AB 1391 Prohibits Unlawfully Obtained Data

On October 6, 2021, Governor Gavin Newsom signed into law Assembly Bill 1391 by Assemblyman Ed Chau (D-San Francisco), related to unlawfully obtained data. The bill adds Section 1724 to the Civil Code.

The bill defines the following terms:

• “Authorized person,” which means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data under state or federal law.

• “Data,” which means the same definition contained in Penal Code Section 502 has the same meaning as defined in Section 502 of the Penal Code, which is defined as a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.

The new law makes it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime. In addition, it is now unlawful for a person who is not an authorized person to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.

However, this new section of law is not to be construed to limit the constitutional rights of the public, the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper (2001) 532 U.S. 514. Also, this new section of law does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft or fraud.

Finally, the new law specifies that a court under this new code section may award equitable relief such as an injunction, costs, and any other relief the court deems proper. Liability under this new law does not limit or preclude liability under any other law, and a violation of this section does not constitute a crime.