California Public Records Act: cyberattacks.

Assembly Member Carrillo's modifications to the California Public Records Act address how state and local agencies handle records requests during cyberattacks and emergencies, refining the conditions under which agencies may extend their standard 10-day response window.

The legislation adds cyberattacks to the definition of "unusual circumstances" that permit agencies to extend their response time by up to 14 days. This provision applies when agencies cannot access electronic servers or systems to search for requested records. The extension remains in effect only until agencies regain system access, and agencies must still fulfill requests for records maintained in non-electronic formats or stored outside affected systems.

The bill also narrows when agencies can cite emergencies to extend response times. Under current law, agencies may extend deadlines when a state of emergency affects their ability to respond due to staffing shortages or facility closures. The new language requires the emergency to "directly affect" agency operations, creating a more specific standard. This provision excludes requests for records created during and related to the emergency itself. The legislation maintains existing provisions for other unusual circumstances, such as the need to search separate facilities or examine voluminous records.