An act to amend Section 1798.100 of, and to add Section 1798.122 to, the Civil Code, relating to privacy.
Summary
AB 364 would amend California privacy law to require businesses that collect personal information to tell consumers if they intend to maintain that information outside the United States. It would also prohibit a business from keeping a consumer’s personal information outside the U.S. unless the consumer is informed of the risks and explicitly consents, and it would bar the offshore storage of health care information, financial information, and geolocation data altogether.
The bill also adds a new Civil Code section aimed at preventing sensitive personal information from being held in the custody of foreign governments or foreign-government-controlled entities. In effect, it creates a new layer of restrictions on where businesses may store Californians’ data and how they must disclose cross-border data handling, while stating that the measure furthers the purposes and intent of the California Privacy Rights Act of 2020.
Impact
AB 364 would modify Section 1798.100 of the Civil Code and add Section 1798.122, expanding the disclosure and retention obligations imposed on businesses under the California Consumer Privacy Act/California Privacy Rights Act framework. Businesses would need to add a new notice about foreign storage of personal information, obtain explicit consent for offshore maintenance of most personal information, and comply with a categorical ban on offshore storage of health care, financial, and geolocation data, as well as a ban on placing those categories in the custody of foreign governments or foreign-government-controlled third parties. The bill would primarily affect businesses that collect or process consumer data, especially those using overseas data storage or foreign service providers.
Sentiment
Based on the available legislative record, the bill appears to have been treated as a privacy-protection measure with no recorded committee debate or vote breakdown in the provided materials. Its stated purpose aligns with existing California privacy policy, suggesting a generally favorable framing within the privacy and consumer protection context. The bill was in the Assembly Privacy and Consumer Protection Committee and was later filed with the Chief Clerk pursuant to Joint Rule 56, but no transcript or vote history is available here to show broader support or opposition.
Contention
The main likely point of contention is the bill’s restriction on where businesses may store data, particularly the requirement for explicit consumer consent before maintaining personal information outside the United States. Businesses that rely on global cloud infrastructure, outsourced data processing, or foreign vendors may view the measure as operationally burdensome or costly. Another possible area of dispute is the categorical prohibition on offshore storage of health care, financial, and geolocation data, which could be seen as stronger than existing privacy disclosure rules and may raise questions about feasibility, enforcement, and compatibility with common data-management practices.
An act to add Section 51103 to, and to add Article 10 (commencing with Section 49058) to Chapter 6 of Part 27 of Division 4 of Title 2 of, the Education Code, relating to local educational agencies.
An act to amend Sections 2301 and 2302 of, and to add Section 2303 to, the Fish and Game Code, to add and repeal Section 515 of the Food and Agricultural Code, to amend Sections 675, 676, and 676.