California Consumer Privacy Act of 2018: personal information: exemptions.

All provisions requiring for-profit and nonprofit residential care facilities for the elderly to have alternative power sources (generators or batteries) for 72-hour outages were removed from the bill. This included compliance deadlines (January 1, 2030 for for-profit; January 1, 2032 for nonprofit), civil penalties, and license suspension/revocation authority under Health and Safety Code Sections 1569.694 and 1569.695.

Senator Ashby and Assembly Member Rogers were removed as coauthors. Only Assembly Member Bonta remains as a coauthor alongside Senator Wahab.

The definition of 'publicly available' in Section 1798.140(v)(2)(B) was narrowed from three categories to two. Subcategory (III), which excluded from protection information a consumer disclosed to a third party without restricting it to a specific audience, was deleted. This means such shared data now qualifies as protected personal information under CCPA.

The introductory language of the 'publicly available' definition changed from 'means any of the following' to 'means any either of the following,' reflecting the reduction from three to two qualifying categories.

The state-mandated local program designation changed from an ambiguous 'yes no' (reflecting the now-removed RCFE provisions) to a clear 'no,' and associated reimbursement language was removed since no local program mandate remains.

The backup power requirement now applies only to facilities licensed to provide care for 16 or more residents in an 'assisted living unit' rather than all residential care facilities for the elderly with 16 or more residents. New definitions of 'assisted living services' and 'assisted living unit' are added to clarify this narrower scope.

A new provision clarifies that for facilities providing multiple levels of care (not just assisted living), the backup power requirements apply only to the assisted living unit portion of the facility, not to other care levels.

The compliance deadline is split into two tiers: for-profit facilities must have an alternative source of power by January 1, 2030 (delayed from the previous single 2028 deadline), and nonprofit facilities must comply by January 1, 2032. The bill itself takes effect on January 1, 2027.

A new civil penalty provision allows penalties of up to $100 per day for non-compliance, capped at $2,000 total. The department is also authorized to suspend or revoke a facility's license and permanently revoke a licensee's ability to operate or act as an administrator of any facility in the state.

Section 1569.695 is restructured: the existing version is amended to sunset on January 1, 2027, and a new permanent version is added that becomes operative on that date. The emergency plan requirement to identify the alternative source of power is updated to reference the separate 2030 (for-profit) and 2032 (nonprofit) deadlines.

Assembly Member Rogers was added as a coauthor of the bill.

A new section amending Civil Code Section 1798.140 (CCPA definitions) was added to the bill. This removes the provision that publicly available sensitive personal information is not considered sensitive personal information or personal information, meaning businesses can no longer treat publicly available sensitive data as outside CCPA protections.

The bill title and legislative digest now reference an act amending Section 1798.140 of the Civil Code relating to consumer privacy, expanding the bill beyond its original focus on residential care facility backup power requirements.

Assembly Member Bonta was added as a coauthor of the bill.

The compliance deadline for for-profit residential care facilities (16+ residents in assisted living units) to have an alternative source of power was delayed from January 1, 2028 to January 1, 2030, giving facilities two additional years to comply.

The requirement for facilities to include backup power information in their emergency and disaster plan also shifted from January 1, 2028 to January 1, 2030 for for-profit facilities.

The fiscal note changed the state-mandated local program designation from 'yes' to 'no', indicating the bill no longer imposes costs on local agencies requiring state reimbursement.

The compliance deadline for residential care facilities licensed for 16 or more residents to have an alternative source of power was extended from January 1, 2027 to January 1, 2028. This gives facilities one additional year to install generators, batteries, or other qualifying power systems.

The definition of 'alternative source of power' was expanded. The prior version listed 'renewable electrical generation facilities' as an example; the amended version changes this to 'renewable energy facilities, and renewable energy microgrids,' explicitly adding microgrids as a recognized category of acceptable alternative power.

Minor wording cleanup in Section 1569.695(a)(7)(A)(i): the phrase 'Beginning power that could include' was revised to simply 'that could include,' removing an apparently stray word.

The requirement for a residential care facility for the elderly to have an alternative source of power providing at least 72 hours of backup during any power outage now applies only to facilities licensed for 16 or more residents. Smaller facilities are exempt from this mandate.

The legislative counsel's digest was updated from 'as introduced' to 'as amended' and now specifies that the bill applies to facilities licensed for 16 or more residents, reflecting the narrowed applicability.

The emergency and disaster plan provision (Section 1569.695(a)(7)(A)) was restructured into two sub-parts: (i) general procedures for provision of emergency power including generator identification, and (ii) a separate requirement, effective January 1, 2027, for facilities licensed for 16 or more residents to identify their elected alternative source of power in the plan. The 16-or-more-resident threshold is applied here as well.