J & N REALTY, INC.

SELECTED PRIVACY LAWS  

CALIFORNIA BUSINESS AND PROFESSIONS CODE 

22575.  (a) An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance. 

   (b) The privacy policy required by subdivision (a) shall do all of the following: 

   (1) Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information. 

   (2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the Web site or online service, provide a description of that process. 

   (3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site or online service of material changes to the operator's privacy policy for that Web site or online service. 

   (4) Identify its effective date. 

22576.  An operator of a commercial Web site or online service that collects personally identifiable information through the Web site or online service from individual consumers who use or visit the commercial Web site or online service and who reside in California shall be in violation of this section if the operator fails to comply with the provisions of Section 22575 or with the provisions of its posted privacy policy in either of the following ways: 

   (a) Knowingly and willfully. 

   (b) Negligently and materially. 

22577.  For the purposes of this chapter, the following definitions apply: 

   (a) The term "personally identifiable information" means individually identifiable information about an individual consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following: 

   (1) A first and last name. 

   (2) A home or other physical address, including street name and name of a city or town. 

   (3) An e-mail address. 

   (4) A telephone number. 

   (5) A social security number. 

   (6) Any other identifier that permits the physical or online contacting of a specific individual. 

   (7) Information concerning a user that the Web site or online service collects online from the user and maintains in personally identifiable form in combination with an identifier described in this subdivision. 

   (b) The term "conspicuously post" with respect to a privacy policy shall include posting the privacy policy through any of the following: 

   (1) A Web page on which the actual privacy policy is posted if the Web page is the homepage or first significant page after entering the Web site. 

   (2) An icon that hyperlinks to a Web page on which the actual privacy policy is posted, if the icon is located on the homepage or the first significant page after entering the Web site, and if the icon contains the word "privacy." The icon shall also use a color that contrasts with the background color of the Web page or is otherwise distinguishable. 

   (3) A text link that hyperlinks to a Web page on which the actual privacy policy is posted, if the text link is located on the homepage or first significant page after entering the Web site, and if the text link does one of the following: 

   (A) Includes the word "privacy." 

   (B) Is written in capital letters equal to or greater in size than the surrounding text. 

   (C) Is written in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the language. 

   (4) Any other functional hyperlink that is so displayed that a reasonable person would notice it. 

   (5) In the case of an online service, any other reasonably accessible means of making the privacy policy available for consumers of the online service. 

   (c) The term "operator" means any person or entity that owns a Web site located on the Internet or an online service that collects and maintains personally identifiable information from a consumer residing in California who uses or visits the Web site or online service if the Web site or online service is operated for commercial purposes. It does not include any third party that operates, hosts, or manages, but does not own, a Web site or online service on the owner's behalf or by processing information on behalf of the owner. 

   (d) The term "consumer" means any individual who seeks or acquires, by purchase or lease, any goods, services, money, or credit for personal, family, or household purposes. 

22578.  It is the intent of the Legislature that this chapter is a matter of statewide concern. This chapter supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, city and county, municipality, or local agency regarding the posting of a privacy policy on an Internet Web site. 

CALIFORNIA CIVIL CODE 

1725. (a) Unless permitted under subdivision (c), no person accepting a negotiable instrument as payment in full or in part for goods or services sold or leased at retail shall do any of the following: 

   (1) Require the person paying with a negotiable instrument to provide a credit card as a condition of acceptance of the negotiable instrument, or record the number of the credit card. 

   (2) Require, as a condition of acceptance of the negotiable instrument, or cause the person paying with a negotiable instrument to sign a statement agreeing to allow his or her credit card to be charged to cover the negotiable instrument if returned as no good. 

   (3) Record a credit card number in connection with any part of the transaction described in this subdivision. 

   (4) Contact a credit card issuer to determine if the amount of any credit available to the person paying with a negotiable instrument will cover the amount of the negotiable instrument. 

   (b) For the purposes of this section, the following terms have the following meanings: 

   (1) "Check guarantee card" means a card issued by a financial institution, evidencing an agreement under which the financial institution will not dishonor a check drawn upon itself, under the terms and conditions of the agreement. 

   (2) "Credit card" has the meaning specified in Section 1747.02, and does not include a check guarantee card or a card that is both a credit card and a check guarantee card. 

   (3) "Negotiable instrument" has the meaning specified in Section 3104 of the Commercial Code. 

   (4) "Retail" means a transaction involving the sale or lease of goods or services or both, between an individual, corporation, or other entity regularly engaged in business and a consumer, for use by the consumer and not for resale. 

   (c) This section does not prohibit any person from doing any of the following: 

   (1) Requiring the production of reasonable forms of positive identification, other than a credit card, which may include a driver's license or a California state identification card, or where one of these is not available, another form of photo identification, as a condition of acceptance of a negotiable instrument. 

   (2) Requesting, but not requiring, a purchaser to voluntarily display a credit card as an indicia of creditworthiness or financial responsibility, or as an additional identification, provided the only information concerning the credit card which is recorded is the type of credit card displayed, the issuer of the card, and the expiration date of the card. All retailers that request the display of a credit card pursuant to this paragraph shall inform the customer, by either of the following methods, that displaying the credit card is not a requirement for check writing: 

   (A) By posting the following notice in a conspicuous location in the unobstructed view of the public within the premises where the check is being written, clearly and legibly: "Check writing ID: credit card may be requested but not required for purchases." 

   (B) By training and requiring the sales clerks or retail employees requesting the credit card to inform all check writing customers that they are not required to display a credit card to write a check. 

   (3) Requesting production of, or recording, a credit card number as a condition for cashing a negotiable instrument that is being used solely to receive cash back from the person. 

   (4) Requesting, receiving, or recording a credit card number in lieu of requiring a deposit to secure payment in event of default, loss, damage, or other occurrence. 

   (5) Requiring, verifying, and recording the purchaser's name, address, and telephone number. 

   (6) Requesting or recording a credit card number on a negotiable instrument used to make a payment on that credit card account. 

   (d) This section does not require acceptance of a negotiable instrument whether or not a credit card is presented. 

   (e) Any person who violates this section is subject to a civil penalty not to exceed two hundred fifty dollars ($250) for a first violation, and to a civil penalty not to exceed one thousand dollars ($1,000) for a second or subsequent violation, to be assessed and collected in a civil action brought by the person paying with a negotiable instrument, by the Attorney General, or by the district attorney or city attorney of the county or city in which the violation occurred. However, no civil penalty shall be assessed for a violation of this section if the defendant shows by a preponderance of the evidence that the violation was not intentional and resulted from a bona fide error made notwithstanding the defendant's maintenance of procedures reasonably adopted to avoid such an error. 

When collected, the civil penalty shall be payable, as appropriate, to the person paying with a negotiable instrument who brought the action or to the general fund of whichever governmental entity brought the action to assess the civil penalty. 

   (f) The Attorney General, or any district attorney or city attorney within his or her respective jurisdiction, may bring an action in the superior court in the name of the people of the State of California to enjoin violation of subdivision (a) and, upon notice to the defendant of not less than five days, to temporarily restrain and enjoin the violation. If it appears to the satisfaction of the court that the defendant has, in fact, violated subdivision (a), the court may issue an injunction restraining further violations, without requiring proof that any person has been damaged by the violation. In these proceedings, if the court finds that the defendant has violated subdivision (a), the court may direct the defendant to pay any or all costs incurred by the Attorney General, district attorney, or city attorney in seeking or obtaining injunctive relief pursuant to this subdivision. 

   (g) Actions for collection of civil penalties under subdivision (e) and for injunctive relief under subdivision (f) may be consolidated. 

CALIFORNIA INSURANCE CODE 

11580.08.  With respect to disclosure of the fact of an arrest for any violation of the Vehicle Code or of a city or county ordinance or resolution relating to vehicles or their operators or owner which did not result in a conviction, the issuer, or his agency or employee, of any policy of automobile liability insurance (as described in Section 16056 of the Vehicle Code), any motor vehicle liability policy (as described in Section 16450 of the Vehicle Code), or any policy or coverage described in Section 660, shall not inquire of an applicant whether he has been arrested under such circumstances or to condition the issuance of any such policy on the applicant's making such disclosure. 

CALIFORNIA BUSINESS AND PROFESSIONS CODE 

461.  No public agency, state or local, shall, on an initial application form for any license, certificate or registration, ask for or require the applicant to reveal a record of arrest that did not result in a conviction or a plea of nolo contendere. A violation of this section is a misdemeanor. 

   This section shall apply in the case of any license, certificate or registration provided for by any law of this state or local government, including, but not limited to, this code, the Corporations Code, the Education Code, and the Insurance Code. 

CALIFORNIA LABOR CODE 

430.  As used in this article "applicant" means an applicant for employment. 

432.  If an employee or applicant signs any instrument relating to the obtaining or holding of employment, he shall be given a copy of the instrument upon request. 

432.2. (a) No employer shall demand or require any applicant for employment or prospective employment or any employee to submit to or take a polygraph, lie detector or similar test or examination as a condition of employment or continued employment. The prohibition of this section does not apply to the federal government or any agency thereof or the state government or any agency or local subdivision thereof, including, but not limited to, counties, cities and counties, cities, districts, authorities, and agencies. 

   (b) No employer shall request any person to take such a test, or administer such a test, without first advising the person in writing at the time the test is to be administered of the rights guaranteed by this section. 

432.5.  No employer, or agent, manager, superintendent, or officer thereof, shall require any employee or applicant for employment to agree, in writing, to any term or condition which is known by such employer, or agent, manager, superintendent, or officer thereof to be prohibited by law. 

432.7.  (a) No employer, whether a public agency or private individual or corporation, shall ask an applicant for employment to disclose, through any written form or verbally, information concerning an arrest or detention that did not result in conviction, or information concerning a referral to, and participation in, any pretrial or posttrial diversion program, nor shall any employer seek from any source whatsoever, or utilize, as a factor in determining any condition of employment including hiring, promotion, termination, or any apprenticeship training program or any other training program leading to employment, any record of arrest or detention that did 

not result in conviction, or any record regarding a referral to, and participation in, any pretrial or posttrial diversion program. As used in this section, a conviction shall include a plea, verdict, or finding of guilt regardless of whether sentence is imposed by the court. Nothing in this section shall prevent an employer from asking an employee or applicant for employment about an arrest for which the employee or applicant is out on bail or on his or her own recognizance pending trial. 

   (b) Nothing in this section shall prohibit the disclosure of the information authorized for release under Sections 13203 and 13300 of the Penal Code, to a government agency employing a peace officer. However, the employer shall not determine any condition of employment other than paid administrative leave based solely on an arrest report. The information contained in an arrest report may be used as the starting point for an independent, internal investigation of a peace officer in accordance with Chapter 9.7 (commencing with Section 3300) of Division 4 of Title 1 of the Government Code. 

   (c) In any case where a person violates this section, or Article 6 (commencing with Section 11140) of Chapter 1 of Title 1 of Part 4 of the Penal Code, the applicant may bring an action to recover from that person actual damages or two hundred dollars ($200), whichever is greater, plus costs, and reasonable attorney's fees. An intentional violation of this section shall entitle the applicant to treble actual damages, or five hundred dollars ($500), whichever is greater, plus costs, and reasonable attorney's fees. An intentional violation of this section is a misdemeanor punishable by a fine not to exceed five hundred dollars ($500). 

   (d) The remedies under this section shall be in addition to and not in derogation of all other rights and remedies that an applicant may have under any other law. 

   (e) Persons seeking employment or persons already employed as peace officers or persons seeking employment for positions in the Department of Justice or other criminal justice agencies as defined in Section 13101 of the Penal Code are not covered by this section. 

   (f) Nothing in this section shall prohibit an employer at a health facility, as defined in Section 1250 of the Health and Safety Code, from asking an applicant for employment either of the following: 

   (1) With regard to an applicant for a position with regular access to patients, to disclose an arrest under any section specified in Section 290 of the Penal Code. 

   (2) With regard to an applicant for a position with access to drugs and medication, to disclose an arrest under any section specified in Section 11590 of the Health and Safety Code. 

   (g) (1) No peace officer or employee of a law enforcement agency with access to criminal offender record information maintained by a local law enforcement criminal justice agency shall knowingly disclose, with intent to affect a person's employment, any information contained therein pertaining to an arrest or detention or proceeding that did not result in a conviction, including information pertaining to a referral to, and participation in, any pretrial or posttrial diversion program, to any person not authorized by law to receive that information. 

   (2) No other person authorized by law to receive criminal offender record information maintained by a local law enforcement criminal justice agency shall knowingly disclose any information received therefrom pertaining to an arrest or detention or proceeding that did not result in a conviction, including information pertaining to a referral to, and participation in, any pretrial or posttrial diversion program, to any person not authorized by law to receive that information. 

   (3) No person, except those specifically referred to in Section 1070 of the Evidence Code, who knowing he or she is not authorized by law to receive or possess criminal justice records information maintained by a local law enforcement criminal justice agency, pertaining to an arrest or other proceeding that did not result in a conviction, including information pertaining to a referral to, and participation in, any pretrial or posttrial diversion program, shall receive or possess that information. 

   (h) "A person authorized by law to receive that information," for purposes of this section, means any person or public agency authorized by a court, statute, or decisional law to receive information contained in criminal offender records maintained by a local law enforcement criminal justice agency, and includes, but is not limited to, those persons set forth in Section 11105 of the Penal Code, and any person employed by a law enforcement criminal justice agency who is required by that employment to receive, analyze, or process criminal offender record information. 

   (i) Nothing in this section shall require the Department of Justice to remove entries relating to an arrest or detention not resulting in conviction from summary criminal history records forwarded to an employer pursuant to law.  

   (j) As used in this section, "pretrial or posttrial diversion program" means any program under Chapter 2.5 (commencing with Section 1000) or Chapter 2.7 (commencing with Section 1001) of Title 6 of Part 2 of the Penal Code, Section 13201 or 13352.5 of the Vehicle Code, or any other program expressly authorized and described by statute as a diversion program. 

   (k) (1) Subdivision (a) shall not apply to any city, city and county, county, or district, or any officer or official thereof, in screening a prospective concessionaire, or the affiliates and associates of a prospective concessionaire for purposes of consenting to, or approving of, the prospective concessionaire's application for, or acquisition of, any beneficial interest in a concession, lease, or other property interest. 

   (2) For purposes of this subdivision the following terms have the following meanings: 

   (A) "Screening" means a written request for criminal history information made to a local law enforcement agency. 

   (B) "Prospective concessionaire" means any individual, general or limited partnership, corporation, trust, association, or other entity that is applying for, or seeking to obtain, a public agency's consent to, or approval of, the acquisition by that individual or entity of any beneficial ownership interest in any public agency's concession, lease, or other property right whether directly or indirectly held. However, "prospective concessionaire" does not include any of the following: 

   (i) A lender acquiring an interest solely as security for a bona fide loan made in the ordinary course of the lender's business and not made for the purpose of acquisition. 

   (ii) A lender upon foreclosure or assignment in lieu of foreclosure of the lender's security. 

   (C) "Affiliate" means any individual or entity that controls, or is controlled by, the prospective concessionaire, or who is under common control with the prospective concessionaire. 

   (D) "Associate" means any individual or entity that shares a common business purpose with the prospective concessionaire with respect to the beneficial ownership interest that is subject to the consent or approval of the city, county, city and county, or district. 

   (E) "Control" means the possession, direct or indirect, of the power to direct, or cause the direction of, the management or policies of the controlled individual or entity. 

   (l) (1) Nothing in subdivision (a) shall prohibit a public agency, or any officer or official thereof, from denying consent to, or approval of, a prospective concessionaire's application for, or acquisition of, any beneficial interest in a concession, lease, or other property interest based on the criminal history information of the prospective concessionaire or the affiliates or associates of the prospective concessionaire that show any criminal conviction for offenses involving moral turpitude. Criminal history information for purposes of this subdivision includes any criminal history information obtained pursuant to Section 11105 or 13300 of the Penal Code. 

   (2) In considering criminal history information, a public agency shall consider the crime for which the prospective concessionaire or the affiliates or associates of the prospective concessionaire was convicted only if that crime relates to the specific business that is proposed to be conducted by the prospective concessionaire. 

   (3) Any prospective concessionaire whose application for consent or approval to acquire a beneficial interest in a concession, lease, or other property interest is denied based on criminal history information shall be provided a written statement of the reason for the denial. 

   (4) (A) If the prospective concessionaire submits a written request to the public agency within 10 days of the date of the notice of denial, the public agency shall review its decision with regard to any corrected record or other evidence presented by the prospective concessionaire as to the accuracy or incompleteness of the criminal history information utilized by the public agency in making its original decision. 

   (B) The prospective concessionaire shall submit the copy or the corrected record of any other evidence to the public agency within 90 days of a request for review. The public agency shall render its decision within 20 days of the submission of evidence by the prospective concessionaire. 

432.8.  The limitations on employers and the penalties provided for in Section 432.7 shall apply to a conviction for violation of subdivision (b) or (c) of Section 11357 of the Health and Safety Code or a statutory predecessor thereof, or subdivision (c) of Section 11360 of the Health and Safety Code, or Section 11364, 11365, or 11550 of the Health and Safety Code as they related to marijuana prior to January 1, 1976, or a statutory predecessor thereof, two years from the date of such a conviction. 

433.  Any person violating this article is guilty of a misdemeanor. 

434.  The provisions of this article shall not apply to applications for employment filed with common carriers by railroad subject to the act of Congress known as the Railway Labor Act. 

435.  (a) No employer may cause an audio or video recording to be made of an employee in a restroom, locker room, or room designated by an employer for changing clothes, unless authorized by court order. 

   (b) No recording made in violation of this section may be used by an employer for any purpose. This section applies to a private or public employer, except the federal government. 

   (c) A violation of this section constitutes an infraction. 

CALIFORNIA CIVIL CODE 

1798.80. The following definitions apply to this title: 

   (a) "Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered, or holding a license or authorization certificate under the law of this state, any other state, the United States, or of any other country, or the parent or the subsidiary of a financial institution. The term includes an entity that disposes of records. 

   (b) "Records" means any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed, or electromagnetically transmitted. "Records" does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number. 

   (c) "Customer" means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business. 

   (d) "Individual" means a natural person. 

   (e) "Personal information" means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.  "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. 

1798.81.  A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by (a) shredding, (b) erasing, or (c) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means. 

1798.81.5. (a) It is the intent of the Legislature to ensure that personal information about California residents is protected. To that end, the purpose of this section is to encourage businesses that own or license personal information about Californians to provide reasonable security for that information. For the purpose of this section, the phrase "owns or licenses" is intended to include, but is not limited to, personal information that a business retains as part of the business' internal customer account or for the purpose of using that information in transactions with the person to whom the information relates. 

   (b) A business that owns or licenses personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. 

   (c) A business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party shall require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. 

   (d) For purposes of this section, the following terms have the following meanings: 

   (1) "Personal information" means an individual's first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: 

   (A) Social security number. 

   (B) Driver's license number or California identification card number. 

   (C) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account. 

   (D) Medical information. 

   (2) "Medical information" means any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a health care professional. 

   (3) "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. 

   (e) The provisions of this section do not apply to any of the following: 

   (1) A provider of health care, health care service plan, or contractor regulated by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1). 

   (2) A financial institution as defined in Section 4052 of the Financial Code and subject to the California Financial Information Privacy Act (Division 1.2 (commencing with Section 4050) of the Financial Code. 

   (3) A covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996 (HIPAA). 

   (4) An entity that obtains information under an agreement pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code and is subject to the confidentiality requirements of the Vehicle Code. 

   (5) A business that is regulated by state or federal law providing greater protection to personal information than that provided by this section in regard to the subjects addressed by this section. 

Compliance with that state or federal law shall be deemed compliance with this section with regard to those subjects. This paragraph does not relieve a business from a duty to comply with any other requirements of other state and federal law regarding the protection and privacy of personal information. 

1798.82. (a) Any person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. 

   (b) Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. 

   (c) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation. 

   (d) For purposes of this section, "breach of the security of the system" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure. 

   (e) For purposes of this section, "personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: 

   (1) Social security number. 

   (2) Driver's license number or California Identification Card number. 

   (3) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account. 

   (4) Medical information. 

   (5) Health insurance information. 

   (f) (1) For purposes of this section, "personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. 

   (2) For purposes of this section, "medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional. 

   (3) For purposes of this section, "health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual's application and claims history, including any appeals records. 

   (g) For purposes of this section, "notice" may be provided by one of the following methods: 

   (1) Written notice. 

   (2) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code. 

   (3) Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following: 

   (A) E-mail notice when the person or business has an e-mail address for the subject persons. 

   (B) Conspicuous posting of the notice on the Web site page of the person or business, if the person or business maintains one. 

   (C) Notification to major statewide media. 

   (h) Notwithstanding subdivision (g), a person or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this part, shall be deemed to be in compliance with the notification requirements of this section if the person or business notifies subject persons in accordance with its policies in the event of a breach of security of the system. 

1798.83.  (a) Except as otherwise provided in subdivision (d), if a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information that corresponds to any of the categories of personal information set forth in paragraph (6) of subdivision (e) to third parties, and if the business knows or reasonably should know that the third parties used the personal information for the third parties' direct marketing purposes, that business shall, after the receipt of a written or electronic mail request, or, if the business chooses to receive requests by toll-free telephone or facsimile numbers, a telephone or facsimile request from the customer, provide all of the following information to the customer free of charge: 

   (1) In writing or by electronic mail, a list of the categories set forth in paragraph (6) of subdivision (e) that correspond to the personal information disclosed by the business to third parties for the third parties' direct marketing purposes during the immediately preceding calendar year. 

   (2) In writing or by electronic mail, the names and addresses of all of the third parties that received personal information from the business for the third parties' direct marketing purposes during the preceding calendar year and, if the nature of the third parties' business cannot reasonably be determined from the third parties' name, examples of the products or services marketed, if known to the business, sufficient to give the customer a reasonable indication of the nature of the third parties' business. 

   (b) (1) A business required to comply with this section shall designate a mailing address, electronic mail address, or, if the business chooses to receive requests by telephone or facsimile, a toll-free telephone or facsimile number, to which customers may deliver requests pursuant to subdivision (a). A business required to comply with this section shall, at its election, do at least one of the following: 

   (A) Notify all agents and managers who directly supervise employees who regularly have contact with customers of the designated addresses or numbers or the means to obtain those addresses or numbers and instruct those employees that customers who inquire about the business's privacy practices or the business's compliance with this section shall be informed of the designated addresses or numbers or the means to obtain the addresses or numbers. 

   (B) Add to the home page of its Web site a link either to a page titled "Your Privacy Rights" or add the words "Your Privacy Rights" to the home page's link to the business's privacy policy. If the business elects to add the words "Your Privacy Rights" to the link to the business's privacy policy, the words "Your Privacy Rights" shall be in the same style and size as the link to the business's privacy policy. If the business does not display a link to its privacy policy on the home page of its Web site, or does not have a privacy policy, the words "Your Privacy Rights" shall be written in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the language. The first page of the link shall describe a customer's rights pursuant to this section and shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number, as appropriate. If the business elects to add the words "Your California Privacy Rights" to the home page's link to the business's privacy policy in a manner that complies with this subdivision, and the first page of the link describes a customer's rights pursuant to this section, and provides the designated mailing address, electronic mailing address, as required, or toll-free telephone or facsimile number, as appropriate, the business need not respond to requests that are not received at one of the designated addresses or numbers. 

   (C) Make the designated addresses or numbers, or means to obtain the designated addresses or numbers, readily available upon request of a customer at every place of business in California where the business or its agents regularly have contact with customers. 

   The response to a request pursuant to this section received at one of the designated addresses or numbers shall be provided within 30 days. Requests received by the business at other than one of the designated addresses or numbers shall be provided within a reasonable period, in light of the circumstances related to how the request was received, but not to exceed 150 days from the date received. 

   (2) A business that is required to comply with this section and Section 6803 of Title 15 of the United States Code may comply with this section by providing the customer the disclosure required by Section 6803 of Title 15 of the United States Code, but only if the disclosure also complies with this section. 

   (3) A business that is required to comply with this section is not obligated to provide information associated with specific individuals and may provide the information required by this section in standardized format. 

   (c) (1) A business that is required to comply with this section is not obligated to do so in response to a request from a customer more than once during the course of any calendar year. A business with fewer than 20 full-time or part-time employees is exempt from the requirements of this section. 

   (2) If a business that is required to comply with this section adopts and discloses to the public, in its privacy policy, a policy of not disclosing personal information of customers to third parties for the third parties' direct marketing purposes unless the customer first affirmatively agrees to that disclosure, or of not disclosing the personal information of customers to third parties for the third parties' direct marketing purposes if the customer has exercised an option that prevents that information from being disclosed to third parties for those purposes, as long as the business maintains and discloses the policies, the business may comply with subdivision (a) by notifying the customer of his or her right to prevent disclosure of personal information, and providing the customer with a cost-free means to exercise that right. 

   (d) The following are among the disclosures not deemed to be disclosures of personal information by a business for a third party's direct marketing purposes for purposes of this section: 

   (1) Disclosures between a business and a third party pursuant to contracts or arrangements pertaining to any of the following: 

   (A) The processing, storage, management, or organization of personal information, or the performance of services on behalf of the business during which personal information is disclosed, if the third party that processes, stores, manages, or organizes the personal information does not use the information for a third party's direct marketing purposes and does not disclose the information to additional third parties for their direct marketing purposes. 

   (B) Marketing products or services to customers with whom the business has an established business relationship where, as a part of the marketing, the business does not disclose personal information to third parties for the third parties' direct marketing purposes. 

   (C) Maintaining or servicing accounts, including credit accounts and disclosures pertaining to the denial of applications for credit or the status of applications for credit and processing bills or insurance claims for payment. 

   (D) Public record information relating to the right, title, or interest in real property or information relating to property characteristics, as defined in Section 408.3 of the Revenue and Taxation Code, obtained from a governmental agency or entity or from a multiple listing service, as defined in Section 1087, and not provided directly by the customer to a business in the course of an established business relationship. 

   (E) Jointly offering a product or service pursuant to a written agreement with the third party that receives the personal information, provided that all of the following requirements are met: 

   (i) The product or service offered is a product or service of, and is provided by, at least one of the businesses that is a party to the written agreement. 

   (ii) The product or service is jointly offered, endorsed, or sponsored by, and clearly and conspicuously identifies for the customer, the businesses that disclose and receive the disclosed personal information. 

   (iii) The written agreement provides that the third party that receives the personal information is required to maintain the confidentiality of the information and is prohibited from disclosing or using the information other than to carry out the joint offering or servicing of a product or service that is the subject of the written agreement. 

   (2) Disclosures to or from a consumer reporting agency of a customer's payment history or other information pertaining to transactions or experiences between the business and a customer if that information is to be reported in, or used to generate, a consumer report as defined in subdivision (d) of Section 1681a of Title 15 of the United States Code, and use of that information is limited by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). 

   (3) Disclosures of personal information by a business to a third party financial institution solely for the purpose of the business obtaining payment for a transaction in which the customer paid the business for goods or services with a check, credit card, charge card, or debit card, if the customer seeks the information required by subdivision (a) from the business obtaining payment, whether or not the business obtaining payment knows or reasonably should know that the third party financial institution has used the personal information for its direct marketing purposes. 

   (4) Disclosures of personal information between a licensed agent and its principal, if the personal information disclosed is necessary to complete, effectuate, administer, or enforce transactions between the principal and the agent, whether or not the licensed agent or principal also uses the personal information for direct marketing purposes, if that personal information is used by each of them solely to market products and services directly to customers with whom both have established business relationships as a result of the principal and agent relationship. 

   (5) Disclosures of personal information between a financial institution and a business that has a private label credit card, affinity card, retail installment contract, or cobranded card program with the financial institution, if the personal information disclosed is necessary for the financial institution to maintain or service accounts on behalf of the business with which it has a private label credit card, affinity card, retail installment contract, or cobranded card program, or to complete, effectuate, administer, or enforce customer transactions or transactions between the institution and the business, whether or not the institution or the business also uses the personal information for direct marketing purposes, if that personal information is used solely to market products and services directly to customers with whom both the business and the financial institution have established business relationships as a result of the private label credit card, affinity card, retail installment contract, or cobranded card program. 

   (e) For purposes of this section, the following terms have the following meanings: 

   (1) "Customer" means an individual who is a resident of California who provides personal information to a business during the creation of, or throughout the duration of, an established business relationship if the business relationship is primarily for personal, family, or household purposes. 

   (2) "Direct marketing purposes" means the use of personal information to solicit or induce a purchase, rental, lease, or exchange of products, goods, property, or services directly to individuals by means of the mail, telephone, or electronic mail for their personal, family, or household purposes. The sale, rental, exchange, or lease of personal information for consideration to businesses is a direct marketing purpose of the business that sells, rents, exchanges, or obtains consideration for the personal information. "Direct marketing purposes" does not include the use of personal information (A) by bona fide tax exempt charitable or religious organizations to solicit charitable contributions, (B) to raise funds from and communicate with individuals regarding politics and government, (C) by a third party when the third party receives personal information solely as a consequence of having obtained for consideration permanent ownership of accounts that might contain personal information, or (D) by a third party when the third party receives personal information solely as a consequence of a single transaction where, as a part of the transaction, personal information had to be disclosed in order to effectuate the transaction. 

   (3) "Disclose" means to disclose, release, transfer, disseminate, or otherwise communicate orally, in writing, or by electronic or any other means to any third party. 

   (4) "Employees who regularly have contact with customers" means employees whose contact with customers is not incidental to their primary employment duties, and whose duties do not predominantly involve ensuring the safety or health of the business's customers. It includes, but is not limited to, employees whose primary employment duties are as cashier, clerk, customer service, sales, or promotion. It does not, by way of example, include employees whose primary employment duties consist of food or beverage preparation or service, maintenance and repair of the business's facilities or equipment, direct involvement in the operation of a motor vehicle, aircraft, watercraft, amusement ride, heavy machinery or similar equipment, security, or participation in a theatrical, literary, musical, artistic, or athletic performance or contest. 

   (5) "Established business relationship" means a relationship formed by a voluntary, two-way communication between a business and a customer, with or without an exchange of consideration, for the purpose of purchasing, renting, or leasing real or personal property, or any interest therein, or obtaining a product or service from the business, if the relationship is ongoing and has not been expressly terminated by the business or the customer, or if the relationship is not ongoing, but is solely established by the purchase, rental, or lease of real or personal property from a business, or the purchase of a product or service, and no more than 18 months have elapsed from the date of the purchase, rental, or lease. 

   (6) (A) The categories of personal information required to be disclosed pursuant to paragraph (1) of subdivision (a) are all of the following: 

   (i) Name and address. 

   (ii) Electronic mail address. 

   (iii) Age or date of birth. 

   (iv) Names of children. 

   (v) Electronic mail or other addresses of children. 

   (vi) Number of children. 

   (vii) The age or gender of children. 

   (viii) Height. 

   (ix) Weight. 

   (x) Race. 

   (xi) Religion. 

   (xii) Occupation. 

   (xiii) Telephone number. 

   (xiv) Education. 

   (xv) Political party affiliation. 

   (xvi) Medical condition. 

   (xvii) Drugs, therapies, or medical products or equipment used. 

   (xviii) The kind of product the customer purchased, leased, or rented. 

   (xix) Real property purchased, leased, or rented. 

   (xx) The kind of service provided. 

   (xxi) Social security number. 

   (xxii) Bank account number. 

   (xxiii) Credit card number. 

   (xxiv) Debit card number. 

   (xxv) Bank or investment account, debit card, or credit card balance. 

   (xxvi) Payment history. 

   (xxvii) Information pertaining to the customer's creditworthiness, assets, income, or liabilities. 

   (B) If a list, description, or grouping of customer names or addresses is derived using any of these categories, and is disclosed to a third party for direct marketing purposes in a manner that permits the third party to identify, determine, or extrapolate any other personal information from which the list was derived, and that personal information when it was disclosed identified, described, or was associated with an individual, the categories set forth in this subdivision that correspond to the personal information used to derive the list, description, or grouping shall be considered personal information for purposes of this section. 

   (7) "Personal information" as used in this section means any information that when it was disclosed identified, described, or was able to be associated with an individual and includes all of the following: 

   (A) An individual's name and address. 

   (B) Electronic mail address. 

   (C) Age or date of birth. 

   (D) Names of children. 

   (E) Electronic mail or other addresses of children. 

   (F) Number of children. 

   (G) The age or gender of children. 

   (H) Height. 

   (I) Weight. 

   (J) Race. 

   (K) Religion. 

   (L) Occupation. 

   (M) Telephone number. 

   (N) Education. 

   (O) Political party affiliation. 

   (P) Medical condition. 

   (Q) Drugs, therapies, or medical products or equipment used. 

   (R) The kind of product the customer purchased, leased, or rented. 

   (S) Real property purchased, leased, or rented. 

   (T) The kind of service provided. 

   (U) Social security number. 

   (V) Bank account number. 

   (W) Credit card number. 

   (X) Debit card number. 

   (Y) Bank or investment account, debit card, or credit card balance. 

   (Z) Payment history. 

   (AA) Information pertaining to creditworthiness, assets, income, or liabilities. 

   (8) "Third party" or "third parties" means one or more of the following: 

   (A) A business that is a separate legal entity from the business that has an established business relationship with a customer. 

   (B) A business that has access to a database that is shared among businesses, if the business is authorized to use the database for direct marketing purposes, unless the use of the database is exempt from being considered a disclosure for direct marketing purposes pursuant to subdivision (d). 

   (C) A business not affiliated by a common ownership or common corporate control with the business required to comply with subdivision (a). 

   (f) (1) Disclosures of personal information for direct marketing purposes between affiliated third parties that share the same brand name are exempt from the requirements of paragraph (1) of subdivision (a) unless the personal information disclosed corresponds to one of the following categories, in which case the customer shall be informed of those categories listed in this subdivision that correspond to the categories of personal information disclosed for direct marketing purposes and the third party recipients of personal information disclosed for direct marketing purposes pursuant to paragraph (2) of subdivision (a): 

   (A) Number of children. 

   (B) The age or gender of children. 

   (C) Electronic mail or other addresses of children. 

   (D) Height. 

   (E) Weight. 

   (F) Race. 

   (G) Religion. 

   (H) Telephone number. 

   (I) Medical condition. 

   (J) Drugs, therapies, or medical products or equipment used. 

   (K) Social security number. 

   (L) Bank account number. 

   (M) Credit card number. 

   (N) Debit card number. 

   (O) Bank or investment account, debit card, or credit card balance. 

   (2) If a list, description, or grouping of customer names or addresses is derived using any of these categories, and is disclosed to a third party or third parties sharing the same brand name for direct marketing purposes in  manner that permits the third party to identify, determine, or extrapolate the personal information from which the list was derived, and that personal information when it was disclosed identified, described, or was associated with an individual, any other personal information that corresponds to the categories set forth in this subdivision used to derive the list, description, or grouping shall be considered personal information for purposes of this section. 

   (3) If a business discloses personal information for direct marketing purposes to affiliated third parties that share the same brand name, the business that discloses personal information for direct marketing purposes between affiliated third parties that share the same brand name may comply with the requirements of paragraph (2) of subdivision (a) by providing the overall number of affiliated companies that share the same brand name. 

   (g) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application. 

   (h) This section does not apply to a financial institution that is subject to the California Financial Information Privacy Act (Division 1.2 (commencing with Section 4050) of the Financial Code) if the financial institution is in compliance with Sections 4052, 4052.5, 4053, 4053.5, and 4054.6 of the Financial Code, as those sections read when they were chaptered on August 28, 2003, and as subsequently amended by the Legislature or by initiative. 

   (i) This section shall become operative on January 1, 2005. 

1798.84. (a) Any waiver of a provision of this title is contrary to public policy and is void and unenforceable. 

   (b) Any customer injured by a violation of this title may institute a civil action to recover damages. 

   (c) In addition, for a willful, intentional, or reckless violation of Section 1798.83, a customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83. 

   (d) Unless the violation is willful, intentional, or reckless, a business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively. 

   (e) Any business that violates, proposes to violate, or has violated this title may be enjoined. 

   (f) (1) A cause of action shall not lie against a business for disposing of abandoned records containing personal information by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means. 

   (2) The Legislature finds and declares that when records containing personal information are abandoned by a business, they often end up in the possession of a storage company or commercial landlord. It is the intent of the Legislature in paragraph (1) to create a safe harbor for such a record custodian who properly disposes of the records in accordance with paragraph (1). 

   (g) A prevailing plaintiff in any action commenced under Section 1798.83 shall also be entitled to recover his or her reasonable attorney's fees and costs. 

   (h) The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law. 

CALIFORNIA CIVIL CODE 

1708.8. (a) A person is liable for physical invasion of privacy when the defendant knowingly enters onto the land of another person without permission or otherwise committed a trespass in order to physically invade the privacy of the plaintiff with the intent to capture any type of visual image, sound recording, or other physical impression of the plaintiff engaging in a personal or familial activity and the physical invasion occurs in a manner that is offensive to a reasonable person. 

   (b) A person is liable for constructive invasion of privacy when the defendant attempts to capture, in a manner that is offensive to a reasonable person, any type of visual image, sound recording, or other physical impression of the plaintiff engaging in a personal or familial activity under circumstances in which the plaintiff had a reasonable expectation of privacy, through the use of a visual or auditory enhancing device, regardless of whether there is a physical trespass, if this image, sound recording, or other physical impression could not have been achieved without a trespass unless the visual or auditory enhancing device was used. 

CALIFORNIA PENAL CODE 

630. The Legislature hereby declares that advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society. 

   The Legislature by this chapter intends to protect the right of privacy of the people of this state. 

   The Legislature recognizes that law enforcement agencies have a legitimate need to employ modern listening devices and techniques in the investigation of criminal conduct and the apprehension of lawbreakers. Therefore, it is not the intent of the Legislature to place greater restraints on the use of listening devices and techniques by law enforcement agencies than existed prior to the effective date of this chapter. 

631.  (a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year, or by imprisonment in the state prison, or by both a fine and imprisonment in the county jail or in the state prison. If the person has previously been convicted of a violation of this section or Section 632, 632.5, 632.6, 632.7, or 636, he or she is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the county jail not exceeding one year, or by imprisonment in the state prison, or by both a fine and imprisonment in the county jail or in the state prison. 

   (b) This section shall not apply (1) to any public utility engaged in the business of providing communications services and facilities, or to the officers, employees or agents thereof, where the acts otherwise prohibited herein are for the purpose of construction, maintenance, conduct or operation of the services and facilities of the public utility, or (2) to the use of any instrument, equipment, facility, or service furnished and used pursuant to the tariffs of a public utility, or (3) to any telephonic communication system used for communication exclusively within a state, county, city and county, or city correctional facility. 

   (c) Except as proof in an action or prosecution for violation of this section, no evidence obtained in violation of this section shall be admissible in any judicial, administrative, legislative, or other proceeding. 

   (d) This section shall become operative on January 1, 1994. 

632. (a) Every person who, intentionally and without the consent of all parties to a confidential communication, by means of any electronic amplifying or recording device, eavesdrops upon or records the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), or imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section or Section 631, 632.5, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. 

   (b) The term "person" includes an individual, business association, partnership, corporation, limited liability company, or other legal entity, and an individual acting or purporting to act for or on behalf of any government or subdivision thereof, whether federal, state, or local, but excludes an individual known by all parties to a confidential communication to be overhearing or recording the communication. 

   (c) The term "confidential communication" includes any communication carried on in circumstances as may reasonably indicate that any party to the communication desires it to be confined to the parties thereto, but excludes a communication made in a public gathering or in any legislative, judicial, executive or administrative proceeding open to the public, or in any other circumstance in which the parties to the communication may reasonably expect that the communication may be overheard or recorded. 

   (d) Except as proof in an action or prosecution for violation of this section, no evidence obtained as a result of eavesdropping upon or recording a confidential communication in violation of this section shall be admissible in any judicial, administrative, legislative, or other proceeding. 

   (e) This section does not apply (1) to any public utility engaged in the business of providing communications services and facilities, or to the officers, employees or agents thereof, where the acts otherwise prohibited by this section are for the purpose of construction, maintenance, conduct or operation of the services and facilities of the public utility, or (2) to the use of any instrument, equipment, facility, or service furnished and used pursuant to the tariffs of a public utility, or (3) to any telephonic communication system used for communication exclusively within a state, county, city and county, or city correctional facility. 

   (f) This section does not apply to the use of hearing aids and similar devices, by persons afflicted with impaired hearing, for the purpose of overcoming the impairment to permit the hearing of sounds ordinarily audible to the human ear. 

632.5. (a) Every person who, maliciously and without the consent of all parties to the communication, intercepts, receives, or assists in intercepting or receiving a communication transmitted between cellular radio telephones or between any cellular radio telephone and a landline telephone shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), by imprisonment in the county jail not exceeding one year or in the state prison, or by both that fine and imprisonment. If the person has been previously convicted of a violation of this section or Section 631, 632, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in the county jail not exceeding one year or in the state prison, or by both that fine and imprisonment. 

   (b) In the following instances, this section shall not apply: 

   (1) To any public utility engaged in the business of providing communications services and facilities, or to the officers, employees, or agents thereof, where the acts otherwise prohibited are for the purpose of construction, maintenance, conduct, or operation of the services and facilities of the public utility. 

   (2) To the use of any instrument, equipment, facility, or service furnished and used pursuant to the tariffs of the public utility. 

   (3) To any telephonic communication system used for communication exclusively within a state, county, city and county, or city correctional facility. 

   (c) As used in this section and Section 635, "cellular radio telephone" means a wireless telephone authorized by the Federal Communications Commission to operate in the frequency bandwidth reserved for cellular radio telephones. 

632.6.  (a) Every person who, maliciously and without the consent of all parties to the communication, intercepts, receives, or assists in intercepting or receiving a communication transmitted between cordless telephones as defined in subdivision (c), between any cordless telephone and a landline telephone, or between a cordless telephone and a cellular telephone shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has been convicted previously of a violation of Section 631, 632, 632.5, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. 

   (b) This section shall not apply in any of the following instances: 

   (1) To any public utility engaged in the business of providing communications services and facilities, or to the officers, employees, or agents thereof, where the acts otherwise prohibited are for the purpose of construction, maintenance, conduct, or operation of the services and facilities of the public utility. 

   (2) To the use of any instrument, equipment, facility, or service furnished and used pursuant to the tariffs of the public utility. 

   (3) To any telephonic communications system used for communication exclusively within a state, county, city and county, or city correctional facility. 

   (c) As used in this section and in Section 635, "cordless telephone" means a two-way low power communication system consisting of two parts--a "base" unit which connects to the public switched telephone network and a handset or "remote" unit--which are connected by a radio link and authorized by the Federal Communications Commission to operate in the frequency bandwidths reserved for cordless telephones. 

632.7.  (a) Every person who, without the consent of all parties to a communication, intercepts or receives and intentionally records, or assists in the interception or reception and intentional recordation of, a communication transmitted between two cellular radio telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a cordless telephone and a landline telephone, or a cordless telephone and a cellular radio telephone, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has been convicted previously of a violation of this section or of Section 631, 632, 632.5, 632.6, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. 

   (b) This section shall not apply to any of the following: 

   (1) Any public utility engaged in the business of providing communications services and facilities, or to the officers, employees, or agents thereof, where the acts otherwise prohibited are for the purpose of construction, maintenance, conduct, or operation of the services and facilities of the public utility. 

   (2) The use of any instrument, equipment, facility, or service furnished and used pursuant to the tariffs of the public utility. 

   (3) Any telephonic communication system used for communication exclusively within a state, county, city and county, or city correctional facility. 

   (c) As used in this section, each of the following terms have the following meaning: 

   (1) "Cellular radio telephone" means a wireless telephone authorized by the Federal Communications Commission to operate in the frequency bandwidth reserved for cellular radio telephones. 

   (2) "Cordless telephone" means a two-way, low power communication system consisting of two parts, a "base" unit which connects to the public switched telephone network and a handset or "remote" unit, that are connected by a radio link and authorized by the Federal Communications Commission to operate in the frequency bandwidths reserved for cordless telephones. 

   (3) "Communication" includes, but is not limited to, communications transmitted by voice, data, or image, including facsimile. 

633.  Nothing in Section 631, 632, 632.5, 632.6, or 632.7 prohibits the Attorney General, any district attorney, or any assistant, deputy, or investigator of the Attorney General or any district attorney, any officer of the California Highway Patrol, any chief of police, assistant chief of police, or police officer of a city or city and county, any sheriff, undersheriff, or deputy sheriff regularly employed and paid in that capacity by a county, police officer of the County of Los Angeles, or any person acting pursuant to the direction of one of these law enforcement officers acting within the scope of his or her authority, from overhearing or recording any communication that they could lawfully overhear or record prior to the effective date of this chapter. 

   Nothing in Section 631, 632, 632.5, 632.6, or 632.7 renders inadmissible any evidence obtained by the above-named persons by means of overhearing or recording any communication that they could lawfully overhear or record prior to the effective date of this chapter. 

633.1. (a) Nothing in Section 631, 632, 632.5, 632.6, or 632.7 prohibits any person regularly employed as an airport law enforcement officer, as described in subdivision (d) of Section 830.33, acting within the scope of his or her authority, from recording any communication which is received on an incoming telephone line, for which the person initiating the call utilized a telephone number known to the public to be a means of contacting airport law enforcement officers. In order for a telephone call to be recorded under this subdivision, a series of electronic tones shall be used, placing the caller on notice that his or her telephone call is being recorded. 

   (b) Nothing in Section 631, 632, 632.5, 632.6, or 632.7 renders inadmissible any evidence obtained by an officer described in subdivision (a) if the evidence was received by means of recording any communication which is received on an incoming public telephone line, for which the person initiating the call utilized a telephone number known to the public to be a means of contacting airport law enforcement officers. 

   (c) This section shall only apply to airport law enforcement officers who are employed at an airport which maintains regularly scheduled international airport service and which maintains permanent facilities of the United States Customs Service. 

633.5.  Nothing in Section 631, 632, 632.5, 632.6, or 632.7 prohibits one party to a confidential communication from recording the communication for the purpose of obtaining evidence reasonably believed to relate to the commission by another party to the communication of the crime of extortion, kidnapping, bribery, any felony involving violence against the person, or a violation of Section 653m. Nothing in Section 631, 632, 632.5, 632.6, or 632.7 renders any evidence so obtained inadmissible in a prosecution for extortion, kidnapping, bribery, any felony involving violence against the person, a violation of Section 653m, or any crime in connection therewith. 

633.6. (a) Notwithstanding the provisions of this chapter, and in accordance with federal law, upon the request of a victim of domestic violence who is seeking a domestic violence restraining order, a judge issuing the order may include a provision in the order that permits the victim to record any prohibited communication made to him or her by the perpetrator. 

   (b) The Judicial Council shall amend its domestic violence prevention application and order forms to incorporate the provisions of this section. 

634.  Any person who trespasses on property for the purpose of committing any act, or attempting to commit any act, in violation of Section 631, 632, 632.5, 632.6, 632.7, or 636 shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), by imprisonment in the county jail not exceeding one year or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section or Section 631, 632, 632.5, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in the county jail not exceeding one year or in the state prison, or by both that fine and imprisonment. 

635. (a) Every person who manufactures, assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to another any device which is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device which is primarily or exclusively designed or intended for the unauthorized interception or reception of communications between cellular radio telephones or between a cellular radio telephone and a landline telephone in violation of Section 632.5, or communications between cordless telephones or between a cordless telephone and a landline telephone in violation of Section 632.6, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000), by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. 

   (b) This section does not apply to either of the following: 

   (1) An act otherwise prohibited by this section when performed by any of the following: 

   (A) A communication utility or an officer, employee or agent thereof for the purpose of construction, maintenance, conduct, or operation of, or otherwise incident to the use of, the services or facilities of the utility. 

   (B) A state, county, or municipal law enforcement agency or an agency of the federal government. 

   (C) A person engaged in selling devices specified in subdivision (a) for use by, or resale to, agencies of a foreign government under terms approved by the federal government, communication utilities, state, county, or municipal law enforcement agencies, or agencies of the federal government. 

   (2) Possession by a subscriber to communication utility service of a device specified in subdivision (a) furnished by the utility pursuant to its tariffs. 

636.  (a) Every person who, without permission from all parties to the conversation, eavesdrops on or records, by means of an electronic device, a conversation, or any portion thereof, between a person who is in the physical custody of a law enforcement officer or other public officer, or who is on the property of a law enforcement agency or other public agency, and that person's attorney, religious adviser, or licensed physician, is guilty of a felony. 

   (b) Every person who, intentionally and without permission from all parties to the conversation, nonelectronically eavesdrops upon a conversation, or any portion thereof, that occurs between a person who is in the physical custody of a law enforcement officer or other public officer and that person's attorney, religious adviser, or licensed physician, is guilty of a public offense. This subdivision applies to conversations that occur in a place, and under circumstances, where there exists a reasonable expectation of privacy, including a custody holding area, holding area, or anteroom. 

This subdivision does not apply to conversations that are inadvertently overheard or that take place in a courtroom or other room used for adjudicatory proceedings. A person who is convicted of violating this subdivision shall be punished by imprisonment in the state prison, or in the county jail for a term not to exceed one year, or by a fine not to exceed two thousand five hundred dollars ($2,500), or by both that fine and imprisonment. 

   (c) This section shall not apply to any employee of a public utility engaged in the business of providing service and facilities for telephone or telegraph communications while engaged in the construction, maintenance, conduct, or operation of the service or facilities of that public utility who listens in to conversations for the limited purpose of testing or servicing equipment. 

636.5.  Any person not authorized by the sender, who intercepts any public safety radio service communication, by use of a scanner or any other means, for the purpose of using that communication to assist in the commission of a criminal offense or to avoid or escape arrest, trial, conviction, or punishment or who divulges to any person he or she knows to be a suspect in the commission of any criminal offense, the existence, contents, substance, purport, effect or meaning of that communication concerning the offense with the intent that the suspect may avoid or escape from arrest, trial, conviction, or punishment is guilty of a misdemeanor. 

   Nothing in this section shall preclude prosecution of any person under Section 31 or 32. 

   As used in this section, "public safety radio service communication" means a communication authorized by the Federal Communications Commission to be transmitted by a station in the public safety radio service. 

637.  Every person not a party to a telegraphic or telephonic communication who willfully discloses the contents of a telegraphic or telephonic message, or any part thereof, addressed to another person, without the permission of such person, unless directed so to do by the lawful order of a court, is punishable by imprisonment in the state prison, or in the county jail not exceeding one year, or by fine not exceeding five thousand dollars ($5,000), or by both fine and imprisonment. 

637.1.  Every person not connected with any telegraph or telephone office who, without the authority or consent of the person to whom the same may be directed, willfully opens any sealed envelope enclosing a telegraphic or telephonic message, addressed to another person, with the purpose of learning the contents of such message, or who fraudulently represents another person and thereby procures to be delivered to himself any telegraphic or telephonic message addressed to such other person, with the intent to use, destroy, or detain the same from the person entitled to receive such message, is punishable as provided in Section 637. 

637.2.  (a) Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation for the greater of the following amounts: 

   (1) Five thousand dollars ($5,000). 

   (2) Three times the amount of actual damages, if any, sustained by the plaintiff. 

   (b) Any person may, in accordance with Chapter 3 (commencing with Section 525) of Title 7 of Part 2 of the Code of Civil Procedure, bring an action to enjoin and restrain any violation of this chapter, and may in the same action seek damages as provided by subdivision (a). 

   (c) It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages. 

637.3.  (a) No person or entity in this state shall use any system which examines or records in any manner voice prints or other voice stress patterns of another person to determine the truth or falsity of statements made by such other person without his or her express written consent given in advance of the examination or recordation. 

   (b) This section shall not apply to any peace officer, as defined in Section 830, while he is carrying out his official duties. 

   (c) Any person who has been injured by a violator of this section may bring an action against the violator for his actual damages or one thousand dollars ($1,000), whichever is greater. 

637.4.  (a) No state or local governmental agency involved in the investigation or prosecution of crimes, or any employee thereof, shall require or request any complaining witness, in a case involving the use of force, violence, duress, menace, or threat of great bodily harm in the commission of any sex offense, to submit to a polygraph examination as a prerequisite to filing an accusatory pleading. 

   (b) Any person who has been injured by a violator of this section may bring an action against the violator for his actual damages or one thousand dollars ($1,000), whichever is greater. 

637.5. (a) No person who owns, controls, operates, or manages a satellite or cable television corporation, or who leases channels on a satellite or cable system shall: 

   (1) Use any electronic device to record, transmit, or observe any events or listen to, record, or monitor any conversations that take place inside a subscriber's residence, workplace, or place of business, without obtaining the express written consent of the subscriber. A satellite or cable television corporation may conduct electronic sweeps of subscriber households to monitor for signal quality. 

   (2) Provide any person with any individually identifiable information regarding any of its subscribers, including, but not limited to, the subscriber's television viewing habits, shopping choices, interests, opinions, energy uses, medical information, banking data or information, or any other personal or private information, without the subscriber's express written consent. 

   (b) Individual subscriber viewing responses or other individually identifiable information derived from subscribers may be retained and used by a satellite or cable television corporation only to the extent reasonably necessary for billing purposes and internal business practices, and to monitor for unauthorized reception of services. A satellite or cable television corporation may compile, maintain, and distribute a list containing the names and addresses of its subscribers if the list contains no other individually identifiable information and if subscribers are afforded the right to elect not to be included on the list. However, a satellite or cable television corporation shall maintain adequate safeguards to ensure the physical security and confidentiality of the subscriber information. 

   (c) A satellite or cable television corporation shall not make individual subscriber information available to government agencies in the absence of legal compulsion, including, but not limited to, a court order or subpoena. If requests for information are made, a satellite or cable television corporation shall promptly notify the subscriber of the nature of the request and what government agency has requested the information prior to responding unless otherwise prohibited from doing so by law. 

   Nothing in this section shall be construed to prevent local franchising authorities from obtaining information necessary to monitor franchise compliance pursuant to franchise or license agreements. This information shall be provided so as to omit individually identifiable subscriber information whenever possible. Information obtained by local franchising authorities shall be used solely for monitoring franchise compliance and shall not be subject to the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code). 

   (d) Any individually identifiable subscriber information gathered by a satellite or cable television corporation shall be made available for subscriber examination within 30 days of receiving a request by a subscriber to examine the information on the premises of the corporation. Upon a reasonable showing by the subscriber that the information is inaccurate, a satellite or cable television corporation shall correct the information. 

   (e) Upon a subscriber's application for satellite or cable television service, including, but not limited to, interactive service, a satellite or cable television corporation shall provide the applicant with a separate notice in an appropriate form explaining the subscriber's right to privacy protection afforded by this section. 

   (f) As used in this section: 

   (1) "Cable television corporation" shall have the same meaning as that term is given by Section 216.4 of the Public Utilities Code. 

   (2) "Individually identifiable information" means any information identifying an individual or his or her use of any service provided by a satellite or cable system other than the mere fact that the individual is a satellite or cable television subscriber. "Individually identifiable information" shall not include anonymous, aggregate, or any other information that does not identify an individual subscriber of a video provider service. 

   (3) "Person" includes an individual, business association, partnership, corporation, limited liability company, or other legal entity, and an individual acting or purporting to act for or on behalf of any government, or subdivision thereof, whether federal, state, or local. 

   (4) "Interactive service" means any service offered by a satellite or cable television corporation involving the collection, reception, aggregation, storage, or use of electronic information transmitted from a subscriber to any other receiving point under the control of the satellite or cable television corporation, or vice versa. 

   (g) Nothing in this section shall be construed to limit the ability of a satellite or cable television corporation to market satellite or cable television or ancillary services to its subscribers. 

   (h) Any person receiving subscriber information from a satellite or cable television corporation shall be subject to the provisions of this section. 

   (i) Any aggrieved person may commence a civil action for damages for invasion of privacy against any satellite or cable television corporation, service provider, or person that leases a channel or channels on a satellite or cable television system that violates the provisions of this section. 

   (j) Any person who violates the provisions of this section is guilty of a misdemeanor punishable by a fine not exceeding three thousand dollars ($3,000), or by imprisonment in the county jail not exceeding one year, or by both that fine and imprisonment. 

   (k) The penalties and remedies provided by subdivisions (i) and (j) are cumulative, and shall not be construed as restricting any penalty or remedy, provisional or otherwise, provided by law for the benefit of any person, and no judgment under this section shall preclude any person from obtaining additional relief based upon the same facts. 

   (l) The provisions of this section are intended to set forth minimum state standards for protecting the privacy of subscribers to cable television services and are not intended to preempt more restrictive local standards. 

637.6.  (a) No person who, in the course of business, acquires or has access to personal information concerning an individual, including, but not limited to, the individual's residence address, employment address, or hours of employment, for the purpose of assisting private entities in the establishment or implementation of carpooling or ridesharing programs, shall disclose that information to any other person or use that information for any other purpose without the prior written consent of the individual. 

   (b) As used in this section, "carpooling or ridesharing programs" include, but shall not be limited to, the formation of carpools, vanpools, buspools, the provision of transit routes, rideshare research, and the development of other demand management strategies such as variable working hours and telecommuting. 

   (c) Any person who violates this section is guilty of a misdemeanor, punishable by imprisonment in the county jail for not exceeding one year, or by a fine of not exceeding one thousand dollars ($1,000), or by both that imprisonment and fine. 

637.7. (a) No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person. 

   (b) This section shall not apply when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle. 

   (c) This section shall not apply to the lawful use of an electronic tracking device by a law enforcement agency. 

   (d) As used in this section, "electronic tracking device" means any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals. 

   (e) A violation of this section is a misdemeanor. 

   (f) A violation of this section by a person, business, firm, company, association, partnership, or corporation licensed under Division 3 (commencing with Section 5000) of the Business and Professions Code shall constitute grounds for revocation of the license issued to that person, business, firm, company, association, partnership, or corporation, pursuant to the provisions that provide for the revocation of the license as set forth in Division 3 (commencing with Section 5000) of the Business and Professions Code. 

637.9.  (a) Any person who, in the course of business, provides mailing lists, computerized or telephone-based reference services, or similar products or services utilizing lists, as defined, knowingly does any of the following is guilty of a misdemeanor: 

   (1) Fails, prior to selling or distributing a list to a first-time buyer, to obtain the buyer's name, address, telephone number, tax identification number if the buyer is a forprofit entity, a sample of the type of material to be distributed using the list, or to make a good-faith effort to verify the nature and legitimacy of the business or organization to which the list is being sold or distributed. 

   (2) Knowingly provides access to personal information about children to any person who he or she knows is registered or required to register as a sex offender. 

   (b) Any person who uses personal information about a child that was obtained for commercial purposes to directly contact the child or the child's parent to offer a commercial product or service to the child and who knowingly fails to comply with the parent's request to take steps to limit access to personal information about a child only to authorized persons is guilty of a misdemeanor. 

   (c) Any person who knowingly distributes or receives any personal information about a child with knowledge that the information will be used to abuse or physically harm the child is guilty of a misdemeanor. 

   (d) (1) List brokers shall, upon a written request from a parent that specifically identifies the child, provide the parent with procedures that the parent must follow in order to withdraw consent to use personal information relating to his or her child. Any list broker who fails to discontinue disclosing personal information about a child within 20 days after being so requested in writing by the child's parent, is guilty of a misdemeanor. 

   (2) Any person who, through the mail, markets or sells products or services directed to children, shall maintain a list of all individuals, and their addresses, who have requested in writing that the person discontinue sending any marketing or sales materials to the individual or the individual's child or children. No person who is obligated to maintain that list shall cause any marketing or sales materials, other than those that are already in the process of dissemination, to be sent to any individual's child or children, 

after that individual has made that written request. Any person who is subject to the provisions of this paragraph, who fails to comply with the requirements of this paragraph or who violates the provisions of this paragraph is guilty of a misdemeanor. 

   (e) The following shall be exempt from subdivisions (a) and (b): 

   (1) Any federal, state, or local government agency or law enforcement agency. 

   (2) The National Center for Missing and Exploited Children. 

   (3) Any educational institution, consortia, organization, or professional association, which shall include, but not be limited to, the California community colleges; the California State University, and each campus, branch, and function thereof; each campus, branch, and function of the University of California; the California Maritime Academy; or any independent institution of higher education accredited by an agency recognized by the federal Department of Education. For the purposes of this paragraph, "independent institution of higher education" means any nonpublic higher education institution that grants undergraduate degrees, graduate degrees, or both undergraduate and graduate degrees, is formed as a nonprofit corporation in this state, and is accredited by an agency recognized by the federal Department of Education; or any private postsecondary vocational institution registered, approved, or exempted by the Bureau of Private Postsecondary Vocational Education. 

   (4) Any nonprofit organization that is exempt from taxation under Section 23701d of the Revenue and Taxation Code. 

   (f) As used in this section: 

   (1) "Child" means a person who is under 16 years of age. 

   (2) "Parent" shall include a legal guardian. 

   (3) "Personal information" means any information that identifies a child and that would suffice to locate and contact the child, including, but not limited to, the name, postal or electronic mail address, telephone number, social security number, date of birth, physical description of the child, or family income. 

   (4) "List" may include, but is not limited to, a collection of name and address records of individuals sharing a common interest, purchase history, demographic profile, membership, or affiliation. 

638.  (a) Any person who purchases, sells, offers to purchase or sell, or conspires to purchase or sell any telephone calling pattern record or list, without the written consent of the subscriber, or any person who procures or obtains through fraud or deceit, or attempts to procure or obtain through fraud or deceit any telephone calling pattern record or list shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in a county jail not exceeding one year, or by both a fine and imprisonment. If the person has previously been convicted of a violation of this section, he or she is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in a county jail not exceeding one year, or by both a fine and imprisonment. 

   (b) Any personal information contained in a telephone calling pattern record or list that is obtained in violation of this section shall be inadmissible as evidence in any judicial, administrative, legislative, or other proceeding except when that information is offered as proof in an action or prosecution for a violation of this section, or when otherwise authorized by law, in any criminal prosecution. 

   (c) For purposes of this section: 

   (1) "Person" includes an individual, business association, partnership, limited partnership, corporation, limited liability company, or other legal entity. 

   (2) "Telephone calling pattern record or list" means information retained by a telephone company that relates to the telephone number dialed by the subscriber, or other person using the subscriber's telephone with permission, or the incoming number of a call directed to the subscriber, or other data related to such calls typically contained on a subscriber telephone bill such as the time the call started and ended, the duration of the call, any charges applied, and any information described in subdivision (a) of Section 2891 of the Public Utilities Code whether the call was made from or to a telephone connected to the public switched telephone network, a cordless telephone, as defined in Section 632.6, a telephony device operating over the Internet utilizing voice over Internet protocol, a satellite telephone, or commercially available interconnected mobile phone service that provides access to the public switched telephone network via a mobile communication device employing radiowave technology to transmit calls, including cellular radiotelephone, broadband Personal Communications Services, and digital Specialized Mobile Radio. 

   (3) "Telephone company" means a telephone corporation as defined in Section 234 of the Public Utilities Code or any other person that provides residential or commercial telephone service to a subscriber utilizing any of the technologies or methods enumerated in paragraph (2). 

   (4) For purposes of this section, "purchase" and "sell" shall not include information provided to a collection agency or assignee of the debt by the telephone corporation, and used exclusively for the collection of the unpaid debt assigned by the telephone corporation, provided that the collection agency or assignee of the debt shall be liable for any disclosure of the information that is in violation of this section. 

   (d) An employer of, or entity contracting with, a person who violates subdivision (a) shall only be subject to prosecution pursuant to that provision if the employer or contracting entity knowingly allowed the employee or contractor to engage in conduct that violated subdivision (a). 

   (e) It is the intent of the Legislature to ensure that telephone companies maintain telephone calling pattern records or lists in the strictest confidence, and protect the privacy of their subscribers with all due care. While it is not the intent of the Legislature in this act to preclude the sharing of information that is currently allowed by both state and federal laws and rules governing those records, it is the Legislature's intent in this act to preclude any unauthorized purchase or sale of that information. 

   (f) This section shall not be construed to prevent a law enforcement or prosecutorial agency, or any officer, employee, or agent thereof from obtaining telephone records in connection with the performance of the official duties of the agency consistent with any other applicable state and federal law. 

   (g) Nothing in this section shall preclude prosecution under any other provision of law. 

   (h) The Legislature hereby finds and declares that, notwithstanding the prohibition on specific means of making available or obtaining personal calling records pursuant to this section, the disclosure of personal calling records through any other means is no less harmful to the privacy and security interests of Californians. 

This section is not intended to limit the scope or force of Section 2891 of the Public Utilities Code in any way. 

CALIFORNIA PENAL CODE 

647 (j) (1) Any person who looks through a hole or opening, into, or otherwise views, by means of any instrumentality, including, but not limited to, a periscope, telescope, binoculars, camera, motion picture camera, or camcorder, the interior of a bedroom, bathroom, changing room, fitting room, dressing room, or tanning booth, or the interior of any other area in which the occupant has a reasonable expectation of privacy, with the intent to invade the privacy of a person or persons inside. This subdivision shall not apply to those areas of a private business used to count currency or other negotiable instruments. 

   (2) Any person who uses a concealed camcorder, motion picture camera, or photographic camera of any type, to secretly videotape, film, photograph, or record by electronic means, another, identifiable person under or through the clothing being worn by that other person, for the purpose of viewing the body of, or the undergarments worn by, that other person, without the consent or knowledge of that other person, with the intent to arouse, appeal to, or gratify the lust, passions, or sexual desires of that person and invade the privacy of that other person, under circumstances in which the other person has a reasonable expectation of privacy. 

   (3) (A) Any person who uses a concealed camcorder, motion picture camera, or photographic camera of any type, to secretly videotape, film, photograph, or record by electronic means, another, identifiable person who may be in a state of full or partial undress, for the purpose of viewing the body of, or the undergarments worn by, that other person, without the consent or knowledge of that other person, in the interior of a bedroom, bathroom, changing room, fitting room, dressing room, or tanning booth, or the interior of any other area in which that other person has a reasonable expectation of privacy, with the intent to invade the privacy of that other person.