California Reader Privacy Act

California has a number of formal acts in statute. Civil Code Division 3, Part 4, Title 1.81.15 provides the Reader Privacy Act, which is contained in Sections 1798.90 to 1798.90.5. Title 1.81.15 was added in 2011 by Chapter 424.

Section 1798.90 names the Act and provides definitions for the following terms: “book”; “book service”; “government entity”; “law enforcement entity”; “personal information”; “provider”; and, “user.”

In addition, a provider is prohibited from knowingly disclosing to any government entity, or be compelled to disclose to any person, private entity, or government entity, any personal information of a user, except under certain specified circumstances.

A provider is required to disclose personal information of a user to a law enforcement entity only pursuant to a court order issued by a duly authorized court with jurisdiction over an offense that is under investigation and only if all of the five specified conditions are met.

A provider is required to disclose personal information of a user to any of the specified entities only if all of the conditions listed are satisfied. In addition, a provider is required to disclose personal information of a user only if all of the four specified conditions are satisfied.

Moreover, any court issuing a court order requiring the disclosure of personal information of a user must impose appropriate safeguards against the unauthorized disclosure of personal information by the provider and by the person, private entity, or government entity seeking disclosure pursuant to the order.

A provider, upon the request of a law enforcement entity, must take all necessary steps to preserve records and other evidence in its possession of a user’s personal information related to the use of a book or part of a book, pending the issuance of a court order or a warrant. The provider is required to retain the records and evidence for a period of 90 days from the date of the request by the law enforcement entity, which is to be extended for an additional 90-day period upon a renewed request by the law enforcement entity.

Violations of this section are subject to specified penalties. An objectively reasonable reliance by the provider on a warrant or court order for the disclosure of personal information of a user, or on any of the enumerated exceptions to the confidentiality of a user’s personal information set forth in this section, is a complete defense to any civil action for the violation of this section.

Unless disclosure of information pertaining to a particular request or set of requests is specifically prohibited by law, a provider must prepare a report including all of the specified information, to the extent it can be reasonably determined.

Reports prepared are to be made publicly available in an online, searchable format on or before March 1 of each year. If the provider does not have an Internet Web site, the provider is required to post the reports prominently on its premises or send the reports to the Office of Privacy Protection on or before March 1 of each year.