Pen. Code, § 4017.1

(a) (1) Except as provided in paragraph (2), any person confined in a county jail, industrial farm, road camp, or city jail who is required or permitted by an order of the board of supervisors or city council to perform work, and any person while performing community service in lieu of a fine or custody or who is assigned to work furlough, may not be employed to perform any function that provides access to personal information of private individuals, including, but not limited to, the following: addresses; telephone numbers; health insurance, taxpayer, school, or employee identification numbers; mothers’ maiden names; demand deposit account, debit card, credit card, savings account, or checking account numbers, PINs, or passwords; social security numbers; places of employment; dates of birth; state- or government-issued driver’s license or identification numbers; United States Citizenship and Immigration Services-assigned numbers; government passport numbers; unique biometric data, such as fingerprints, facial scan identifiers, voice prints, retina or iris images, or other similar identifiers; unique electronic identification numbers; address or routing codes; and telecommunication identifying information or access devices.

(2) Notwithstanding paragraph (1), persons assigned to work furlough programs may be permitted to work in situations that allow them to retain or look at a driver’s license or credit card for no longer than the period of time needed to complete an immediate transaction. However, no person assigned to work furlough shall be placed in any position that may require the deposit of a credit card or driver’s license as insurance or surety.

(b) Any person confined in a county jail, industrial farm, road camp, or city jail who has access to any personal information shall disclose that they are confined before taking any personal information from anyone.

(c) This section shall not apply to inmates in employment programs or public service facilities where incidental contact with personal information may occur.