Pen. Code, § 5071

(a) The Secretary of the Department of Corrections and Rehabilitation shall not assign any prison inmate to employment that provides that inmate with access to personal information of private individuals, including, but not limited to, the following: addresses; telephone numbers; health insurance, taxpayer, school, or employee identification numbers; mothers’ maiden names; demand deposit account, debit card, credit card, savings account, or checking account numbers, PINs, or passwords; social security numbers; places of employment; dates of birth; state- or government-issued driver’s license or identification numbers; United States Citizenship and Immigration Services-assigned numbers; government passport numbers; unique biometric data, such as fingerprints, facial scan identifiers, voice prints, retina or iris images, or other similar identifiers; unique electronic identification numbers; address or routing codes; and telecommunication identifying information or access devices.

(b) Any person who is a prison inmate, and who has access to any personal information, shall disclose that they are a prison inmate before taking any personal information from anyone.

(c) This section shall not apply to inmates in employment programs or public service facilities where incidental contact with personal information may occur.