California CodesBusiness and Professions Code - BPCDivision 10 — CannabisChapter 16 — RecordsSection 26161.5

(a) A licensee shall not disclose a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.

(b) A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision
(a), to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.

(c) For purposes of this section, “personal information” has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.

(d) For the purposes of this section, “third party” does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee.

(e) This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.