(

a) As used in this section: (1) “Authorized person” means a person who has come to possess or access the data lawfully and who continues to maintain the legal authority to possess, access, or use that data, under state or federal law, as applicable. (2) “Data” has the same meaning as defined in

Section of the Penal Code. (

b) It is unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime. (

c) It is unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime. (

d) This

section shall not be construed to limit the constitutional rights of the public, the rights of whistleblowers, and the press regarding matters of public concern, including, but not limited to, those described in Bartnicki v. Vopper, (2001) 532 U.S. 514. (

e) This

section does not limit providing or obtaining data in an otherwise lawful manner for the purpose of protecting a computer system or data stored in a computer system or protecting an individual from risk of identity theft or fraud. (

f) The court in an action pursuant to this

section may award equitable relief, including, but not limited to, an injunction, costs, and any other relief the court deems proper. (

g) Liability under this

section shall not limit or preclude liability under any other law. (

h) A violation of this

section shall not constitute a crime.