PEN §637.6: (a) No person who, in the course of business, acquires or has access to personal information concerning an individual, including, but not limited to, the individual’s residence address, employment add

(a) No person who, in the course of business, acquires or has access to personal information concerning an individual, including, but not limited to, the individual’s residence address, employment address, or hours of employment, for the purpose of assisting private entities in the establishment or implementation of carpooling or ridesharing programs, shall disclose that information to any other person or use that information for any other purpose without the prior written consent of the individual. (b) As used in this section, “carpooling or ridesharing programs” include, but shall not be limited to, the formation of carpools, vanpools, buspools, the provision of transit routes, rideshare research, and the development of other demand management strategies such as variable working hours and telecommuting. (c) Any person who violates this section is guilty of a misdemeanor, punishable by imprisonment in the county jail for not exceeding one year, or by a fine of not exceeding one thousand dollars ($1,000), or by both that imprisonment and fine.