BILL NUMBER: SB 1834	AMENDED
	BILL TEXT

	AMENDED IN SENATE  APRIL 1, 2004

INTRODUCED BY   Senator Bowen
    (Principal coauthor:  Senator Machado) 

                        FEBRUARY 20, 2004

   An act to add Chapter 22.7 (commencing with Section 22650) to
Division 8 of the Business and Professions Code, relating to
business.



	LEGISLATIVE COUNSEL'S DIGEST


   SB 1834, as amended, Bowen.  Radio frequency identification
systems.
   Existing law imposes special business regulations on various
businesses.  Existing law defines the term "unfair
competition" and provides for the assessment of civil penalties for
acts of unfair competition that may be recovered in an action brought
by a governmental entity or by a person acting for the interests of
itself, its members, or the general public. 
   This bill would  require a person or  
prohibit a private  entity  that uses  
from using an electronic product code system that uses radio
frequency identification (RFID)  systems to comply 
 tags attached to consumer products or an RFID reader to gather,
store, use, or share information that could be used to identify an
individual unless the entity complies  with certain conditions
 , including obtaining an individual's written consent before
attaching or storing personally identifiable information with data
collected via an RFID tag or before any personally identifiable
information collected via an RFID system is shared with a third
party.  The bill would make a violation of the bill an act of unfair
competition that is subject to specified enforcement provisions,
including actions brought by the Attorney General or a district
attorney or city attorney   .  The bill would authorize
a library to use RFID tags attached to circulating materials to
collect information that could be used to identify a borrower under
specified conditions  .
   Vote:  majority.  Appropriation:  no.  Fiscal committee:  
yes   no . State-mandated local program:  no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:


  SECTION 1.  Chapter 22.7 (commencing with Section 22650) is added
to Division 8 of the Business and Professions Code, to read:

      CHAPTER 22.7.  RADIO FREQUENCY IDENTIFICATION

   22650.  A person or entity that uses a radio frequency
identification (RFID) system that can be used to gather information
about an individual shall obtain written consent from an individual
before any personally identifiable information of the individual,
including name, address, telephone number, or credit card number, is
attached to or stored with data collected via the RFID system.
   22651.  A person or entity shall obtain separate written consent
from an individual before any personally identifiable information
about the individual collected by an RFID system is shared with a
third party.
   22652.  An individual shall have the right to access his or her
personally identifiable information collected through an RFID system
and the opportunity to make corrections to that information.
   22653.  A person or entity shall take reasonable measures to
ensure that any individual data collected via an RFID system is
transmitted and stored in a secure manner, and that access to the
data is limited to those individuals needed to operate and maintain
the RFID system.
   22654.  If a retail store uses an RFID system on a consumer
product, the RFID tag shall be detached or destroyed before a
consumer leaves the store.
   22655.  Collecting information through an RFID system that is
aggregate in nature and that does not personally identify an
individual is not a violation of this chapter.
   22656.  A violation of this chapter is an act of unfair
competition under Chapter 5 (commencing with Section 17200) of
Division 7 and subject to the enforcement provisions of that chapter.
   
   22650.  A private entity may not use an electronic product code
system that uses radio frequency identification (RFID) tags attached
to consumer products or an RFID reader that enables the user to
collect information from RFID tags attached to consumer products to
gather, store, use, or share information that could be used to
identify an individual, unless all of the following conditions are
met:
   (a) The information is collected only to the extent permitted by
law.
   (b) The information has been provided by a customer for the
purpose of completing a transaction to purchase or rent an item
containing an RFID tag at a retail store.
   (c) The information is not collected at any time before a customer
actually initiates a transaction to purchase or rent an item or at
any time after the customer completes the transaction.
   (d) The information regards only a customer who actually presents
the item for purchase or rent, and is in regard only to that item.
   22651.  A library may use an electronic product code system that
uses radio frequency identification (RFID) tags attached to
circulating materials only to collect, store, use, or share
information that could be used to identify a borrower if all of the
following conditions are met:
   (a) The information is collected only to the extent permitted by
law.
   (b) The information has been provided by the borrower for the
purpose of borrowing an item containing an RFID tag at the library.
   (c) The information is not collected at any time before the
borrower actually attempts to borrow the item or at any time after
the customer completes the transaction to borrow the item containing
the RFID tag.
   (d) The information is collected with regards only to a borrower
who actually attempts to borrow the item and is in regard only to
that item.