Law / United States / 
California
Health and Location Data Privacy: geofencing of health care entities (AB 45)
Cal. Civ. Code section 1798.99.92
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- Do not geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services, to collect personal information from such a person, or to send such a person notifications or advertisements related to their personal information or health care services (section 1798.99.92(a)).
- Do not sell personal information to, or share it with, a third party for use in violating that prohibition. A statement signed under penalty of perjury by a person authorized to bind the third party that the information will not be used for these purposes is prima facie evidence that it was not sold or shared in violation (section 1798.99.92(b)).
- Do not use personal information obtained in violation of the section (section 1798.99.92(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 1798.99.92(d)(1): an injunction and a civil penalty of $25,000 for each violation, assessed and recovered in a civil action the Attorney General brings in the name of the people of the State of California. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
California Attorney General, in a civil action brought in the name of the people of the State of California (section 1798.99.92(d)(1)).
What this law does
Civil Code section 1798.99.92 makes it unlawful to geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services. Section 1798.99.92(a) also makes it unlawful to geofence such an entity to collect personal information from a person seeking, receiving or providing health care services or to send the person notifications or advertisements related to their personal information or health care services.
Section 1798.99.92(b) makes it unlawful to sell personal information to, or share it with, a third party for use in violating the geofencing prohibition. Under section 1798.99.92(d)(1), a violator is subject to an injunction and a civil penalty of $25,000 for each violation, recovered in an action by the Attorney General.
Section 1798.99.92(f) does not prohibit a person that owns, operates, manages or provides services to an in-person health care entity from geofencing the entity's own location to provide necessary health care services. Civil Code section 1798.99.92 took effect on .
When LexLint raises it
When your app profile says your app tracks devices or sends automated outreach.