An act to amend amend, repeal, and add Sections 1798.3, 1798.16, 1798.17, 1798.19, 1798.20, 1798.24, 1798.24b, 1798.25, 1798.26, 1798.27, 1798.29, 1798.44, 1798.55, 1798.57, and 1798.68 of the Civil Code, relating to information privacy.
AB 1337 updates California’s Information Practices Act of 1977 to reflect modern data practices and to apply its privacy rules more broadly to state and local agencies. The bill expands the definition of “personal information” to explicitly include a wider range of identifiers and sensitive data, such as IP addresses, precise geolocation, biometric information, genetic data, neural data, health information, and certain electronic communications. It also treats some abstract digital formats, including metadata, encrypted files, and AI systems capable of outputting personal information, as covered records.
The bill would remove the existing exemption for local agencies, meaning counties, cities, school districts, and other local public agencies would be brought under the act’s requirements. It would also require agencies to keep source information for collected personal data, provide clearer notices when collecting information, follow state administrative and information-management manuals, limit use of personal information to the purpose for which it was collected unless otherwise authorized by law, and maintain accounting records for certain disclosures. In addition, the bill updates breach-notification rules, expands disclosure rules in some circumstances, and makes negligent violations of the act a basis for employee discipline.
AB 1337 also strengthens enforcement by making intentional disclosure of medical, psychiatric, or psychological information a misdemeanor even without proof of economic loss or personal injury, which broadens the scope of an existing crime. The bill includes legislative findings intended to justify privacy-related limits on public access under the California Constitution and states that certain costs imposed on local agencies and school districts are not reimbursable, though other mandated costs could be reimbursed if determined by the Commission on State Mandates.
The overall sentiment in the available voting history appears generally favorable, with the bill advancing through committee and receiving unanimous or near-unanimous support at several stages, including a 64-0 Assembly third reading vote. However, there was at least one committee vote with a single no vote, and the bill later failed passage in one committee hearing before reconsideration was granted. The final status indicates the bill was set for a final hearing that was later canceled at the author’s request, suggesting continued procedural movement but no final resolution in the provided record.
The main points of contention appear to be the bill’s expansion of privacy obligations to local governments, the broader definition of personal information, and the increased compliance and enforcement burden on agencies. The removal of the local-agency exemption and the expansion of criminal and disciplinary consequences likely drive the fiscal and administrative concerns reflected in the bill’s state-mandated local program designation and appropriations referrals. At the same time, the bill’s privacy-protection goals and modernization of outdated statutory language seem to have broad support among most voting members.
AB 1337 would substantially revise the Information Practices Act of 1977 by expanding the scope of covered agencies, broadening the definition of personal information, and imposing additional recordkeeping, notice, disclosure, and breach-notification duties on state and local public agencies. It would also extend disciplinary exposure to negligent violations and broaden misdemeanor liability for certain improper disclosures of medical, psychiatric, or psychological information. Because it removes the exemption for local agencies, the bill would create new compliance obligations for counties, cities, school districts, and other local public entities, and it is identified as a state-mandated local program with potential reimbursement implications.
The bill’s voting history suggests generally strong support for the measure’s privacy modernization goals. It passed key Assembly votes overwhelmingly, including a unanimous third-reading vote, and earlier committee action was also favorable. That said, the record shows at least one committee vote with some opposition and a later failed passage in committee before reconsideration, indicating that while the bill was broadly acceptable, it was not entirely free of procedural or policy resistance.
The most notable contention centers on the bill’s expansion of privacy duties to local agencies, which would increase administrative workload and potential costs for local governments and school districts. Another likely point of debate is the bill’s broader definition of personal information, especially its inclusion of newer categories such as neural data, AI-generated outputs, metadata, and precise geolocation data. Finally, the bill’s removal of the economic-loss/personal-injury condition for misdemeanor liability and its addition of negligent violations as grounds for discipline raise concerns about expanded enforcement exposure for public employees and agencies.