While state data privacy legislation is picking up across the U.S., a California bill that just passed the State Senate and has remained largely under the radar, has some privacy experts raising alarm bells.

California’s “Public Right to Know Act,” or SB 1149, would curtail settlement agreements that don’t disclose information about environmental hazards or defective products that are discovered during litigation. To be sure, there are exemptions for disclosing personally identifying information (PII) and medical information in these situations. But they only extend to individuals directly involved in the case, leaving third-parties mentioned in the settlements vulnerable.