would do any of the following:
(1) Involve the analysis or processing of personally identifiable information that was collected without the knowledge of the individuals to whom it pertains.
(2) Involve the analysis or processing of disaggregated personally identifiable information, or deidentified but reidentifiable information, about individuals.
(3) Potentially assist in the analytical processing of personally identifiable information of individuals.
(4) Assist in the conduct of surveillance activities performed
by, or on behalf of, a federal intelligence agency.
(c) An institution described in subdivision (a) shall disclose, on an annual basis, the number of contracts with federal intelligence agencies where the agency sponsoring the contract imposes a limit or restriction on the publication of research.
(d) An institution described in subdivision (a) shall not enter into a contract with a federal intelligence agency that imposes limits or restrictions on the publication of research if the contract would involve the analysis or processing of personally identifiable information collected without the knowledge of the individuals to whom it pertains.
(e) As used in this section, the following terms have the following meanings:
(1) “Individual” means a natural person, regardless of citizenship.
(2) “Personally identifiable information” means information that can be used to distinguish or trace an individual’s identity, including, but not limited to, an individual’s name, social security number, or biometric records, whether alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.