(a) For purposes of this article, the following terms have the following meanings:

(1) “Cellular communications interception technology” means any device that intercepts mobile telephony calling information or content, including an international mobile subscriber identity catcher or other virtual base transceiver station that masquerades as a cellular station and logs mobile telephony calling information.

(2) “Local agency” means any city, county, city and county, special district, authority, or other political subdivision of the state, and includes every county sheriff and city police department.

(b) Every local agency that operates cellular communications interception technology shall do both of the following:

(1) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information gathered through the use of cellular communications interception technology from unauthorized access, destruction, use, modification, or disclosure.

(2) Implement a usage and privacy policy to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through the use of cellular communications interception technology complies with all applicable law and is consistent with respect for an individual’s privacy and civil liberties. This usage and privacy policy shall be available in writing to the public, and, if the local agency has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site. The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for using cellular communications interception technology and for collecting information using that technology.

(B) A description of the job title or other designation of the employees who are authorized to use, or access information collected through the use of, cellular communications interception technology. The policy shall identify the training requirements necessary for those authorized employees.

(C) A description of how the local agency will monitor its own use of cellular communications interception technology to ensure the accuracy of the information collected and compliance with all applicable laws, including laws providing for process and time period system audits.

(D) The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of cellular communications interception technology or the sharing of information collected through its use, including the identity of signatory parties.

(E) The purpose of, process for, and restrictions on, the sharing of information gathered through the use of cellular communications interception technology with other local agencies and persons.

(F) The length of time information gathered through the use of cellular communications interception technology will be retained, and the process the local agency will utilize to determine if and when to destroy retained information.

(c) (1) Except as provided in paragraph (2), a local agency shall not acquire cellular communications interception technology unless approved by its legislative body by adoption, at a regularly scheduled public meeting held pursuant to the Ralph M. Brown Act (Chapter 9 (commencing with Section 54950) of Part 1 of Division 2 of Title 5 of the Government Code), of a resolution or ordinance authorizing that acquisition and the usage and privacy policy required by this section.

(2) Notwithstanding paragraph (1), the county sheriff shall not acquire cellular communications interception technology unless the sheriff provides public notice of the acquisition, which shall be posted conspicuously on his or her department’s Internet Web site, and his or her department has a usage and privacy policy required by this section.

(d) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this section may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. The court may award a combination of any one or more of the following:

(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).

(2) Punitive damages upon proof of willful or reckless disregard of the law.

(3) Reasonable attorney’s fees and other litigation costs reasonably incurred.

(4) Other preliminary and equitable relief as the court determines to be appropriate.

(Added by Stats. 2015, Ch. 659, Sec. 1. (SB 741) Effective January 1, 2016.)