The California Information Practices Act of 1977 is the state law that controls how California government agencies collect, store, share, and correct personal information about residents, and it gives you the right to inspect your records, demand corrections, and sue when an agency gets it wrong.1Franchise Tax Board. Information Practices Act of 1977 Codified at Civil Code Section 1798 and following, it took effect July 1, 1978 and remains the main privacy check on the state agencies that handle everything from your tax file to your professional license.
Who the Law Covers
The IPA reaches every state-level office, department, division, bureau, board, and commission in California. Three pieces of state government sit outside it: the California Legislature, the court system (agencies established under Article VI of the state constitution), and the State Compensation Insurance Fund, which is covered only for records about its own employees.
Local government is not covered. Cities, counties, and school districts fall outside the IPA, and a 2022 bill (AB 2677) that would have pulled them in was vetoed. Private companies are also outside the law entirely. If a business, not a state agency, mishandled your data, the California Consumer Privacy Act is the statute to look at instead.2State of California Department of Justice. California Consumer Privacy Act (CCPA)
What Information Is Protected
The statute defines personal information broadly as any data an agency maintains that identifies or describes an individual. That includes the obvious items — name, Social Security number, home address, phone number — along with physical characteristics, fingerprints, medical history, and financial and employment records. Information qualifies for protection whenever it can reasonably be linked back to you through a name or identifying number, so data that looks anonymous on its surface can still be covered if it can be traced to a specific person.
Your Core Rights Under the IPA
The law builds four duties into every covered agency, and each one is the mirror of a right you can enforce.
Agencies Can Only Collect What They Need
An agency may only maintain personal information that is relevant and necessary to carry out a purpose authorized by the California Constitution, a state statute, or a federal mandate.3California Legislative Information. California Civil Code Section 1798.14 Agencies cannot stockpile data for unrelated uses, and they must collect from you directly whenever practical rather than pulling it from third parties.1Franchise Tax Board. Information Practices Act of 1977
You Have to Be Told Why
Whenever an agency uses a form to collect your personal information, it must give you a written notice. For ongoing relationships, the notice can be delivered once at the start and then at least annually. The notice has to identify the agency and division asking, a contact official for questions, the legal authority for the collection, whether answering is mandatory or voluntary, what happens if you refuse, the purpose, any foreseeable disclosures to other entities, and a statement that you can request to see what the agency keeps about you. The one carve-out: a request for only your name, address, photo, or similar identifying information used purely for identification and communication does not trigger the full notice, though any request for a Social Security number still has to comply with the Federal Privacy Act of 1974.4California Legislative Information. California Civil Code Section 1798.17
Records Must Be Accurate and Secure
Agencies must keep records accurate, timely, relevant, and complete enough to ensure fairness in any decision made about you from that data. They also have to establish reasonable administrative, technical, and physical safeguards against unauthorized access and anticipated threats.5California Legislative Information. California Civil Code Section 1798.21 When sloppy record-keeping causes a wrong decision about your benefits, employment, or license, that accuracy duty becomes the backbone of a civil claim.
You Can See Your Records and Fix Them
You have the right to inspect any state agency record containing your personal information. Refusing a lawful request is itself a ground for suit under the IPA.6California Legislative Information. California Civil Code Section 1798.45 If you find something wrong, submit a written request asking the agency to amend the record. The agency then has 30 days from receipt to either make the correction and notify you, or explain in writing why it is refusing.7California Legislative Information. California Civil Code Section 1798.35 A denial letter has to spell out the agency’s reasons, the procedure for a higher-level review, and the name and contact information of the reviewing official. The head of the agency, or a specific designee, handles that review.
When an Agency Can Share Your Information Without Asking
The default is that an agency cannot disclose personal information in a way that links back to you. The statute then lists the exceptions. An agency can release data to you, to someone acting under your written consent (valid for 30 days unless you agree to a different period in writing), to your guardian or an authorized representative who can prove authorization, or to its own employees, attorneys, and agents who need it for their official duties.
Beyond those, the agency can share with another government body when necessary for that body’s legal duties and compatible with the purpose for which the data was originally collected; when state or federal law requires the disclosure; when the information is subject to release under the Public Records Act; for statistical research in a form that cannot identify any individual, backed by written assurance of research-only use; and in health or safety emergencies, with after-the-fact notice to you. Any sharing outside these categories is a violation.8California Legislative Information. California Civil Code Section 1798.24
Records You Cannot Get Access To
Some categories of law enforcement and investigative files are exempt from the access right. Criminal identification records (identifying details, arrests, charges, sentencing, parole status), active criminal investigation files including informant and investigator reports tied to a person, and records at any stage of the criminal enforcement process from arrest through release are all off limits. A fourth category covers information gathered to evaluate someone’s fitness for a license or public employment, or to investigate a grievance or suspected civil violation. That one is narrower: it applies only while disclosure would compromise the investigation, and the exemption falls away once the investigation closes.9California Legislative Information. California Civil Code Section 1798.40
Suing an Agency Under the IPA
Civil Code Section 1798.45 gives you three grounds to sue a state agency: refusal to let you inspect your records after a lawful request; failure to maintain accurate records when that failure leads to a decision that harms you, such as a denied benefit, a wrongful termination, or a revoked license; and any other IPA violation that has an adverse effect on you. You can file in the superior court for the county where you live, where your principal place of business sits, or where the agency’s records are located.6California Legislative Information. California Civil Code Section 1798.45
What You Can Recover
For claims based on inaccurate records or other IPA violations, the agency is liable for your actual damages, including compensation for mental suffering, plus court costs and reasonable attorney fees.10California Legislative Information. California Civil Code Section 1798.48 A court can also order the agency to stop the violation or grant access to records through an injunction.
A separate provision targets people outside government who intentionally disclose non-public personal information they know came from state agency records. In those cases, the person who leaked the data owes a minimum of $2,500 in exemplary damages on top of any actual damages, plus attorney fees.11Justia Law. California Civil Code Sections 1798.45 Through 1798.53 This is the point most people misread: the $2,500 floor applies to unauthorized third-party disclosures, not to every IPA violation.
Deadline to File
You have two years from the date the cause of action arises to file suit. If the agency willfully misrepresented something material to its liability, the clock restarts: two years from the date you discover the misrepresentation.12California Legislative Information. California Civil Code Section 1798.49
What Filing Costs
A civil complaint in California Superior Court costs $435 to file, rising to $450 in Riverside, San Bernardino, and San Francisco counties because of local courthouse construction surcharges.13Judicial Council of California. Statewide Civil Fee Schedule A prevailing plaintiff can recoup the fee as part of the judgment because the IPA allows recovery of litigation costs.
Criminal Penalties
State employees who intentionally violate the IPA face workplace discipline up to termination. Two kinds of conduct go further and carry criminal charges. Obtaining records under false pretenses — tricking an agency into releasing personal information by misrepresenting who you are or why you need the data — is a misdemeanor punishable by up to a year in jail, a fine of up to $5,000, or both. Intentionally releasing medical, psychiatric, or psychological information in violation of the IPA’s disclosure rules is also a misdemeanor if the disclosure causes economic loss or personal injury.
The false-pretenses charge is not limited to government employees. A private investigator who lies to an agency to pull someone’s file faces the same criminal exposure as a rogue state worker.14Justia Law. California Civil Code Sections 1798.55 Through 1798.57