CA AB2677

Expands the definition of "personal information" effective January 1, 2025 to include genetic information, IP addresses, online browsing history, and location information if reasonably capable of identifying an individual.

Prohibits state agencies from using personal information records for purposes other than those for which the information was collected or generated, except as required by state or federal law.

Adds Financial Industry Regulatory Authority to the definition of "regulatory agency" and makes negligent violations (in addition to intentional violations) of the act grounds for employee discipline up to and including termination.

Revises the misdemeanor offense for unlawful disclosure of medical, psychiatric, or psychological information to apply when disclosure is "known or should be known" to violate disclosure provisions, removing the requirement that wrongful disclosure result in economic loss or personal injury.

Simplifies accounting requirements for certain personal information disclosures, requiring agencies to maintain disclosure records for three years after disclosure.