California Privacy Update: Tentative Compromise on Consumer Privacy Act
6/28/2018 Update: Governor Brown signed AB-375 into law on the afternoon of June 28, 2018. The law is named the California Consumer Privacy Act of 2018, and will take effect in January 2020. This will give industry and lawmakers some time to regroup and fine tune the regulations under this new act.
In a last-minute attempt to keep the California Consumer Privacy Act initiative off the November ballot, California lawmakers reached a tentative deal with ballot sponsor Alastair Mactaggart on June 21st to push forward a legislative privacy bill. The deal depends on the bill passing both houses and being signed by Governor Brown by June 28th.
The proposed bill, introduced by State Assembly member Ed Chau and state senator Robert Hertzberg, would give California consumers unprecedented rights to know what information businesses collect about them, where that information comes from, and how that information is shared. The bill also gives consumers the power to stop companies from selling their data.
The bill removes some of the most draconian features of the proposed Consumer Privacy Act, by removing private rights of action for procedural violations of the law, discarding minimum statutory damages for even de minimis violations, and providing a 30-day “right to cure” for businesses. Further, the proposed bill provides some relief for businesses facing “manifestly unfounded or excessive” requests from consumers concerning their data.
Though this compromise bill reduces many of the operational headaches of the proposed ballot initiative, it will likely face strong opposition from the tech sector. Most prominent amongst the initiative’s detractors is the Committee to Protect California Jobs, a PAC composed of the California Chamber of Commerce, TechNet, Internet Association, and technology giants such as Google, AT&T, and Comcast.
While it remains to be seen whether this bill prevents a November ballot showdown, the policy debate around the Consumer Privacy Act is indicative of broader trends towards privacy legislation. Public sentiment in support of state privacy laws is only growing, given the recent Facebook-Cambridge Analytica scandal, and the increasing frequency of large-scale data breaches like those affecting Equifax, Target, and Yahoo. This growing pro-privacy sentiment is not confined to California and follows on the heels of recent cybersecurity legislation in Massachusetts and New York, heightened data breach rules in Idaho and Oregon, and a new federal bill introduced in Congress by Sens. Edward Markey, D-Mass, and Richard Blumenthal, D-Conn. (the “CONSENT” bill).
California’s appetite for regulation is one of the largest in the nation, however, and it has a history of spearheading privacy rules. It was the first state to introduce data breach notification requirements in 2002, and so far, is the only state with specific rules on online privacy notices (under CalOPPA). Compared with other proposed legislation, this would be the widest in scope, increasing the operational burdens of most businesses. Regardless of the outcome of this tentative privacy deal, businesses should pay close attention to privacy developments in California, as they often provide a model for other states.