(a) As used in this section, the following terms have the following meanings:

1. (1) “Audio-video communication” means being able to see, hear, and communicate with another individual in real time using electronic means.
2. (2) “Audio-video recording” means a recording of the audio-video communication of a remote online notarial act.
3. (3) “Business” means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of individuals acting in concert that provides a software platform for use by a notarial officer not in the physical presence of the principal to communicate with the principal, enable the performance of a remote online notarial act, and record the performance of the remote online notarial act.
4. (4) “Electronic journal” means a sequential record of remote online notarial acts performed by a notarial officer facilitated by a business.
5. (5) “Encrypt” or “encrypted” means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.
6. (6) “Notarial act” means an act, whether performed with respect to a tangible or electronic record, that a notarial officer may perform under the laws of a state other than California, a foreign state, or under federal law.
7. (7) “Notarial officer” means a notary public or other individual authorized to perform a notarial act.
8. (8) “Notary public” means an individual commissioned to perform a notarial act.
9. (9) “Open format” means information that is formatted in a manner that is platform independent, machine readable, and made available to the public without restrictions that would impede the reuse of that information.
10. (10) “Principal” means an individual for whom a remote online notarial act is performed who has represented to the business that they are located in California.
11. (11) “Record” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in both physical and electronic form.
12. (12) “Remote online notarial act“ or “remote online notarization” means a notarial act performed for a principal by a notarial officer using audio-video communication through a business when the notarial officer is located in a state other than California.
13. (13) “State” means a state of the United States, the District of Columbia, Puerto Rico, the United States Virgin Islands, or any territory or insular possession subject to the jurisdiction of the United States.

(c) For transactions related to a principal, a business shall comply with all of the following:

1. (1)

   1. (A) A business shall create an encrypted electronic journal entry for each remote online notarial act. The business shall enable access to the electronic journal by the notarial officer through secure multifactor means of authentication. The electronic journal shall be capable of providing both physical and electronic copies of any entry made therein. Each electronic journal entry shall contain, at a minimum, the following information:

      1. (i) The date, time, and type of each remote online notarial act. The time entered shall be in Coordinated Universal Time.
      2. (ii) The physical location of the principal as represented to the business by the principal, and the physical location of the notarial officer at the time of the remote online notarial act.
      3. (iii) The title, or a short description if no title exists, of each record that was the subject of the remote online notarial act.
      4. (iv) The electronic signature of each principal.
      5. (v) A statement as to the basis of the notarial officer’s method of identification of the principal.
      6. (vi) A statement that an audio-video recording of the remote online notarial act was made pursuant to subparagraph (B).
      7. (vii) The fee, if any, charged for the remote online notarial act.
      8. (viii) The name of the business that provided the software platform for the performance of the remote online notarial act.
   2. (B) A business shall create an audio-video recording of the audio-video communication of each remote online notarial act facilitated by the business. The business shall enable access to the audio-video recording by the notarial officer through a secure multifactor means of authentication. The audio-video recording shall be created in an open format and shall not include images of any record that was the subject of the remote online notarization.
   3. (C) Each electronic journal entry and audio-video recording shall be retained, in accordance with federal, state, or local law, as applicable.
   4. (D) A business shall provide the principal with a copy of each relevant electronic journal entry and audio-video recording following the completion of a transaction in the most expedient time possible.

2. (2)

   1. (A) A business shall provide each individual for whom a remote online notarial act is to be performed with a prompt asking if the individual is located in California before the performance of a remote online notarial act.
   2. (B) If the individual represents to the business that the individual is located in California in response to the prompt under subparagraph (A), the business shall append a document to the record that is subject to the remote online notarial act. The appended document shall indicate the principal’s response to the prompt, as well as the notarial officer’s location at the time of the remote online notarial act. The failure to obtain or append the document indicating the principal’s location does not affect the validity of the record or the remote online notarial act, and nothing in this section shall be construed to require submission of the appended document referenced in this subparagraph as a condition of recording or acceptance under California law.

3. (3)

   1. (A) A business shall produce an audit trail detailing the following information completed as a part of each transaction involving a remote online notarial act:

      1. (i) The action performed.
      2. (ii) The date and time of the action’s performance in Coordinated Universal Time.
      3. (iii) The name of the party performing the action.
      4. (iv) The Internet Protocol address of the party performing the action.
   2. (B) A business shall encrypt all audio-video communication and all records related to a remote online notarization and shall take reasonable steps to ensure that the audio-video communication used in a remote online notarization is secure from unauthorized interception.
4. (4) A business shall, in the most expedient time possible and without unreasonable delay, notify all appropriate law enforcement agencies and any affected principals of the unauthorized access or use by or disclosure to another person, loss, compromise, theft, vandalism, corruption, or breach of a principal’s personal information or an electronic journal or audio-video recording.

5. (5)

   1. (A) A business shall not access, use, share, sell, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the contents of any of the following related to a principal:

      1. (i) An electronic journal entry.
      2. (ii) The contents of a record that is the subject of a remote online notarial act.
      3. (iii) The audio-video recording of a remote online notarial act.
      4. (iv) Personal information.

   2. (B) Notwithstanding subparagraph (A), a business may access, use, share, disclose, produce, provide, release, transfer, disseminate, or otherwise communicate the contents of clauses (i), (ii), (iii), and (iv) of subparagraph (A) to the extent necessary to do any of the following:

      1. (i) Facilitate the performance of an online notarial act.
      2. (ii) To comply with any other applicable federal, state, or local law, a lawful subpoena or court order, or a lawful request from a law enforcement or regulatory agency.
      3. (iii) Administer, affect, enforce, or process a record provided by or on behalf of a principal or the transaction of which the record is a part.
      4. (iv) As necessary to implement the requirements of this section and to implement the fraud mitigation measures as outlined in NIST Special Publication 800-63A, dated June 2017, promulgated by the National Institute of Standards and Technology, or any successor publication.

(d)

1. (1) For a violation of any provision of this section, a business is liable in civil action to the persons injured thereby for any of the following:

   1. (A) The greater of the following:

      1. (i) Any actual damages sustained by that person as a result of the violation.
      2. (ii) Statutory damages of two hundred fifty dollars ($250) per violation.
   2. (B) Injunctive or declaratory relief. Such relief is presumed to accrue to the benefit of the public.
   3. (C) Any other relief that the court deems proper.
2. (2) In any successful cause of action under this section, the court shall award costs of the action, together with reasonable attorney’s fees, as determined by the court.
3. (3) An action under paragraph (1) shall be brought no later than four years from the date the plaintiff had actual knowledge of the violation.

4. (4)

   1. (A) The Attorney General, a city attorney, including the city attorney of a city and county, a county counsel, or a district attorney may bring a civil action in the name of the people of the State of California against a business for any violation of this article and recover or obtain any of the remedies available under paragraph (1).
   2. (B) An action shall be brought under this paragraph no later than four years from the date the business notifies the Attorney General of the violation that is the basis of the action.

5. (5) A business shall not be vicariously liable for any of the following and shall not be vicariously liable in any civil action brought under this article for any damages proximately resulting from any of the following:

   1. (A) The negligence, fraud, or willful misconduct of the notarial officer, principal, or the person that requested notarization of the record, unless the notarial officer is an employee or agent of the business, in which case the business is responsible for the conduct of the notarial officer to the extent provided under other applicable law.
   2. (B) The contents of records uploaded to the business for remote online notarization.