CA AB499

Prohibits state agencies from mailing full social security numbers to individuals starting January 1, 2023, requiring numbers be truncated to last 4 digits, with limited exceptions for federal law requirements, current/prospective employees, and certain circumstances involving the Controller.

Requires state agencies that mail full or truncated social security numbers to report to the Legislature by September 1, 2021 on when and why they do so, and to submit annual corrective action plans if unable to comply.

Makes all reports, corrective action plans, and related communications confidential and prohibits public disclosure under the California Public Records Act to prevent identity theft targeting of mail.

Extends existing restrictions on sending personal information (phone numbers, driver's license numbers, credit card numbers) in outgoing mail to require sealed correspondence that cannot be viewed from outside.

Defines "outgoing United States mail" to include common carriers such as package express and courier services, and extends the definition of "state agency" to include the California State University.