PRIVACY LEGISLATION REPORT

By Norwood & Associates

August 19, 2026

Legislature Sends SB 1 to Governor

In a matter of two days the California Legislature sent Governor Gray Davis a privacy bill dubbed the toughest law of its kind in the nation. The Legislature acted with urgency after finally coming to a compromise with most of the financial services industry and to meet today's deadline set by sponsors of an even more draconian privacy initiative.

The deal came together last week when Senator Jackie Speier and supporters of her bill, SB 1, finally reached an agreement after four years of bitter maneuvering over the issue. Governor Davis promptly announced he would sign the bill. The bill's supporters, however, had to cool their heels until the Legislature returned yesterday from their three-week summer vacation.

SB 1 became the sole focus of the State Assembly yesterday as six separate votes, including rule waivers, were held to clear the bill through three committees and the Assembly floor. The Assembly essentially shunted most other business in order to pass SB 1 out of the Assembly so the Senate, which has already approved an earlier version of the bill, could take one final vote approving the compromise achieved in the Assembly.

The normal legislative process was short-circuited by an unusual joint hearing of the Banking & Finance Committee and Judiciary Committee. Each Committee was called to order separately and took separate votes, but heard testimony jointly in order to save time. After the Banking & Finance Committee voted, the bill was immediately sent to the Assembly Desk for certification and then returned within minutes for a second vote by the Judiciary Committee. While that vote was being certified, the Appropriations Committee convened, and promptly voted the bill out of Committee and to the Assembly Floor, which passed it by a vote of 76-1. The entire process, culminating four years of work, took about three hours.

This morning, the Senate convened to approve the Assembly changes. SB 1 passed by a vote of 31-6. The bill is now on its way to the Governor's Desk. The Governor has 12 days to act on the bill once his office receives physical possession, or it will become law automatically. Normally, its takes a few days for the Legislature to certify a vote and physically transmit it to the Governor's Office. However, in this case transmittal is expected to be immediate and the Governor is expected to sign the bill quickly.

The Legislature acted with unusual speed and determination in order to forestall an even more severe privacy measure from being placed on the March 2004 ballot. Privacy advocates successfully gathered almost 600,000 signatures to place the measure on the ballot as a tactic to force a legislative compromise. Chris Larsen, the founder of E-Loan who funded the initiative drive, said he would not submit the signatures if a legislative solution was reached by today. Tomorrow is the last day the privacy advocates determined they had to submit signatures in order to qualify the initiative.

Not everyone is happy with the compromise. Several insurers continue to voice muted opposition, but are making no serious attempts to undo the deal. Even those insurers, banks and other financial institutions that removed their opposition continued to voice their preference for a national standard, raising concern among privacy advocates they intend to try and preempt SB 1 at the federal level.

The compromise makes only relatively minor changes to the last version of SB 1 which was being discussed before negotiations broke down and the bill failed to pass out of the Assembly Banking and Finance Committee a couple of months ago. Senator Speier characterized the changes as making the bill more "workable."

The major changes in the compromise are:

· Changing the effective date from January 1, 2004, to July 1, 2004.

· Eliminating the catchall option in the statutory privacy notice.

· Authorizing a privacy notice approved by the functional regulator as an alternative to the statutory notice and meeting specified requirements.

· Eliminating the requirement for postage paid envelopes for consumers to provide a privacy choice as long as they can respond by email and a toll-free telephone number.

· Eliminating enforcement by district attorneys. Enforcement would be left to the functional regulator and the Attorney General.

· Affinity partners may also receive a consumer's telephone number in addition to the previously authorized name and address, provided the consumer has not opted-out.

In summary, SB 1 now requires a financial institution to obtain the consent of a consumer before it may share personal information with any nonaffiliated third party (opt-in). While consent is not required to share information with an affiliate or joint marketing partners, the consumer must be provided with the opportunity to direct that personal information not be disclosed (opt-out). The bill provides for unrestricted sharing of information between a financial institution and its wholly owned financial subsidiaries in the same line of business defined as one of the following: insurance, banking or securities (no-opt).

The bill contains several transactional exemptions. In addition, exemptions are provided for transactions covered by the federal Real Estate Settlement Procedures Act, financial planning services provided pursuant to agreement, sharing of information between insurers and exclusive agents, and insurance producers and securities brokers acting within the scope of their license. Most importantly, the bill specifically provides an exemption for insurance agents and brokers shopping for quotes.