What happened?

On September 11 and 12, 2024, the California Legislature presented to the governor Bill AB 1008 and SB 1223, which would amend the California Consumer Privacy Act of 2018 in California. It is waiting for the governor’s signature.

Quick Summary:

• The bill expands personal and sensitive information to include AI-processed and neural data, ensuring privacy protections. It mandates clear AI and data privacy regulations, requiring business transparency.
• Consumers have the right to know what data is collected, used, and disclosed.

What are the details?

Key Bites:

• Expansion of Personal & Sensitive Information Definition:
  • The bill expands the definition to include data stored and processed by AI systems and in all formats (physical, digital, and abstract). It also includes neural data as sensitive information, putting the legislation on par with Colorado (SB1223).
  • This ensures that personal data managed by AI technologies is subject to the same privacy protections as other types of personal information.
  • Neural data refers to information generated by measuring the activity of a consumer’s central or peripheral nervous system.

• Regulatory Framework:
  • The bills emphasize the need for clear regulations around AI and data privacy.
  • AB 1008 aims to address the growing integration of AI in various sectors by ensuring that businesses are transparent about their data collection and processing practices.
  • SB 1223 aims to ensure that businesses managing neural data are transparent about their practices and comply with privacy standards.
  • The duo bill (SB 1223 and AB 1008) has some provisions that are contingent on each other becoming law for their respective changes to become operative.

• Consumer Rights:
  • Businesses are required to disclose their data collection practices to consumers at or before the point of collection.
  • Consumers retain the right to know what personal information is being collected, how it is being used, and to whom it is being disclosed.
  • Neural data includes the right for consumers to know what neural data is being collected, how it is being used, and to whom it is being disclosed.

Business Considerations

• Companies will need to update their privacy policies and practices to comply with the new requirements, particularly those involving AI systems. This also means Enhanced protections and greater transparency regarding how their personal data is managed, especially in the context of AI.
• Employers should update privacy policies to include AI-processed data in all formats and recognize neural data as sensitive information.
• Employers should disclose data collection practices to consumers at or before collection and provide transparency about the use and disclosure of personal and neural data.

Source References

• California Privacy and AI Legislation Update: August 12, 2024 (Husch Blackwell LLP)
• CA AB 1008
• CA SB 1223

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.