Civ. Code, § 53.5

(a) Notwithstanding any other law, except as specified in this section, an innkeeper, hotelkeeper, motelkeeper, lodginghouse keeper, or owner or operator of an inn, hotel, motel, lodginghouse, or other similar accommodations, or any employee or agent thereof, who offers or accepts payment for rooms, sleeping accommodations, or board and lodging, or other similar accommodation, shall not disclose, produce, provide, release, transfer, disseminate, or otherwise communicate, except to a California peace officer, all or any part of a guest record orally, in writing, or by electronic or any other means to a third party without a court-issued subpoena, warrant, or order.

(b) Notwithstanding any other law, except as specified in this section, an owner or operator of a private or charter bus transportation company, or any employee or agent thereof, shall not disclose, produce, provide, release, transfer, disseminate, or otherwise communicate, except to a California peace officer, all or any part of a passenger manifest record orally, in writing, or by electronic or any other means to a third party without a court-issued subpoena, warrant, or order.

(c) “Guest record” for purposes of this section includes any record that identifies an individual guest, boarder, occupant, lodger, customer, or invitee, including, but not limited to, their name, social security number or other unique identifying number, date of birth, location of birth, address, telephone number, driver’s license number, other official form of identification, credit card number, or automobile license plate number.

(d) “Passenger manifest record” for purposes of this section includes any record that identifies an individual guest, passenger, customer, or invitee, including, but not limited to, their name, social security number or other unique identifying number, date of birth, location of birth, address, telephone number, driver’s license number, other official form of identification, credit card number, or automobile license plate number.

(e) “Court issued subpoena, warrant, or order” for purposes of this section is limited to subpoenas, warrants, or orders issued by a judicial officer. An administrative subpoena, warrant, or order is not sufficient for purposes of this section.

(f) “Third-party service provider,” for the purposes of this section, means an entity contracted to provide services outlined in the contract that has no independent right to use or share the data beyond the terms of the contract. Records shared with a third-party service provider shall be subject to limitations on further disclosure as described in subdivisions (a) and (b), except as otherwise permitted by this section.

(g) This section shall not be construed to prevent a government entity from requiring a private business to provide business records, including, but not limited to, guest and passenger manifest records, in a public health, civil rights, or consumer protection investigation, or in an investigation conducted pursuant to Section 308.5 of the Public Utilities Code.

(h) This section shall not be construed to prevent a government entity from requiring a private business to provide business records during an audit or inspection if those records omit the personal information described in subdivisions (c) and (d).

(i) This section shall not be construed to prevent a private business from providing business records containing a guest’s or passenger’s name, address, credit card number, or driver’s license number to a third-party service provider, if required, for the sole purpose of effectuating financial payment, including, approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment, from a guest or passenger to the private business for a good or service, or from providing business records to a third-party service provider that the private business contracts with for business-related services.

(j) This section shall not be construed to prevent a private business from providing, where required, business records to a government entity in order to comply with state and federal laws regarding financial oversight and privacy, including, but not limited to, the federal Gramm-Leach-Bliley Act (15 U.S.C. Sec. 6801). Records shared with a government entity or in compliance with the federal Gramm-Leach-Bliley Act shall be subject to the limitations on further disclosure as described in subdivisions (a) and (b), except as otherwise permitted by this section.

(k) This section shall not be construed to prevent a private business from disclosing records in a criminal investigation if a law enforcement officer in good faith believes that an emergency involving imminent danger of death or serious bodily injury to a person requires a warrantless search, to the extent permitted by law.

(l) This section shall not be construed to compel disclosure of a guest record or passenger manifest record by an innkeeper, motelkeeper, lodginghouse keeper, or owner or operator of an inn, hotel, motel, lodginghouse, or other similar accommodation, or an owner or operator of a private or charter bus transportation company, in the absence of a court-issued subpoena, warrant, or order.