California state flag

California Privacy Update: Tentative Compromise on Consumer Privacy Act

6/28/2018 Update: Governor Brown signed AB-375 into law on the afternoon of June 28, 2018. The law is named the California Consumer Privacy Act of 2018, and will take effect in January 2020. This will give industry and lawmakers some time to regroup and fine tune the regulations under this new act.

In a last-minute attempt to keep the California Consumer Privacy Act initiative off the November ballot, California lawmakers reached a tentative deal with ballot sponsor Alastair Mactaggart on June 21st to push forward a legislative privacy bill. The deal depends on the bill passing both houses and being signed by Governor Brown by June 28th.

The proposed bill, introduced by State Assembly member Ed Chau and state senator Robert Hertzberg, would give California consumers unprecedented rights to know what information businesses collect about them, where that information comes from, and how that information is shared. The bill also gives consumers the power to stop companies from selling their data.

The bill removes some of the most draconian features of the proposed Consumer Privacy Act, by removing private rights of action for procedural violations of the law, discarding minimum statutory damages for even de minimis violations, and providing a 30-day “right to cure” for businesses. Further, the proposed bill provides some relief for businesses facing “manifestly unfounded or excessive” requests from consumers concerning their data.

Though this compromise bill reduces many of the operational headaches of the proposed ballot initiative, it will likely face strong opposition from the tech sector. Most prominent amongst the initiative’s detractors is the Committee to Protect California Jobs, a PAC composed of the California Chamber of Commerce, TechNet, Internet Association, and technology giants such as Google, AT&T, and Comcast.

While it remains to be seen whether this bill prevents a November ballot showdown, the policy debate around the Consumer Privacy Act is indicative of broader trends towards privacy legislation. Public sentiment in support of state privacy laws is only growing, given the recent Facebook-Cambridge Analytica scandal, and the increasing frequency of large-scale data breaches like those affecting Equifax, Target, and Yahoo. This growing pro-privacy sentiment is not confined to California and follows on the heels of recent cybersecurity legislation in Massachusetts and New York, heightened data breach rules in Idaho and Oregon, and a new federal bill introduced in Congress by Sens. Edward Markey, D-Mass, and Richard Blumenthal, D-Conn. (the “CONSENT” bill).

California’s appetite for regulation is one of the largest in the nation, however, and it has a history of spearheading privacy rules. It was the first state to introduce data breach notification requirements in 2002, and so far, is the only state with specific rules on online privacy notices (under CalOPPA). Compared with other proposed legislation, this would be the widest in scope, increasing the operational burdens of most businesses. Regardless of the outcome of this tentative privacy deal, businesses should pay close attention to privacy developments in California, as they often provide a model for other states.

KUCI local radio logo

Metaverse Law Discusses GDPR and State Privacy Laws on KUCI 88.9 FM Privacy Piracy Radio

On Monday, June 25 at 8 A.M. Pacific, attorney Lily Li appeared as a guest star on KUCI 88.9 FM’s Privacy Piracy radio show. During the half-hour segment, Ms. Li discussed the impact of the recent General Data Protection Regulation, growing developments in state privacy regulation, and the California Consumer Privacy Act.

To listen to this broadcast, please click on the MP3 below.

KUCI 88.9 FM is a commercial free radio station, based out of the University of California – Irvine. For more information, see http://kuci.org/

Privacy Piracy is a half-hour public affairs radio show broadcasting on KUCI 88.9 FM. The show is co-hosted by attorney and privacy consultant Mari Frank and production engineer Lloyd Boshaw. For more information, see http://privacypiracy.org/

1 2