(b) A transportation agency that employs an electronic toll collection or an electronic transit fare collection system shall establish a privacy policy regarding the collection and use of personally identifiable information and provide to subscribers of that system a copy of the privacy policy in a manner that is conspicuous and meaningful, such as by providing a copy to the subscriber with the transponder, electronic transit pass, or other device used as an electronic toll or transit fare collection mechanism, or, if the system does not use a mechanism, with the application materials. A transportation agency shall conspicuously post its privacy policy on its internet website. For purposes of this subdivision, “conspicuously post” has the same meaning as that term is defined in paragraphs (1) to (4), inclusive, of subdivision (b) of Section 22577 of the Business and Professions Code. The policy shall include, but need not be limited to, a description of the following:

1. (1) The types of personally identifiable information that is collected by the agency.
2. (2) The categories of third-party persons or entities with whom the agency may share personally identifiable information.
3. (3) The process by which a transportation agency notifies subscribers of material changes to its privacy policy.
4. (4) The effective date of the privacy policy.
5. (5) The process by which a subscriber may review and request changes to any of the subscriber’s personally identifiable information.

(e)

1. (1) Except as authorized in paragraphs (2) and (3), a transportation agency may make personally identifiable information of a person available to a law enforcement agency only pursuant to a search warrant. Absent a provision in the search warrant to the contrary, the law enforcement agency shall immediately, but in any event within no more than five days, notify the person that the person’s records have been obtained and shall provide the person with a copy of the search warrant and the identity of the law enforcement agency or peace officer to whom the records were provided.
2. (2) This section does not prohibit a peace officer, as defined in Section 830.1 or 830.2 of the Penal Code, when conducting a criminal or traffic collision investigation, from obtaining personally identifiable information of a person if the officer has good cause to believe that a delay in obtaining this information by seeking a search warrant would cause an adverse result, as defined in subparagraphs (A) to (E), inclusive, of paragraph (2) of subdivision (a) of Section 1524.2 of the Penal Code.
3. (3) This section does not prohibit a transportation agency that employs an electronic toll collection system from providing the date, time, and location of a vehicle license plate read captured by the system to a peace officer, as defined in Section 830.1 or 830.2 of the Penal Code, in response to an alert pursuant to Section 8594, 8594.5, 8594.10, 8594.11, 8594.13, 8594.14, or 8594.15 of the Government Code containing a license plate number of a vehicle.

(q)

1. (1) In addition to any other remedies provided by law, a person whose personally identifiable information has been knowingly sold or otherwise provided in violation of this section may bring an action to recover either actual damages or two thousand five hundred dollars ($2,500) for each individual violation, whichever is greater, and may also recover reasonable costs and attorney’s fees.
2. (2) A person whose personally identifiable information has been knowingly sold or otherwise provided three or more times in violation of this section may bring an action to recover either actual damages or four thousand dollars ($4,000) for each individual violation, whichever is greater, and may also recover reasonable costs and attorney’s fees.