US: California amends privacy law to tighten regulation of personal information that reveals immigration status

On October 8, 2023, California Governor Gavin Newsom announced that he had signed AB 947 into law, bringing California in line with other states with comprehensive privacy laws that address personal information revealing immigration status. Companies that fall under the California Consumer Privacy Act (CCPA) should review their personal information practices and make any necessary updates to their processes, such as revising privacy policies.

Effective January 1, 2024, AB 947 amends the CCPA to update its definition of “sensitive personal information” (SPI). SPI is a subset of “personal information” (PI), which the CCPA defines as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. SPI is specifically defined under CCPA to include only certain categories of information, such as a California resident’s social security number or genetic data. AB 947 revises the definition of SPI, so PI that reveals a California resident’s citizenship or immigration status is itself SPI. Depending on the circumstances, such information could include a scan of a non-US passport, a federal Individual Taxpayer Identification Number (ITIN or tax ID), or a person’s nonpublic disclosure of their immigration status over text message.

Once this amendment becomes effective, this information will be subject to CCPA’s heightened protections for SPI, such as its restrictions on how a “business” subject to CCPA may process SPI and the right of a California resident to request that a business limit the use and disclosure of their SPI.

Companies that operate in California or collect or process PI from California residents should determine whether they are subject to the CCPA – ie, as “businesses” or via contract with “businesses” – and review their personal information practices. For example, AB 947 may require a business to update its privacy policy to disclose that it collects and processes SPI that may reveal immigration status.

It is also notable that AB 947 aligns California with the dozen other states that have enacted comprehensive state privacy laws. Personal information and sensitive personal information (or analogous terms) are defined differently across these laws, but, up to this point, only CCPA excluded citizenship and/or immigration status from its definition of SPI. But because what constitutes PI and SPI changes from state to state, it is possible that a document, containing what on its face may appear to be personal information revealing citizenship or immigration status, is treated differently across the states. For example, only California applies its privacy law to PI collected or processed in the commercial or employment context.

For more information, please contact the authors or your DLA Piper relationship attorney.