Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information, as defined, to disclose a breach in the security of the data to a resident of California whose encrypted or unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, as specified. Existing law requires that disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

This bill would instead specify that disclosures be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or on a rolling basis while taking any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. would, in the event that a person or business delays full disclosure of the security breach due to the determination of the scope of the breach or the restoration of the reasonable integrity of the data system, require the person or business to disclose as much information as it can, to as many affected residents as it can, and as soon as it can, on a rolling basis.

Existing law requires an operator of a commercial Internet Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit the commercial Internet Web site or online service to conspicuously post, or make available, its privacy policy, as specified.

Existing law creates the Department of Consumer Affairs in the Business, Consumer Services, and Housing Agency. Existing law establishes among the powers and duties of the Director of Consumer Affairs, the duty to propose and assist in the creation and development of consumer education programs. Justice, headed by the Attorney General. The department is required, among other duties, to provide summary information involving specified incidents through the departments Web portal, as specified.

This bill bill, on or after January 1, 2020, would require the department to establish an Internet Web portal linked to its Consumer Information Center Internet Web page that contains links to the personal data privacy policies of online platforms, including social media, as specified.

Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This bill would state the intent of the Legislature to enact legislation that would create a new state agency or officer that would be charged with, among other things, protecting the personal information of California residents. ensure that personal information can be removed from the database of an edge provider, as defined, when a user chooses not to continue to be a customer of that edge provider.

Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This bill would state the intent of the Legislature to enact legislation that would create a new state agency or officer that would be charged with, among other things, protecting the personal information of California residents.

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: AB 2182 (Author:Levine)

Version: June 18, 2018

Hearing Date: June 26, 2018

Fiscal: Yes

Urgency: No

Consultant: TSG

SUBJECT

Privacy: Department of Consumer Affairs: online platforms: personal data privacy

DESCRIPTION

This bill would direct the California Department of Justice to establish an Internet Web portal where consumers could find links to the personal data privacy policies of online platforms.

BACKGROUND

Online privacy – or, more to the point, the lack thereof – has been a source of growing public concern in the past year. There have been alarming media revelations about the detailed level of information that Internet giants like Facebook, Apple, and Google possess about their users and how that information has been put to use for commercial and political purposes.

In order to make it easier for California consumers to judge for themselves how well any given Internet platform safeguards user’s personal information, this bill would direct the California Department of Justice to establish an online repository for links to the personal data privacy policies of online platforms. The online platforms would be responsible for updating the links with any policy revisions. Any online platform that already notifies users about its privacy policies would be exempt.

CHANGES TO EXISTING LAW

Existing law provides, under the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. Article 1, Sec. 1.)

Existing law requires online businesses that collect personally identifiable information (PII) about California consumers through the internet to conspicuously post their privacy policies on their websites. Those privacy policies must, among other things:

• identify the categories of PII that the business collects through the website and the categories of third-party persons with whom the business may share that information;
• provide a description of any available process for an individual consumer who uses or visits its commercial website or online service to review and request changes to any of his or her PII that is collected through the website or online service;
• disclose how the operator responds to web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party websites or online services, if the operator engages in that collection; and
• disclose whether other parties may collect PII about an individual consumer's online activities over time and across different websites when a consumer uses the operator's website or service. (Bus. & Prof. Code Sec. 22575.)

This bill would direct the Department of Justice to establish an Internet Web portal, on or after January 1, 2020, where consumers can find links to the personal data privacy policies of online platforms, including, but not limited to, social media, that have been updated or revised to make a material change in their policies.

This bill would make the online platforms responsible for providing the updates and revisions to the department’s Internet Web portal, in a manner determined acceptable by the department.

This bill would not apply to online platforms which notify users of personal data privacy policy updates and revisions electronically, by email, or with a prominent notice on their homepages.

This bill would provide that it shall not be construed to require an online platform to disclose information beyond what is already required by existing law or to authorize a private cause of action for relief or damages.

COMMENT

1. Stated need for the bill

According to the author:

As the widespread use of social media and other online platforms continues to grow, it is increasingly important for consumers to be familiar with and understand these privacy policies and have easy access to them. Given the multiple concerns surrounding privacy and online platforms, this bill would establish a one-stop link to help consumers in California understand how these platforms operate and handle personal information.

Support: None known

Opposition: None known

HISTORY

Source: Author

Related Pending Legislation:

SB 1424 (Pan, 2018) would direct the Attorney General to establish a working group to develop a model policy for social media platforms to use to mitigate the spread of false information on their sites. SB 1424 is currently pending consideration before the Assembly Committee on Arts, Entertainment, Sports, Tourism, and Internet Media.

AB 375 (Chau, 2017) would codify online privacy protections and prohibit the sale of consumer information, as specified. AB 375 is currently pending consideration on the Senate Floor.

Prior Legislation: SB 761 (Lowenthal, 2011) would have instructed the Attorney General to adopt regulations by July 1, 2012, that would require online businesses to provide California consumers with a method for the consumer to opt out of the collection or use of his or her information by the business. SB 761 died in the Senate Appropriations Committee.

Prior Vote:

Assembly Floor (Ayes 75, Noes 0)

Assembly Appropriations Committee (Ayes 11, Noes 4)

Assembly Privacy and Consumer Protection Committee (Ayes 6, Noes 2)

**************

ASSEMBLY THIRD READING

ATR Bill Id:

Author:(Levine)

As Amended Ver:May 25, 2018

Majority vote

SUMMARY: This bill requires, consistent with existing law, that the Department of Consumer Affairs (DCA) establish an internet web portal linked to its Consumer Information Center Internet web page that contains links to the personal data privacy polices of online platforms, including social media. This bill requires that DCA determine the threshold for the number of annual users of, or visitors to, an online platform that will have the privacy policy linked through the portal. This bill provides that nothing in this section shall be construed: 1) to require an online platform to disclose information beyond what is required by existing law; or 2) to authorize a privacy cause of action for relief or damages.

EXISTING LAW:

1. Provides, under the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California Constitution Article 1, Section 1)
2. Requires online businesses that collect personally identifiable information (PII) about California consumers through the internet to conspicuously post their privacy policies on their websites. Those privacy policies must, among other things:
   1. Identify the categories of PII that the business collects through the website and the categories of third-party persons with whom the business may share that information.
   2. Provide a description of any available process for an individual consumer who uses or visits its commercial website or online service to review and request changes to any of his or her PII that is collected through the website or online service.
   3. Disclose how the operator responds to web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer's online activities over time and across third-party websites or online services, if the operator engages in that collection.
   4. Disclose whether other parties may collect PII about an individual consumer's online activities over time and across different websites when a consumer uses the operator's website or service. (Business and Professions Code Section (BPC) 22575.)
3. Establishes in state government the Business, Consumer Services and Housing Agency, and provides that this agency shall consist of several departments, including the DCA. (Government Code Section (GOV) 12804.)
4. Specifies, under the Consumer Affairs Act, the powers and duties of the director of DCA, which include proposing and assisting in the creation and development of consumer education programs, among other things. (BPC 310(f).)

FISCAL EFFECT: According to the Assembly Appropriations Committee, likely minor costs to the Department of Consumer Affairs to post links on its website.

COMMENTS:

1. Purpose of the bill, as recently amended: A prior version of this author-sponsored bill, as analyzed in policy committee, sought to create an office within California state government to be known as the California Data Protection Authority (CDPA), with the singular purpose of protecting the personal information of California consumers that is in the hands of "Big Tech." This bill was recently gutted and amended in the Assembly Appropriations Committee, to instead require the DCA to establish an internet web portal that will contain links to the personal data privacy policies of online platforms, including social media.
2. Author's statement: With respect to the prior version of the bill, the author stated the following:

Right now, California doesn't speak with a single authoritative voice to monitor and regulate Big Tech's growing marketplace of personally identifiable data[.] AB 2182 establishes the California Data Protection Authority, answerable to the Legislature and ultimately to the people of California. It will be tasked with the critical mission of protecting the personal information of California residents by holding Big Tech accountable to the law by way of reasonable regulations. The expertise developed in the California Data Protection Authority will ensure that our regulations evolve in parallel with the inevitable advancements in data collection and analysis.

1. Bill's new approach to providing consumers assistance on privacy issues: Until 2012, there was in California state government, the Office of Privacy Protection (OPP). That office was established to "protect the privacy of individuals' personal information in a manner consistent with the California Constitution by identifying consumer problems in the privacy area and facilitating the development of fair information practices in adherence with the Information Practices Act . . . and to promote and protect consumer privacy to ensure the trust of the residents of this state." (GOV 11549.5 et seq.) While the OPP disbanded due to budget cuts in 2012, it still exists as a matter of statutory law. Moreover, upon disbandment, the Attorney General's (AG) office immediately created a new privacy enforcement unit where the director of that former office was relocated. That resulting unit also includes prosecutors who concentrate on enforcing state and federal privacy laws. Specifically, that unit was set up by the AG to enforce laws regulating the collection, retention, disclosure, and destruction of private information by individuals, organizations, and the government, including laws relating to health privacy, financial privacy, identity theft and data breaches.

Indeed, according to its current website, this Privacy Enforcement and Protection Unit:

• 1. Enforces state and federal privacy laws.
  2. Empowers Californians with information on their rights and strategies for protecting their privacy.
  3. Encourages businesses to follow privacy-respectful best practices.
  4. Advises the Attorney General on privacy matters.

The AG's unit currently includes public resources ranging from: consumer privacy resources; identity theft; protecting children online; business privacy resources; privacy enforcement, laws, and legislation; privacy reports; special protection; privacy and piracy fund; and data breaches. The AG's consumer privacy resources include items on "Online Privacy" such as tips on controlling mobile tracking; tips for consumers, as well as parents specifically, on getting smart about smartphones; and most relevant to this bill, tips on how to read a privacy policy. (See AG Privacy Enforcement and Protection webpage < https://oag.ca.gov/privacy> [as of May 29, 2018].)

As noted above, a previous version of this bill, among other things, would have created a new office under the Department of Consumer Affairs charged with adopting regulations as necessary to protect California residents. Now, as recently amended by the author in the Assembly Appropriations Committee, this bill instead seeks to simply direct the DCA to provide a portal on its Consumer Information Center internet webpage that links to the personal privacy policies of online platforms, including social media.

The bill does not define "online platforms" or "social media" for these purposes, which can have vastly different meanings to different persons, leaving ambiguous exactly which data privacy policies must be linked to on this portal. That being said, the bill does not allow for a private right of action, should DCA incorrectly interpret the intended meaning.

Lastly, whether the AG's website should provide a link to this information, instead, or in addition to, the DCA's Consumer Information Center webpage, remains an open question when considering how to best achieve success in reaching the most number of consumers searching for this information.

1. Related legislation: AB 375 (Chau) of the current legislative session, would enact the California Broadband Internet Privacy Act to give consumers greater control over their personal information when accessing the Internet through a broadband Internet access service provider and thereby better protect their own privacy and autonomy, as specified. That bill is currently on the inactive file on the Senate Floor.
2. Prior legislation: SB 761 (Lowenthal) of 2011, would have required the Attorney General, by July 1, 2012, to adopt regulations that would require online businesses to provide California consumers with a method for the consumer to opt out of the collection or use of his or her information by the business. That bill died in the Senate Appropriations Committee.

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200 FN: 0003419

Date of Hearing: May 9, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 2182

Author:(Levine) – As Amended Ver:March 15, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill establishes a new data protection office within the Department of Consumer Affairs and requires businesses to disclose to California residents when the businesses may disclose personal information to a nonaffiliated third party, as specified. Specifically, this bill:

1. Requires any business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party to state, in plain language, in a privacy policy or user agreement, that it may disclose personal information to a nonaffiliated third party. 
2. Requires the Department of Consumer Affairs to establish the California Data Protection Authority (CDPA) to adopt regulations to standardize online user agreements, facilitate the removal of personal information from an edge provider database, and prohibit edge provider internet websites from conducting potentially harmful experiments on nonconsenting users. In addition, the CDPA must evaluate and determine whether business are in compliance with state and federal personal information protection laws.
3. Defines “edge provider” as any individual or entity in California that provides any content, application, or service over the internet, and any individual or entity in California that provides a device used for accessing any content, application, or service over the internet.

FISCAL EFFECT:

1. Unknown, significant GF costs to DCA, likely in the hundreds of thousands to low millions of dollars annually, for the creation and administration of the CDPA. Actual costs will depend on the specific activities the CDPA performs, which are not specified in this bill.
2. Costs (Public Rights Division Law Enforcement Fund) in the tens of thousands of dollars annually for the Department of Justice (DOJ) to the extent DOJ is tasked with enforcement of CDPA regulations.

COMMENTS:

1. Background and purpose. According to the author:

Right now, California doesn’t speak with a single authoritative voice to monitor and regulate Big Tech’s growing marketplace of personally identifiable data. AB 2182 establishes the California Data Protection Authority, answerable to the Legislature and ultimately to the people of California. It will be tasked with the critical mission of protecting the personal information of California residents by holding Big Tech accountable to the law by way of reasonable regulations. The expertise developed in the California Data Protection Authority will ensure that our regulations evolve in parallel with the inevitable advancements in data collection and analysis.

1. Related legislation. AB 375 (Chau), of the current legislative session, will enact the California Broadband Internet Privacy Act to give consumers greater control over their personal information when accessing the Internet through a broadband Internet access service provider and thereby better protect their own privacy and autonomy. AB 375 is currently on the inactive file on the Senate Floor.

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 17, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2182 (

Author:Levine) – As Amended Ver:March 15, 2018

SUBJECT: Privacy: Department of Consumer Affairs: California Data Protection Authority

SUMMARY: This bill would establish a new data protection office within the Department of Consumer Affairs and otherwise require businesses to disclose to California residents when they may disclose personal information to a nonaffiliated third party, as specified. Specifically, this bill would:

1. Require under state information security law, that any business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party to state, in plain language, in a privacy policy or user agreement, that it may disclose personal information to a nonaffiliated third party. 
2. Codify the intent of the Legislature under this law to ensure that personal information can be removed from the database of an edge provider, as defined, when a user chooses not to continue to be a customer of that edge provider.
3. Require the Department of Consumer Affairs to establish the California Data Protection Authority (CDPA) to adopt regulations as necessary to protect California residents, as specified.
4. Require the CDPA to evaluate the sufficiency of state and federal personal information protection laws in comparison to the protections provided in the state’s data breach law, Section 1798.81.5 of the Civil Code, to determine whether a business that is regulated by those laws shall be deemed in compliance with that statute because they provide greater protection to personal information.
5. Place a condition the existing ability of businesses to be deemed in compliance with the state’s information security law on the basis of their compliance with other state or federal law that provides greater protection to personal information than that provided by this information security law.
6. Define “edge provider” for these purposes as any individual or entity in California that provides any content, application, or service over the internet, and any individual or entity in California that provides a device used for accessing any content, application, or service over the internet.

EXISTING LAW:

1. Provides, under the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Requires online businesses that collect personally identifiable information (PII) about California consumers through the Internet to conspicuously post their privacy policies on their websites. Those privacy policies must, among other things:
   • Identify the categories of PII that the business collects through the website and the categories of third-party persons with whom the business may share that information.
   • Provide a description of any available process for an individual consumer who uses or visits its commercial website or online service to review and request changes to any of his or her PII that is collected through the website or online service;
   • Disclose how the operator responds to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party websites or online services, if the operator engages in that collection.
   • Disclose whether other parties may collect PII about an individual consumer’s online activities over time and across different websites when a consumer uses the operator’s website or service. (Bus. & Prof. Code Sec. 22575.)
3. Establishes the information security law, which requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civ. Code Sec. 1798.81.5(b).)
   
4. Defines “personal information,” for purposes of the data security statute, to include the individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: Social Security number (SSN); driver’s license number or California Identification Card number; account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or medical information, as defined. Personal information does not include publicly available information that is lawfully made available to the general public from government records. (Civ. Code Sec. 1798.81.5(d).)
5. Defines “personal information” more generally for purposes of the Civil Code’s title pertaining to customer records as any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, SSN, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. “Personal information” under this provision does not include publicly available information that is lawfully made available to the general public from federal, state, or local government record. (Civ. Code Sec. 1798.80.)
6. Establishes in state government the Business, Consumer Services and Housing Agency, and provides that this agency shall consist of several departments, including the Department of Consumer Affairs. (Gov. Code Sec. 12804.)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of the bill: This bill seeks to create an office within California state government with the singular purpose of protecting the personal information of California consumers that is in the hands of “Big Tech.” This is an author-sponsored bill.
2. Author’s statement: According to the author, “Right now, California doesn’t speak with a single authoritative voice to monitor and regulate Big Tech’s growing marketplace of personally identifiable data[.] AB 2182 establishes the California Data Protection Authority, answerable to the Legislature and ultimately to the people of California. It will be tasked with the critical mission of protecting the personal information of California residents by holding Big Tech accountable to the law by way of reasonable regulations. The expertise developed in the California Data Protection Authority will ensure that our regulations evolve in parallel with the inevitable advancements in data collection and analysis.”

The author cites several examples as background to support the need for this bill:

The unfathomable amounts of personal data produced on the internet means that regulations are required to safeguard consumers, their privacy and data on the internet.

Significant examples include both the “data harvest” of consumer information by Global Science Research (GSR) and the harmful psychological experiment, which manipulated the moods of non-consenting users through content manipulation.

Facebook, in 2014, gave Global Science Research (GSR) permission to conduct a paid survey, for academic purposes, which allowed access to participants’ profile information. Ultimately, GSR sold the collected data to Cambridge Analytica, providing raw data for close to 50 million profiles, of which only the original 270,000 participants provided consent.

Also in 2014, Cornell University and the University of California, in conjunction with Facebook, conducted a psychological study without participants’ consent. During the course of the study, Experimental evidence of massive-scale emotional contagion through social networks, approximately 700,000 Facebook users were unwittingly subjects in an experiment where content posts were used to manipulate their moods. [Citations omitted.] Notable examples also include the data breach of Yahoo! email account information in 2014 and the 2017 Equifax data breach. [Citations omitted.]

Accordingly, the author writes, AB 2182 establishes the California Data Protection Authority, within the Department of Consumer Affairs, to protect California consumers as follows:

• Prohibit website content providers from conducting harmful psychological experiments;
• Require website content providers to have privacy policies or user agreements that that clearly state they may share personal information with third parties;
• Standardize online user agreements to allow consumers to easily delete personal information from online databases.

1. Recent trends in data breaches: According to the California Attorney General’s (AG) October 2014 Data Breach report, California is “uniquely impacted by data breaches. In 2012, 17 percent of the data breaches recorded in the United States took place in California – more than any other state. Even more troubling, the number of reported breaches in California increased by 28 percent in 2013…and the number of Californians’ records affected increased by over 600 percent.” The AG’s office received reports of 167 breaches affecting more than 500 Californians (the threshold for triggering reporting to the AG under the Civil Code Section 1798.82) for 2013, where records containing personal information of more than 18.5 million California residents were compromised.
   

These breaches are not only growing more frequent, they are expensive events to consumers and businesses alike. According to the AG’s February 2014 “Cybersecurity in the Golden State” report, one study found that “the average cost to victims of a data breach per compromised record is now $136, or $157 if it results from malicious criminal conduct. Additionally, the study notes that costs for businesses that are victims of Internet–based attacks have risen 78 percent per year, on average, over the past four years. And from 2010 through 2013, the time needed to recover from a breach has increased 130 percent. Just as there is a cost involved in cybersecurity protection, there is a cost involved in not protecting the information stored in your systems.”

In 2016, the AG issued an updated data breach report, finding that “[i]n the last four years, nearly 50 million records of Californians have been breached and the majority of these breaches resulted from security failures. Furthermore, nearly all of the exploited vulnerabilities, which enabled these breaches, were compromised more than a year after the solution to patch the vulnerability was publicly available.” Specifically, the 2016 report found the following: In the past four years, the AG received reports on 657 data breaches, affecting a total of over 49 million records of Californians. In 2012, there were 131 breaches, involving 2.6 million records of Californians; in 2015, 178 breaches put over 24 million records at risk. This means that nearly three in five Californians were victims of a data breach in 2015 alone.

Separately, the AG’s 2016 report found that SSNs were the data type most often breached, involved in just under half of all breaches, for a total of 24 million records containing SSNs. That is nearly half of the 49.6 million records of Californians breached in the four-year period. The report also indicated that “[a]s retailers continue their transition to EMV (chip-enabled payment cards), the attractiveness of trying to steal payment card data from in-store systems will decline and the focus of criminals on [SSNs] will likely increase.”

As stated in that report:

With more of our personal information online, it is imperative that organizations employ strong privacy practices. To protect privacy, businesses must have privacy policies that are easy to read and access, inform consumers about material changes to their data handling practices, and carefully select their default settings which often determine how data is collected, used, and shared. Foundational to those privacy practices is information security: if companies collect consumers’ personal data, they have a duty to secure it. An organization cannot protect people’s privacy without being able to secure their data from unauthorized access.

Data breaches, particularly when they involve sensitive information such as [SSNs] and health records, threaten not only the privacy but also the security and economic wellbeing of consumers. Breaches also impact a wide range of industries, from the health care and financial services sectors to retail and small businesses, and pose a threat to critical infrastructure and national security. Now that organizations rely increasingly on the collection and use of personal information and criminals take advantage of security weaknesses to obtain and profit from that same information, it is more important than ever that all of us redouble our efforts to ensure that this data does not end up in the wrong hands.

1. Industry sectors with the largest breaches according to the AG’s 2016 data breach report: While the stated intent of this bill appears to be monitoring and regulating “Big Tech’s” growing marketplace of personally identifiable data, the AG’s 2016 data breach report reflected the following breakdown by industry sectors:

• The retail sector had the largest share of breaches, accounting for 25 percent of breaches and 42 percent of records breached in the past four years. Most retail breaches were caused by malware and hacking, and the type of data most commonly breached was payment card data.
• The financial sector accounted for the second largest share of breaches, 18 percent, and for 26 percent of records breached. The sector showed the greatest susceptibility to breaches caused by insiders (employees, service providers), both through unintentional errors and intentional misuse of privileges. The most common type of data breached in this sector was SSNs.
• Health care, with 16 percent of breaches, continued to be particularly vulnerable to physical breaches, although malware and hacking breaches are starting to increase as the sector’s transition to electronic medical records progresses. The most vulnerable information in health care was medical information, such as patient records, and SSNs.
• Despite generally having less data than larger businesses, small businesses were still a significant breach risk and represented 15 percent of all breaches reported. They were most susceptible to hacking and malware attacks, but also experienced physical breaches at a greater rate than larger businesses.

That being said, the bill, on its face, is not written with a specific focus on “Big Tech” or any other particular industry—it would thus arguably operate to provide a focused look at the handling of personal data by these industries that experienced the largest share of breaches as well.

1. New office with singular focus on protecting consumer privacy: This bill would establish within the Department of Consumer Affairs a new entity, the CDPA, charged with adopting regulations as necessary to protect California residents. These would include, but not limited to, regulations that:

• standardize online user agreements to help users clearly understand what permission a user gives to a company regarding the use and dissemination of his or her personal information;
• facilitate the removal of personal information, as defined under specified law pertaining to customer records under the Civil Code, from an edge provider database when a user chooses not to continue to be a customer of that edge provider; and
• prohibit edge provider internet websites from conducting potentially harmful experiments on nonconsenting users.

Separately, this bill would amend the state information security statute, Section 1798.81.5 of the Civil Code, to hereinafter condition the existing ability of businesses to be deemed in compliance with the that law on the basis that they are in compliance with state or federal law which provides greater protection to personal information than that provided by the provisions described in the data security law on a determination by the CDPA, at least every five years, that those state and federal laws provide greater protections. In furtherance of that change in law, this bill would make CDPA responsible for evaluating the sufficiency of state and federal personal information protection laws in comparison to the protections provided in the state’s data breach law to determine whether a business that is regulated by those laws shall be deemed in compliance with that statute because they provide greater protection to personal information. As a matter of public policy, this would seemingly provide an element of oversight into that safe harbor provision and prevent companies from taking advantage of that safe harbor in unjustified circumstances.

1. Existing state office currently works on privacy issues and data protection issues: Until 2012, there was in California state government, the Office of Privacy Protection (OPP). That office was established to “protect the privacy of individuals’ personal information in a manner consistent with the California Constitution by identifying consumer problems in the privacy area and facilitating the development of fair information practices in adherence with the Information Practices Act . . . and to promote and protect consumer privacy to ensure the trust of the residents of this state.” (Gov. Code Sec. 11549.5 et seq.) While the OPP disbanded due to budget cuts in 2012, it still exists as a matter of statutory law. Moreover, upon disbandment, the AG’s office immediately created a new privacy enforcement unit where the director of that former office was relocated. That resulting unit also includes prosecutors who concentrate on enforcing state and federal privacy laws. Specifically, that unit was set up by the AG to enforce laws regulating the collection, retention, disclosure, and destruction of private information by individuals, organizations, and the government, including laws relating to health privacy, financial privacy, identity theft and data breaches.

Indeed, according to its current website, this Privacy Enforcement and Protection Unit:

• Enforces state and federal privacy laws.
• Empowers Californians with information on their rights and strategies for protecting their privacy.
• Encourages businesses to follow privacy-respectful best practices.
• Advises the Attorney General on privacy matters.

Staff notes that it currently includes public resources ranging from: consumer privacy resources; identity theft; protecting children online; business privacy resources; privacy enforcement, laws, and legislation; privacy reports; special protection; privacy and piracy fund; and data breaches.

Arguably, creating a new office under the Department of Consumer Affairs to adopt regulations that would protect California residents could be seen as redundant in light of this enforcement unit in the AG’s office, and particularly unnecessary if the OPP were ever refunded. On the other hand, the proposed office can be distinguished in that its primary focus is not enforcement of the current laws after a breach has occurred, but rather, assistance of consumers in navigating how to control the use and sharing (and ultimately, the protection) of their data at the outset. This could serve as a useful function in the current climate of data protection issues as many companies argue that consumers already have the ability to control the use and sharing of their private information on their platforms but, practically speaking, consumers of varying levels of tech-sophistication may struggle to utilize those controls to their utmost potential.

1. Disclosure of consumer information shared with nonaffiliated third parties: This bill would amend the state’s information security law, Section 1798.85.1 of the Civil Code, to require businesses that disclose personal information about a California resident pursuant to a contract with a nonaffiliated 3rd party to state, in plain language, in a privacy policy or user agreement, that they may disclose personal information to a nonaffiliated third party. 

Under existing law, the Business and Professions Code already requires that online businesses that collect PII about California consumers through the Internet to conspicuously post their privacy policies on their websites, and that those privacy policies, among other things, identify the categories of PII that the business collects through the website and the categories of third-party persons with whom the business may share that information. Thus, with respect to online businesses, this provision may be redundant; with others, this bill would appear consistent with public policy previously approved by the Legislature in the online context.

1. Arguments in opposition: A coalition of business and technology stakeholders, including CalChamber, CompTIA, California Grocers Association, California Retailers Association, CTIA, and TechNet, among others, writes in opposition to the bill that:

Without question, a steady stream of such regulations could diminish internet speed and functionality as well as potentially harm California’s innovation economy.

The creation of a new regulatory regime is unnecessary given that Californians already enjoy the strongest privacy protections in the country, including, but not limited to, the California Online Privacy Protection Act (CalOPPA). AB 2182 will not further these protections. For example, AB 2182 would require businesses to “state in a privacy policy or user agreement that it may disclose personal information to a nonaffiliated third party.” Yet, CalOPPA already requires websites to feature a conspicuous privacy policy stating exactly what information is collected and with whom it is shared.

Further, AB 2182, without any factual evidence or any policy basis, makes sweeping allegations that “internet web sites are conducting potentially harmful experiments on their users.” Finally, a single-state approach to regulating the internet is antithetical to the forward-looking policies that have made California a world leader in technology.

The Electronic Frontier Foundation (EFF) also writes in opposition, raising issue with the definition of “edge providers” in the bill, as well as the definition of “personal information” in the bill, among other concerns.

1. Related legislation: AB 375 (Chau, 2017) would enact the California Broadband Internet Privacy Act to give consumers greater control over their personal information when accessing the Internet through a broadband Internet access service provider and thereby better protect their own privacy and autonomy, as specified. That bill is currently on the inactive file on the Senate Floor.
2. Prior legislation: SB 761 (Lowenthal, 2011) would have required the Attorney General, by July 1, 2012, to adopt regulations that would require online businesses to provide California consumers with a method for the consumer to opt out of the collection or use of his or her information by the business. That bill died in the Senate Appropriations Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

California Chamber of Commerce

California Cable and Telecommunications Association

California Grocers Association

California Manufacturers and Technology Association

California Retailers Association

CompTIA

Consumer Data Industry Association

CTIA

Data and Marketing Association

Electronic Frontier Foundation

Internet Association

Internet Coalition

State Privacy and Security Coalition, Inc.

TechNet

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200