AB 874 redefines “personal information” to mean: “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
Both AB 1355 and AB 874 also exclude deidentified and aggregated consumer information from the definition of “personal information”.
Presumably, the addition of “reasonably” enhances the relativity perception of de-identification. It means that businesses may have more leeway to argue that data is de-identified because it is not reasonably capable of being associated with a specific consumer or household.
Compare this definition with the GDPR (see recital 26) which advocatess a more rigid approach for anonymity (“anonymous in such a manner that the data subject is not or no longer identifiable”) and for ‘personal data’ (“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly…”).
AB 874 also defines “publicly available” to mean information that is lawfully made available from federal, state, or local records. Publicly available information is out of the ‘personal information’ scope as well.