Gov. Code, § 12916

(a) Nonpublic personal and genetic information held under the bureau’s authority shall be collected, held, and disclosed only as relevant and necessary to accomplish the purposes set forth in this chapter and in a manner permitted by and consistent with federal and California data privacy laws.

(b) Before asking individuals to supply information for its system of records, the bureau shall inform each individual of all of the following:

(1) The authority that authorizes the solicitation of the information and whether disclosure of that information is mandatory or voluntary.

(2) The principal purpose or purposes for which the information is intended to be used.

(3) The routine uses that may be made of the information.

(4) The effects on the individual, if any, of not providing all or any part of the requested information.

(c) The bureau shall not disclose any data contained in its system of records by any means of communication to any person except as necessary to fulfill the purposes of this chapter and pursuant to either a written request by, or the written consent of, the individual to whom the record pertains. Intra-agency, interagency, or public disclosure shall not be permitted without that written authorization.