Personal information: maintenance.

Assembly Member DeMaio's privacy legislation would establish new requirements for California businesses that maintain consumer personal information outside the United States, adding geographic restrictions to the state's existing data protection framework. The proposal would require businesses to inform consumers about plans to store their personal information internationally and obtain explicit consent after disclosing potential risks associated with overseas data maintenance.

The bill creates specific prohibitions around sensitive data categories, barring businesses from storing health care information, financial records, or geolocation data with foreign governments or entities under foreign government control. These provisions add to existing California Consumer Privacy Act requirements that businesses disclose their data collection practices and implement reasonable security measures.

Under the proposed changes, businesses that share consumer data with third parties or service providers must ensure contractual agreements specify limited data usage purposes and equivalent privacy protections. The legislation maintains the California Privacy Protection Agency's authority to enforce these requirements as part of its existing oversight of state privacy laws. The bill's authors state these modifications advance the objectives of the California Privacy Rights Act of 2020, which established the state's current privacy protection framework.