(a)

1. (1) A person, business, or association shall not knowingly publicly post or publicly display, disclose, or distribute on internet websites or social media, the personal information or image of any designated health care services provider, employee, volunteer, or patient, or other individuals residing at the same home address, with the intent to do either of the following:

   1. (A) Incite a third person to cause imminent great bodily harm to the designated health care services provider, employee, volunteer, or patient identified in the posting or display, or to a coresident of that person, where the third person is likely to commit this harm.
   2. (B) Threaten the designated health care services provider, employee, volunteer, or patient, identified in the posting or display, or a coresident of that person, in a manner that places the person identified or the coresident in objectively reasonable fear for their personal safety.

2. (2) A designated health care services provider, employee, volunteer, or patient whose personal information or image is made public as a result of a violation of paragraph (1), or any individual entity or organization authorized to act on their behalf, may do either or both of the following:

   1. (A) Bring an action seeking injunctive or declarative relief in any court of competent jurisdiction. If a jury or court finds that a violation has occurred, it may grant injunctive or declarative relief and shall award the successful plaintiff court costs and reasonable attorney’s fees.
   2. (B) Bring an action for money damages in any court of competent jurisdiction. In addition to any other legal rights or remedies, if a jury or court finds that a violation has occurred, it shall award damages to that individual in an amount up to a maximum of three times the actual damages, but in no case less than four thousand dollars ($4,000).

(b)

1. (1) A person, business, or association shall not publicly post or publicly display, disclose, or distribute, on internet websites or social media, the personal information or image of a designated health care services provider, employee, volunteer, or patient if that individual, or any individual, entity, or organization authorized to act on their behalf, has made a written demand of that person, business, or association to not disclose the personal information or image. A written demand made under this paragraph shall include a statement declaring that the individual is subject to the protection of this section and describing a reasonable fear for the safety of that individual or of any person residing at the individual’s home address, based on a violation of subdivision (a). A demand made under this paragraph shall be effective for four years, regardless of whether or not the individual’s affiliation with a designated health care services facility has expired prior to the end of the four-year period.
2. (2) A designated health care services provider, employee, volunteer, or patient whose personal information or image is made public as a result of a failure to honor a demand made pursuant to paragraph (1), or any individual, entity, or organization authorized to act on their behalf, may bring an action seeking injunctive or declarative relief in any court of competent jurisdiction. If a jury or court finds that a violation has occurred, it may grant injunctive or declarative relief and shall award the successful plaintiff court costs and reasonable attorney’s fees.
3. (3) This subdivision does not apply to a person or entity defined in Section 1070 of the Evidence Code.

(c)

1. (1) A person, business, or association shall not solicit, sell, or trade on the internet or social media the personal information or image of a designated health care services provider, employee, volunteer, or patient with the intent to do either of the following:

   1. (A) Incite a third person to cause imminent great bodily harm to the person identified in the posting or display, or to a coresident of that person, where the third person is likely to commit this harm.
   2. (B) Threaten the person identified in the posting or display, or a coresident of that person, in a manner that places the person identified or the coresident in objectively reasonable fear for their personal safety.
2. (2) A designated health care services provider, employee, volunteer, or patient whose personal information or image is solicited, sold, or traded in violation of paragraph (1), or any individual, entity, or organization authorized to act on their behalf, may bring an action in any court of competent jurisdiction. In addition to any other legal rights and remedies, if a jury or court finds that a violation has occurred, it shall award damages to that individual in an amount up to a maximum of three times the actual damages, but in no case less than four thousand dollars ($4,000).